Fauxx

An open-source Android privacy tool that poisons data broker and ad-tech profiles by generating continuous, plausible, off-demographic synthetic activity from your device. The goal is simple: bury your real behavioural signal under a steady stream of coherent, believable decoy activity, so profilers cannot tell the real you from the plausible fakes. Not easily filterable noise, but deception that reads as real people.

How it works

Fauxx uses a Demographic Distancing Engine, a layered system that decides what synthetic activity to generate.

- Layer 0, uniform entropy (always active): equal probability across all content categories. - Layer 1, self-report (optional): you optionally provide coarse demographics such as age range, interests, profession, and region. Fauxx then weights away from these categories, generating believable decoy activity in areas you do not care about. - Layer 2, ad-profile import (opt-in, advanced): Fauxx imports the ad-interest profile platforms have already built about you from a data export you provide, such as Google Takeout or Facebook Download Your Information. It reads what the ad networks think they know about you and suppresses those confirmed categories so the decoy activity concentrates on off-profile interests. Fauxx never logs in, reads cookies, or contacts the platforms. - Layer 3, synthetic persona rotation (active when Layer 1 or Layer 2 is enabled): Fauxx rotates to a fresh, coherent persona on a jittered schedule, drawn uniformly over 30 to 90 days and re-rolled each cycle. The persona's channels phase in over days through staggered adoption, so a broker sees no single synchronized change-point to lock onto.

All layers produce a weight map across content categories. These weights multiply together and normalise, so the final distribution sums to 1. Categories are clamped with a minimum weight of 0.001, because absence is still a signal.

Modules

Fauxx poisons through seven complementary channels:

1. Search Poisoning: executes synthetic search queries across Google, Bing, DuckDuckGo, Yahoo, and Yandex, with any engine switchable off. Queries are composed on-device by a per-install grammar model, so they read as natural and topically coherent rather than random. 2. Ad Pollution: loads ad-heavy pages in background WebViews, clicks ads at a sub-1% CTR, and visits ad preference dashboards. 3. Location Spoofing (experimental, off by default): uses Android's MockLocationProvider to feed fake GPS coordinates along plausible paths drawn from a database of over 800 world city centres. This module does not currently do what its name suggests; on Android 14, apps asking for location the normal way still receive your real location. 4. Device Identity: presents a stable, coherent device identity per synthetic persona rather than churning random User-Agents. Canvas fingerprint noise is still injected. 5. Cookie Saturation: visits over 2,400 categorised URLs in isolated background WebViews, accumulating tracker cookies across diverse categories. Per-persona cookie jars keep each synthetic identity separate. 6. App Signals: opens deep links and app store pages for off-profile applications. 7. DNS Noise: resolves a diverse spread of domain names, so DNS lookups visible to ISPs and network trackers reflect the decoy activity.

Privacy guarantees

- On-device only: all demographic data, profile settings, and activity logs stay on your device. - Encrypted database: sensitive tables use SQLCipher encryption with Android Keystore-backed keys. - Import reads only your file: Layer 2 reads the ad-profile export you hand it, and never logs into, modifies, or contacts the ad platforms. - No sensitive attributes: demographic distance rules never include or infer race, ethnicity, religion, sexual orientation, gender identity, disability, or political affiliation. - Domain blocklist: every URL is checked against a hardcoded blocklist of illegal or harmful domains before loading. - Rate limiting: maximum one request per five seconds per domain, and 200 requests per hour at high intensity. - No fingerprinting of users: the app does not track or identify individual users.

License

GNU Affero General Public License v3.0