How TrapFree works

It explains, device by device, what TrapFree installs, what it can see, what it sends to our server and how to remove it.

The short version

• TrapFree decides on your device. Our server never receives the addresses of pages you visit, video titles, searches or page content.
• On computers, a filter on your own machine reads only YouTube, Instagram, Facebook and TikTok. Banking, email, work tools and every other site pass through without being opened.
• On Android, TrapFree uses an Accessibility service to recognise the Shorts and Reels screens. What it reads stays on the phone.
• On iPhone, TrapFree uses Apple's Screen Time controls. Apple does not let TrapFree see what you watch.
• Our server keeps the shared minutes, your rules, your wallet and your plan, so they are the same on every device.
• Unless you switch it off, our server adjusts your next day's limits by a few minutes to how your days go, from what it already keeps. It never uses your browsing, and never Screen Time data from an iPhone or iPad.

Where each device stands today: Mac — available. Windows, Android, iPhone and iPad — in development; this page describes how they will work and will be updated before each one is released.

Setting up, on every device. The setup is four screens and nothing to type:

1. How strict: Light, Balanced, Strict or Max. This sets your daily minutes on YouTube and Instagram (15, 10, 5 or 5 each) and where the next screens' sliders start.
2. About you, three optional rows and Continue: who you are (Male, Female, Other or Rather not say), your age group (18–24, 25–34, 35–44, 45+ or Rather not say; TrapFree is for adults, so there is no younger group) and where you live (country and state). Your age and where you live help the setup start with the apps that pull people like you the most: where the sliders start, the local apps and sites in each category (for example the short-video apps popular in India join Shorts, Reels and TikTok as always blocked), and whether YouTube or Instagram starts one step stricter. Each answer is kept to suggest settings; "Rather not say" keeps nothing. No GPS and no location permission: the country comes from what your device tells every app (the App Store's country on iPhone and iPad, the SIM's or network's country on Android, the device's region on a computer); the state only if you press Find my state (our server looks up the approximate place of your internet address, at Cloudflare, and stores nothing) or pick it from the list.
3. Your habits: Shorts, Reels, TikTok and adult sites are always blocked, and YouTube and Instagram keep their daily minutes; these rows have no slider. Six sliders follow, for Social media, Movies & series, Shopping, Gaming, Betting & gambling and News & browsing. Each has six levels, from "Rarely" (no limit) to "Can't stop" (once a week, 1 hour), and starts at a suggestion you can move.
4. Ready: a summary of what will be set up, then Install, which opens the steps each device needs (below: the Mac's "Before you install" screen, Android's Accessibility explanation, Apple's Screen Time permission; on Windows the installer has already shown its screen).

After installing you may add your name and sign in, or skip both. Your answers stay on the device until you sign in; then they go to your account, so your other devices start the same (section 1).

Your categories, on every device. Each slider is a rule. "Rarely" leaves the category free. Every other level keeps the category closed, except while you open it: "Sometimes" and "Often" allow a number of opens a day, "Every day", "Hours a day" and "Can't stop" a number of opens a week (for example "Shopping: 3 times a week, 1 hour each"). You open a category yourself, on the Today screen of any of your devices ("Open for 1 hour"). The time starts at once and runs until its end whether you use it or not; closing early does not give it back. A day starts at midnight and a week on Monday at midnight, in your account's time zone, and then the opens start again. An open counts on all your devices: Shopping opened on your Mac is open on your phone too, until the same time. While Focus Lock is on, no category can be opened (one already open stays open until its end). Opening a category is free and is never sold. Changing a level later works like every other rule: stricter at once, looser after a random 3 to 4 days. Each device closes a category in its own way, and each has limits (sections 2 to 5):

Adjusting to how your days go, on every device. Unless you switch it off, our server looks at each of your days and can make the next day a little easier or a little stricter. Each night at 04:00, in your account's time zone, it marks the day that has just ended (midnight to midnight) as good, hard or neither:

• A good day: YouTube and Instagram each stayed under their daily limit, with no door or pass used, and protection was on all day on all your devices.
• A hard day: protection was off on one of your devices, you asked to remove TrapFree from a computer, or you asked to switch off a filter; or you used your last "2 min later" pass of the 7 days that day, and "3 min now" on every app whose limit you reached; or you reached a daily limit before 12:00.
• Any other day counts as neither: it does not count, and it does not break a run.

