Control.
Android launcher · you decide what you see
Control is a launcher built around one promise: what your phone shows you is up to you. Ads are stripped before they load. Scam and spam noise is held before it reaches you. Known malicious domains are blocked at the door. What's left is the screen you picked — your apps, your browser, your people, on a relay you control — and you can stop worrying about the rest.
A direct APK, signed with Control's own key — every update installs over the last, nothing to uninstall. Android will ask once to allow install from your browser; that's the standard sideload prompt. Needs Android 8 or newer.
No trackers on this page, no cookies, and none in the app either. What the app can and can't do is written down plainly below — including the parts that are staged or phone-dependent.
BROWSER · HOME · WALKIE — APPS RISE FROM THE BOTTOM
Why Control
A phone throws things at you all day that you never asked for. Control's answer isn't a promise to be careful — it's a set of mechanisms that stop each one before it reaches your eyes.
Every name lookup your phone makes is checked against a bundled list of 42,042 known ad and tracker domains. A match gets an instant "does not exist" — the ad is never fetched, never rendered, never seen. It works in the built-in browser and, through the DNS filter, in your other apps too.
Noisy apps' notifications are held in-app instead of lighting up your screen — you read them when you choose, and nothing is deleted behind your back. The blocklist also covers known scam and malicious domains, so a bad link in a text or page goes nowhere when you tap it. And your walkie-talkie and chat reach only your contacts and your channels — there is no public surface for strangers to shout into.
Most phone malware arrives by road: a malicious ad, a poisoned download link, a drive-by page. Control closes those roads — known malware domains are blocked before anything downloads, the browser refuses third-party cookies and trackers, and Reader mode strips scripts and forms out of articles before rendering them.
Stated plainly: Control is not an antivirus scanner — it doesn't scan your files or other apps, and it doesn't claim to. Blocklists cover domains that are known to serve ads, trackers, scams, and malware; a brand-new malicious domain isn't on any list yet. What Control does is cut off the roads this material usually travels, and keep everything you didn't choose off your screen.
The launcher
Browser sits left of Home, the walkie-talkie right of it, and your apps rise from the bottom as a sheet. Hold your finger anywhere on the launcher's own surfaces and a circle menu opens under it — a ring of icons for every part of Control. No dock, no drawer of sponsored tiles, nothing you didn't pick.
Swipe right for the browser, left for the radio, up from the bottom edge for the full app list — search included. Long-press an app to star it as a favorite on Home. The tiny icons at the bottom of the screen are dot-sized and tappable, and Back from anywhere returns to Home.
Tap-and-hold and an eight-icon ring appears centered on your touch: Home, Browser, Walkie, Apps, Chat, Activity, Connections, Settings. Slide onto an icon and let go — or lift and tap. Surfaces that own their gestures (the web page, the tuner, the talk button) never trigger it by accident.
Solid colors, built-in gradients, or a photo from your gallery, with a dim slider so the clock stays readable — applied across every page as one shared layer. Colors and gradients travel inside your profile file; a photo stays on the device, and the app says so.
Mute any app and its notifications are held, not shown — recorded in an in-app list you can read when you choose, never deleted behind your back. A QUIET-all switch silences everything at once. The Activity screen shows what arrived, what was held, and which apps spend your attention and your data.
Search at the top, your profile as a header card, grouped rows that each show their current state in one line — Wi-Fi — HomeNet · Filter on, 12,408 blocked. Real on/off settings are switches right on the row, the way Android does it; the rest open their detail screens.
Ad filter
A launcher alone can't strip ads from other apps, so Control filters the layer they all share: name lookups. A bundled list of 42,042 ad and tracker domains (the StevenBlack unified hosts list) is checked against every DNS question your phone asks.
A local VPN service that captures DNS traffic and nothing else — it never sees your web traffic. Blocklisted names get an instant "does not exist" answer; everything else is forwarded untouched to the resolver you choose (1.1.1.1 by default). Per-app bypass is built in for anything that misbehaves.
Settings walks you through Android's Private DNS with a recommended ad-blocking resolver, and reads back the phone's current mode. The built-in browser enforces the same blocklist on its own requests, so the filtering is identical inside and outside Control.
The honest limit: an app that does its own encrypted DNS (DoH/DoT) can walk around any DNS filter — Control says exactly that in its own settings. What the filter does cover is the ordinary lookups that ads and trackers overwhelmingly rely on.
Browser + Reader mode
The browser is a page of the home screen, not a separate app you leave for — with the same blocklist enforced on every request and third-party cookies off.
Blocked domains never load — ads, trackers, and the page weight that carries them. Bookmarks live in your profile, JavaScript is your switch, and sharing or opening a page in another browser is always one tap away.
