Noxa

Noxa is a free, open, dead-simple Android app that blocks ads, trackers, and malware across your whole phone — every app, not just the browser — and can hide your IP through an encrypted tunnel when you're on untrusted Wi-Fi. No servers of its own, no accounts, no ads, no data sale. Provably nothing leaves your device — you can read the code and check.

What it does

- System-wide blocking — a local VpnService DNS sinkhole checks every app's lookups against a compiled ~860,000-domain filter (UT1 + StevenBlack + EasyList/EasyPrivacy + OISD + HaGeZi + AdGuard). Blocked domains never connect. - Per-app control + plain-language stats — see which company each app is tracking you for ("Google · Advertising", "Xiaomi · Analytics"), and block any app entirely with one switch. - CNAME uncloaking — catches trackers disguised as first-party subdomains that plain domain-lists miss. - IPv6-proof — DNS is captured over IPv4 and IPv6, so lookups can't slip around the filter on modern networks. - Works on Android TV — appears in the TV launcher; block the trackers baked into every smart-TV app. - Stays on — battery-exemption ask, a self-restarting watchdog, and automatic start after reboot: protection that doesn't silently die. - Encrypted DNS (DoH) — hides your lookups from your ISP/Wi-Fi. - Hide my IP (WireGuard tunnel) — optional; routes through your provider (Proton, Mullvad, IVPN, or your own server). Blocks trackers while tunnelling. Noxa runs no servers. - User allowlist — un-block anything caught by mistake, yourself. - 30-day rolling stats, CSV export, first-run explainer. - Zero telemetry, verifiable. No location permission, no accounts, nothing phones home.

Default experience is one on/off switch. Everything advanced lives one tap deeper.

How it works

Noxa is a local filter built on Android's VpnService — not a real VPN by default. It routes DNS to itself, checks each looked-up domain against a compiled Bloom filter (built offline; the phone never parses raw lists), and drops trackers while forwarding everything else. The optional IP tunnel embeds the official WireGuard library and mode-switches with the blocker (Android allows one VPN at a time).

License

Copyright © 2026 Stojan Tomeski

GNU Affero General Public License v3.0 or later