After 3 good days in a row, the next day YouTube and Instagram each get 10 more minutes. After 2 hard days in a row, the next day is one step stricter: each gets 5 minutes less, never below 5 minutes, and if either limit is already 5 minutes, door 1 ("3 min now") is closed that day; "2 min later" and the wallet stay as they are. Either change lasts from 04:00 until midnight and then ends by itself, and the count starts again. The Today screen says it in one line, for example "+10 minutes today: 3 good days in a row" or "One step stricter today after 2 hard days", and "How your days count" in the app explains it. These numbers are our settings and may change; a reward is never more than 15 minutes, a stricter day never takes more than 10 minutes off a limit or takes it below 5 minutes, and the app always shows the numbers in force.

What the score uses. Only what our server already keeps for the reasons in section 1: the minutes your devices report, the doors and passes you use, and whether protection was on (from the check-ins every 5 minutes, removal requests and filter switch-offs). Never your wallet spends: paying is a choice, so minutes you paid for never make a day good or hard. Nothing new is sent for it, never your browsing, and never diagnostics. On iPhone and iPad the minutes Screen Time counts never leave the device, so they are never part of the score: on an account with only an iPhone or iPad, only doors, passes and protection decide. The day's adjustment still reaches the iPhone and iPad from our server and changes that day's Screen Time limits and door 1.

Why a device cannot fake it. No device creates time.

• The adjustment is set only by our server, for one day; our server ignores one sent by a device.
• Every extra minute TrapFree gives (a door, a pass, wallet time) is a grant signed with our server's key, for your account, one target and one time, and your devices accept no other.
• A reward cannot be bought, saved, stacked, moved to another day or another account, or turned into wallet minutes.
• The minutes are counted on our server, from reports each device signs with its own key.
• Our server also looks for signs of faking: a device reporting no use while its protection self-check fails, reports arriving out of order, or the same grant used twice. Then your account gets no rewards while our support team looks; stricter days still apply. A person in our support team checks every such flag before it is cleared.
• An administrator of a computer can always change or remove software by hand. Your other devices then show that its protection is off or that it stopped reporting, and no such day is a good day.

Your choice. It is on for every account. You can switch it off in Settings › Daily limits ("Adjust my limit to how my days go"): because it can make a day stricter, turning it off is a looser change and waits a random 3 to 4 days, like raising a limit (the app shows the day, never the hour); until then your days keep counting. Turning it on is at once. A computer that is signed out has no adjustment: only our server decides it. The privacy notice (section 4.10) says what is kept, for how long, and your rights.

1. What every device sends to our server

Mostly only while you are signed in. Even when you are signed out, the app checks for settings and updates (app version and platform only), sends feedback only when you press Send, and test builds send diagnostics. Everything goes over an encrypted connection to server.ascendify.pro.

Never sent, on any device: the addresses of pages you visit, video or page titles, searches, what is on a page or screen, screenshots, your contacts, your precise location, or card and bank details.

Nothing more is sent for the daily score ("Adjusting to how your days go", above): our server works it out from the rows above, and your devices receive the day's adjustment with your rules.

