v0.1.7 · Android · prototype

VIGIL

What's been following you? A native Android app that watches for personal item-trackers — AirTags, Tile, Samsung SmartTags, Google Find My — that are travelling with you over time. A tracker being near you means nothing. The signal is persistence.

VIGIL main screen: a green "You're clear — nothing has been following you" card, a Stop Watching button, and a High/Medium/Low sensitivity selector.
0tracker ecosystems
0escalation tiers
0internet permission
v0.1.7latest APK
↓ Download APK The clone problem Source on GitHub

Prototype / work in progress. Debug-signed APK — sideload; no Play Store. Read the README.

🛰

The temporal counterpart to OVERWATCH

OVERWATCH is spatial — what surveillance is watching this place, right now. VIGIL is temporal — what has been with you, across time and places. VIGIL reuses OVERWATCH's proven passive-scanning stack and adds a persistent on-device store to reason about a tracker's history.

what it detects

Five ecosystems. One tell: separated from its owner.

VIGIL recognises each BLE wire format and, where the ecosystem signals it, filters to the separated-from-owner state — the only state in which a following tracker is even detectable. Chipolo, Pebblebee, eufy and the rest inherit whichever network their SKU joined, so VIGIL detects the network.

🍎

Apple Find My / AirTag

Mfg data, company 0x004C, type 0x12. Separated when the "maintained" status bit is cleared. ~24 h re-link window.

🟢

Google Find My Device

Service data 0xFEAA, frame 0x40/0x41. Frame 0x41 is the cleartext separated state.

🔵

Samsung Galaxy SmartTag

Service data 0xFD5A; the state byte flags lost / overmature-lost — the following state.

🟩

Tile

Service data 0xFEED / 0xFEEC. No separated signal and a static MAC — always findable, indefinitely.

🔗

DULT (unified, emerging)

Service data 0xFCB2; the near-owner bit (byte 14 LSB) marks separation. The cross-industry standard the whole ecosystem is converging on — VIGIL parses it today.

how it decides

Persistence, not proximity.

A tracker is escalated only when it clears the co-movement test — the same device, seen at many of your distinct places, over a sustained window, while close enough to actually be on you.

📍

≥ N distinct places

Geohash-7 cells; N = 2 / 3 / 4 by sensitivity. A tracker seen only where you dwell isn't following — it lives there.

⏱

≥ 3 sightings over ≥ T minutes

Debounced to one per 15 min; T = 30 / 45 / 90 by sensitivity. Persistence across time, not a single blip.

📶

RSSI proximity gate

It must have been genuinely close — on-body / in-bag — at least once. This is the piece AirGuard omits; it rejects "a Tile in a passing car."

OBSERVED

Seen, logged, geotagged — but hasn't cleared the co-movement test. No alarm.

SUSPICIOUS

Co-moving across your places. VIGIL is watching it closely.

ALERTING

Confirmed following you. Surfaced with the "Make it ring" and hot/cold finder tools.

✓
Allowlist — "This is mine"

Tap a tracker to approve it — your own AirTag, your partner's Tile — and it never alerts again.

✓
Learned offline baseline

VIGIL learns the places you dwell (home, work) as anchors; a tracker seen at an anchor across several days is auto-marked Known (home) — so household tags fall silent on their own, entirely on-device.

screenshots

Spot it, then walk it down.

No account, no map tiles, no cloud — it all runs on the phone. See what's moving with you, wave off your own gear, and when something's left over, home in on it.

VIGIL active list: an ACTIVE (6) list of nearby Apple Find My and Google Find My Device trackers, each showing places seen, signal in dBm, time since last seen, and an It's-mine button.
The active listEvery tracker seen moving with you — signal, places, and how long ago. Tap “It's mine” and your own gear drops out.
VIGIL locate screen for an Apple Find My tracker: a large pulsing radar icon reading Searching… walk around, no signal yet, with a Make-it-ring button.
Locate modePick a suspect and walk — the ripple strengthens as you close in. No signal yet? Keep moving.
VIGIL locate screen for a Google Find My Device tracker reading Close, minus 52 dBm, with a Make-it-ring button and a Ringing… listen for the tracker toast.
Getting warmerLive signal strength as you approach — −52 dBm is close. “Make it ring” forces a silent tracker to give itself up.
the hard part

Catching the clone.

Every shipping detector — AirGuard, iOS, Android's built-in — keys on device identity. A key-rotating clone (Positive Security's Find You: ~2,000 Find My keys, a new one every 30 s) looks like 2,000 one-off devices and evades them all — it tracked a phone for five days with zero alerts.

🎯

Detect the attack, not the device

A rotating clone is one physical radio holding an unbroken, close-range, co-moving RF presence — even as its identity churns thousands of times faster than any standards-compliant tracker is allowed to. VIGIL's PresenceEngine pairs a CUSUM churn trigger with an identity-agnostic presence-track confirmer and the co-movement gate — an "identity-path × churn-path squeeze" that leaves no safe rotation rate. First version implemented and unit-tested against synthetic clone/ambient traces; field-tuning is what remains.

Read the algorithm →
on-device, private

Fully offline. It only listens.

🔒

No INTERNET permission at all

There is no server, no account, no telemetry. Every tracker, every sighting, and the entire learned baseline live in an on-device SQLite database and never leave the phone. Detection is entirely passive — it listens only.

🔔

Make it ring

Tap a suspected tracker to connect over GATT and play its own sound — the DULT-standard way for a victim to locate a hidden AirTag / Find My / Chipolo tag.

🌡

Hot / cold finder

A passive proximity meter — warmer/colder from live signal. Works even on silent or modified tags that refuse to ring, which is exactly when you need it.

get it

Sideload in three steps.

1 · download
  • Grab the latest debug-signed APK from Releases (currently v0.1.7).
2 · install
  • Sideload — allow "install unknown apps" for your browser or files app, then open the APK.
3 · grant + scan
  • Grant nearby-devices + location + notifications, pick a sensitivity, and let it run in the background.

Build from source, read the paper, or file issues: github.com/KaraZajac/VIGIL · the paper