2. Mac

Before you install

After Install on the setup's last screen, one more screen comes before macOS asks for your password. It says plainly that TrapFree adds a local certificate (below), and tells you, with links to the Terms of Service and this page:

• Removing TrapFree from this Mac takes time, on purpose. After you ask, a random wait of 14 to 23 hours, then 90 minutes to confirm. You can cancel the removal at any time, and confirmed removal restores your network settings. Paying never shortens this wait. An administrator can always remove software by hand.
• Turning the adult filter or strict network mode off later waits a random 3 to 4 days. Turning either on is instant. Strict mode stops VPN apps, including a work VPN, from connecting. The setup turns the adult filter on, because adult sites are always blocked; strict mode starts as the Mac's default, and that screen says which. [DECISION: CA-02 — whether strict mode starts on or off on a Mac]
• Pressing Install means you agree to the Terms of Service. TrapFree keeps which version of the terms and of this screen you agreed to, and when. While you are signed in, it sends them to your account as a record of your agreement.

What is installed

macOS asks for your password twice: once to install, once to trust the local certificate.

The local certificate: what it can and cannot read

To recognise a Short or a Reel, the filter has to see the page address inside an encrypted connection. The local certificate lets it do that, on your Mac only.

• It is created on your Mac during install. Its private key never leaves your Mac and only the system service can read it. We never see it.
• The filter opens only these sites: youtube.com, youtube-nocookie.com, googlevideo.com, youtu.be, youtube.googleapis.com, youtubei.googleapis.com, instagram.com, cdninstagram.com, Instagram's fbcdn.net servers, facebook.com, tiktok.com, tiktokv.com, tiktokcdn.com, tiktokcdn-us.com and ttwstatic.com.
• For every other site, the filter only passes the encrypted connection through. It learns the site's name (needed to connect) but cannot read the page, and it does not record it.
• On the listed sites, the filter handles everything your browser exchanges with them, including your sign-in to those sites, in memory. It uses only the page address and activity signals (video playing, page loads) to apply your rules. It changes YouTube, Instagram and Facebook pages only to add a small TrapFree script: it turns a tap on a Short or a Reel into a new page load, so the filter can block it, and on YouTube and Instagram it also keeps time with your daily minutes. TikTok pages are not changed. The filter serves the TrapFree block page when a page is blocked. It stores nothing from these pages and sends nothing from them to anyone. The local log records only events like "YouTube blocked", never addresses.
• Technically limited to these sites: since engine version 32 the certificate carries "name constraints": it can only ever be used for the sites above, never for any other site and never for an IP address. An older TrapFree certificate without them is replaced once, automatically. The private key is readable only by the system.
• Removal deletes the certificate.

Strict network mode (optional)

Blocks QUIC (UDP port 443), DNS-over-TLS (port 853), known DNS-over-HTTPS servers, DNS to any server except the family resolver, and common VPN ports and protocols. VPN apps will not connect while strict mode is on. Turning it on is instant; turning it off waits a random 3–4 days. On a signed-in account, switching it on needs Pro; a computer that already has it keeps it if Pro ends.

What this means on a shared or public Wi-Fi network: with the adult filter on, your Mac looks up site addresses at Cloudflare for Families (1.1.1.3) in ordinary, unencrypted DNS, and strict mode blocks encrypted DNS, so every lookup goes unencrypted. Others on that network can see, and could alter, the names of the sites your Mac looks up, and while strict mode is on you cannot use a VPN to protect yourself. Windows works the same way.

What the filter sees in memory

To read the page addresses of YouTube, Instagram, Facebook and TikTok, the filter decrypts your traffic to those sites on your computer. In memory it therefore also sees what you send to them, including their sign-in cookies and, when you sign in there, your password. It never stores, logs or sends them; every other site passes through unread.

Your categories on a Mac

While a category is closed, its websites (TrapFree's list for that category, for example amazon.in and flipkart.com for Shopping) are blocked in the Mac's hosts file, as the sites on your block list are. An open lifts the block until its end. The filter still reads only the sites listed above (the certificate stays limited to them, and categories add none), and the block happens before a connection starts, so TrapFree does not show its own page for a category's sites: your browser shows its own error page instead, for example "This site can't be reached". The Categories card on the Today screen says so, and shows each category's state and its Open button. Because the block is in the hosts file, apps on the Mac that use those websites usually cannot connect either; the Mac does not close apps for a category.

What the Mac sends

Section 1, plus: an hourly update check (it carries only the app version; TrapFree Test's also carries its install id, used only to choose a staged release and never stored), and feedback you choose to send (your text, the site you name, app/engine/macOS versions, an optional email (with a one-way lookup code of it, so deleting your account deletes the messages sent from its email address) and an anonymous install id).

Removing TrapFree from a Mac

In the app, choose to remove TrapFree. A random 14–23 hour wait starts; then you have a 90-minute window to confirm. You can cancel at any time. Confirmed removal deletes every file, service, certificate, hosts entry, firewall rule and DNS setting TrapFree added, and restores your original network settings. Removal never cancels a subscription, and cancelling never needs removal. A Mac administrator can always remove software by hand; the wait is honest friction, not a lock.

If TrapFree blocks something you truly need, our support team can, after checking it is you, send a key that ends the wait on this Mac only (Settings › Remove TrapFree › "I have a key from support"). The key works for 24 hours, once, and only on the Mac it was issued for; we issue at most one per device in 90 days. Removing still asks for your macOS password.

3. Windows (in development)

Windows uses the same engine and rules as the Mac.

Before you install: the installer lists what it will install, then shows the same removal wait as the Mac (a random 14 to 23 hours, then 90 minutes to confirm; paying never shortens it), that turning the adult filter or strict mode off later waits a random 3 to 4 days, and that pressing Install means you agree to the Terms of Service, with a link to them. As on the Mac, the version you agreed to is kept and sent to your account while you are signed in. Then the app opens the setup's four screens; its Install applies your answers through the TrapFree service, with no second notice. The setup turns the adult filter on, because adult sites are always blocked.

Your categories: as on the Mac. While a category is closed its websites are blocked in the hosts file, so your browser shows its own error page, not TrapFree's; apps that use those websites usually cannot connect either, and Windows does not close apps for a category.

Removal: the same random 14–23 hour wait and 90-minute window. "Apps & features" sends you to this flow. Removal takes away the service, firewall filters, certificate, browser policies, hosts entries, proxy and DNS settings and all files, and restores your original settings. A Windows administrator can always remove software by hand; we never claim otherwise. As on the Mac, a key from our support team (Settings › Remove TrapFree, "A support key") can end the wait on this PC only; removing still asks Windows for an administrator.

Antivirus programs sometimes flag local HTTPS filters. We submit every release to Microsoft and the major antivirus companies.

4. Android (in development)

Phones cannot run a filter for other apps' encrypted traffic, so Android uses the tools Google provides. There is no certificate on Android.

The Accessibility service

Before you switch it on (after Install on the setup's last screen, and whenever you turn protection on), TrapFree shows a full-screen explanation and asks you to tap Agree (or No thanks). Only then does it open Android's Accessibility settings, where you turn it on yourself. Usage access and notifications follow, each as its own step.

• Which apps it watches: only YouTube, Instagram, Facebook and TikTok (including Facebook Lite and TikTok Lite) and the browsers Chrome (including Chrome Beta, Dev and Canary), Samsung Internet, Firefox, Edge, Brave and Opera: the 16 apps in the table below, and no others. Android itself keeps the service to this list, and TrapFree cannot add an app without a new app version. Other browsers (for example Vivaldi, Kiwi, Opera Mini, Opera GX or DuckDuckGo) and other apps (for example YouTube Kids) are not watched.
• What it reads: what is on screen in those apps, to recognise the Shorts and Reels screens (by fixed markers in the app's layout, never by guessing), and the address-bar text in those browsers, to match Shorts, Reels, TikTok, adult sites, your block list and the websites of your categories while they are closed.
• What it does: when a blocked screen opens, it presses Back or Home, or taps the app's own Home tab, and shows TrapFree's own block screen with the doors and the wallet. It follows fixed, human-written rules from a signed file our server can update; the file contains data, never code.
• It never blocks uninstalling, switching off TrapFree, Android Settings, the Play Store or the phone dialer, and it never uses device-administrator powers.
• Everything it reads stays on your phone. Nothing from the screen is stored or sent. Our server gets only the minutes and counts in section 1.

The 16 apps the Accessibility service watches, by their Android package name (you can see an app's package name in its Google Play web address):

Other permissions

• Usage access: how long YouTube and Instagram were open, counted on the phone (a backup), and which app is in front, so TrapFree can close the apps of a category while it is closed. Which apps you use stays on the phone.
• Notifications: timer and "time's up" messages.
• Push messages arrive through Google's Firebase Cloud Messaging.
• Private DNS (your own setting, offered once after Notifications): the step-by-step guide for Cloudflare's family filter (below, "Limits").

Your categories on Android

While a category is closed:

• Its apps (TrapFree's list of Android apps for that category, for example Amazon Shopping and Flipkart for Shopping) are closed when they come to the front: Usage access tells TrapFree which app is in front, and TrapFree shows its own block screen ("Shopping is closed."), which says how many opens are left and offers Open TrapFree while some are. Without Usage access, a category's apps are not closed.
• Its websites are closed in the 9 watched browsers above, as your block list is: the Accessibility service reads the address bar and shows the same block screen.
• The Accessibility service's list of apps is not widened for categories: it still watches only the 16 apps above. Other browsers are not covered.
• Facebook (and Facebook Lite) is in the Social media list and is also one of the 16 apps above, for Facebook Reels. While Social media is closed, Facebook is closed like every other category app (Usage access and the block screen); whatever the category's state, the Accessibility service goes on closing Facebook Reels, as before. For a category it presses nothing in the app.
• Usage access reports the app in front after a short delay, so a category's app may show for a moment before the block screen covers it: in our tests about 1 second, and up to about 2.5 seconds the first time (measured on an Android 16 emulator, 16 October 2026: 0.9 to 2.6 seconds from opening the app to the block screen).

Limits

• Blocking only Shorts and Reels inside the apps is best effort: when YouTube or Instagram changes its app, detection can miss until we update the rules.
• Verticals (one Short at a time) work only in part.
• The adult filter works through browser detection and a guided Private DNS setting (family.cloudflare-dns.com) that you switch on yourself. TrapFree uses no VPN.
• Android 17's optional Advanced Protection mode removes Accessibility access from apps like TrapFree. TrapFree detects this and tells you. It can then only count your YouTube and Instagram minutes (with Usage access) and tell you when the time is up; it cannot close them, or Shorts and Reels.

Payments

Wallet minutes and Pro are bought through Google Play.

Removing TrapFree from Android

At any time: switch off TrapFree in Settings → Accessibility, or uninstall it. There is no waiting period on phones. Your other devices then show "Protection off on <phone> since <time>", and that day does not count as within your limit.

5. iPhone and iPad (in development)

iPhone uses Apple's Screen Time controls, the only way Apple allows. There is no certificate on iPhone.

What you allow

After Install on the setup's last screen:

• Screen Time access: you approve it with Face ID or Touch ID.
• Which apps: you choose YouTube, Instagram, TikTok (and Facebook, if you wish) yourself in Apple's app picker. Then, for each category with a limit (any level but "Rarely"), the picker opens once more: you pick that category's apps, or Apple's matching category, with a line on what else Apple puts in it (for example, Apple's Social category also holds WhatsApp). You can pick nothing, and change your picks later in Settings. Apple gives TrapFree only anonymous tokens for your choices; TrapFree cannot see your other apps.
• The Safari extension: you switch it on in Settings. It blocks /shorts and /reels addresses in Safari and counts YouTube and Instagram time there. It decides in Safari and sends no addresses to us.

What happens

• At each app's daily limit (YouTube and Instagram each have their own), Apple's lock screen (a "shield") covers that app, with TrapFree's words and buttons. TikTok is always shielded.
• The shield's buttons offer the doors [once tested], and Use wallet opens the TrapFree app (iOS 26.5 or later), where buying and the 5-second warning happen.
• Websites: Screen Time can block up to 50 sites in total (TikTok, your block-list sites and the best-known websites of each closed category).
• Your categories: while a category is closed, Apple's shield covers the apps and Apple categories you picked for it ("Shopping is closed", with how many opens are left and Open TrapFree while some are), and Safari shows its own "restricted" page for its websites. You open a category in the TrapFree app; Screen Time schedules lift the shield for that open and put it back at its end, even while the app is closed.
• Adult sites are always blocked, with Apple's own adult-website filter, which also turns off Safari Private Browsing; the app says so before you allow Screen Time.

What iPhone cannot do (and we tell you in the app)

• No app can block only Shorts inside the YouTube app, or only Reels inside Instagram. On iPhone those apps are limited as a whole.
• Reels inside the Facebook app cannot be blocked.
• Other browsers (Chrome, Firefox, in-app browsers) are covered only at the limit, and only where they respect Screen Time; some do not. The app shows which ones.
• A category closes only the apps you picked for it and, in Safari, only its best-known websites (within the 50-site limit). Apple's categories hold apps TrapFree does not choose, so picking a whole Apple category may close more than you meant; the line beside the picker says what else is in it.
• No Verticals inside the apps, no strict network mode and no removal wait.
• Sharing minutes with your other devices is best effort on iPhone: Apple reports usage to TrapFree only in one-minute steps.

What TrapFree can see

Apple keeps Screen Time reports inside a sealed area that TrapFree cannot send data out of. TrapFree learns only that a minute of a sector you chose was used. [What the iPhone sends to our server is a decision still open; this line, the privacy notice (sections 4.4 and 5) and the App Store answers will say the same (APP-REVIEW-NOTES section 3.3). Option A (recommended) reads: "The app sends your TrapFree account two numbers for each day, at most once an hour: the budget minutes used on this iPhone so far, to keep one daily budget across your own devices, and how many Shorts, Reels and TikTok pages Safari stopped, for your own progress and weekly report. Never which app, site or page. Nothing is used for analytics, advertising or anyone else." Until the choice is made (option C, the default): "Nothing derived from Screen Time leaves the device: the iPhone keeps its own daily budget."] Diagnostics from iPhone never include anything taken from Screen Time. Nothing from Screen Time is part of the daily score ("Adjusting to how your days go", above), whichever option is chosen for the line before: the iPhone and iPad only receive the day's adjustment from our server, which changes that day's Screen Time limits and door 1 on the shield.

Payments

Wallet minutes and Pro are bought with Apple In-App Purchase. [Only if the fallback build ships: Apple did not allow the wallet on iPhone, so the iPhone app neither sells nor spends wallet minutes. Your minutes stay in your account and work on your other devices.]

Removing TrapFree from iPhone or iPad

At any time: remove TrapFree's Screen Time access in Settings → Screen Time, or delete the app. Your other devices then show "Protection off on iPhone".

6. The 3-day test build

"TrapFree Test" is a separate app for testers, with its own name, folders, services, certificate ("TrapFree Test Local Filter") and proxy port (8090). On a computer it refuses to install if real TrapFree is present; it can only ever remove its own parts. On phones it refuses to block anything while the real app is installed. It works for 3 days, then stops blocking and asks to be uninstalled. Details: the tester agreement.

7. Diagnostics

When we switch diagnostics on from our server, the apps can report technical events: errors, how long operations take, which TrapFree server routes were called and how fast, rule decisions at the level of "YouTube blocked by the daily limit", and self-check results. Never page addresses, titles, searches, page content, phone numbers, emails, tokens, IP addresses, contacts or location. The basic level (errors, self-checks, server timing) is part of running the service; anything more detailed needs your "Help improve TrapFree" setting, which is off until you switch it on. Diagnostics are kept 30 days. The privacy notice has the full list.

8. Questions

[email protected] · Security reports: https://ascendify.pro/.well-known/security.txt