When a page is an article, a Read button appears. Reader mode extracts the main content (Mozilla's Readability, bundled in the app) and re-renders it in Control's own dark layout and typography — the launcher owns the presentation, not the site. Scripts, forms, and handlers are stripped before anything renders.
Walkie-talkie
A bank of 50 numbered channels with a sweepable tuner — detents, haptic ticks, an FRS-style frequency readout, tap-to-type direct tune, and a Scan mode that pauses on active channels. Talk works in bursts: hold, speak, release. Nothing transmits on real radio frequencies — the frequency is the channel's identity, and the burst travels over data. Text rides every road alongside the voice, one thread per channel.
Bursts and texts travel as sealed messages through the Control Relay — anywhere in the world, over Wi-Fi or mobile data.
Phones nearby form their own group. One phone hosts: bursts go to it and it relays them to everyone — and arbitrates the floor when two people talk at once, like a repeater.
The same relay engine on your ordinary network — phones find each other with a discovery beacon. No internet needed here either.
Direct to one paired phone over Bluetooth Classic. It's bursty, not fluid — and the app labels it exactly that way.
Make any channel private and it gets its own key. Its join code sits at the bottom of the radio screen — centered, about a third of the screen tall — and tapping it opens the full-screen invite. The screen says it in plain words: this code IS the key — anyone who has it can join; share it like a key. On the mesh, LAN, and Bluetooth roads the key itself gates the channel.
Unconfigured numbers are open channels anyone nearby can tune to — the app says that too, on the channel itself. Offline texts queue and send themselves when a road opens, marked queued → sent in plain words.
Chat
Most chat apps start with an account on somebody else's server. Control's chat runs on the Control Relay — a small store-and-forward post office. Your identity is a cryptographic key generated in your profile. There is no username, no password, no homeserver, no login screen. The chat header says it the way the app does: "You are your profile key."
Every conversation has a channel key. Messages are sealed on your phone with AES-256-GCM before they leave, and the relay stores and forwards ciphertext only — it can see that a channel got a message, never what it says. Exchange a contact card (a QR) with someone and you can talk; group chats share their key the same way.
Because there's no server-side account to log back into, your identity key lives inside your encrypted profile export — the app states it verbatim: "Your identity key travels only inside the encrypted profile file; anyone holding it is you." Move the profile to a new phone and you are still you.
Labeled honestly, in the app: messages are sealed with the conversation's channel key and the relay stores ciphertext only. That is real encryption — and Control still tells you it is not Signal-grade end-to-end encryption, because the channel key is shared by the conversation's members rather than ratcheted per message. Relay chat also reaches other Control users — it's your own network, not a federation with the wider internet.
Connections
Wi-Fi, Bluetooth, cellular, airplane mode, NFC, location, and the filter's VPN status, each with its live state on the card. Since Android 10, normal apps are not allowed to flip the radios themselves — so Control never fakes a switch. Without Deep view you get real status, scanning, pairing, and Android's official panels one tap away. With Deep view on, the same rows become real switches.
| Row | Standard | With Deep view |
|---|---|---|
| Wi-Fi | State, network name, signal, scan & tap-to-connect, Wi-Fi panel | A real on/off switch |
| Bluetooth | State, paired devices, system enable prompt, discovery + tap-to-pair | A real on/off switch |
| Cellular | Carrier, network type, signal, roaming — read-only, plus the internet panel | A mobile-data switch |
| Airplane mode | State + the system settings screen | A switch, behind a press-and-hold confirm — it drops every radio, and the app warns you so |
| NFC | State + settings | A real on/off switch |
| Location | State + settings | — the system screen stays the switch, and the app says why |
Deep view
Android walls the interesting things off from normal apps: other apps' running services, the full system log, real control over permissions. Control builds the same mechanism Shizuku uses — its own shell bridge, a small process that runs with the shell's identity and answers only to Control. Deep-view pairing is built into the app: pair once with the six-digit wireless-debugging code, no computer, and after that a restart is one tap.
Every process and service, the full system log, per-app operations and permissions — the view the Activity screen's base tier honestly can't give you.
The bridge runs a named allowlist of fixed commands — grant or revoke a permission, set an app operation, force-stop, set Private DNS, flip the Connections radios. There is no general command line, ever. System-critical packages sit on a refuse list the bridge itself enforces.
Every write asks first — destructive ones need a press-and-hold. Every attempt, success or refusal, lands in the audit log on the phone. A single Settings switch kills the bridge outright.
Lifecycle, stated in the app: the bridge process doesn't survive a reboot — that's an Android rule, not a bug. Deep view detects it and offers the one-tap restart; the staged start log names each stage (discover → connect → bridge answered), and a Diagnose action can read the bridge's own log back over the connection and show it on screen, so a failure explains itself.
SMS remote control
The last-resort line: when data is down or the phone is across the room, a text message can still run it. A command is obeyed only if all three hold: the feature is switched on (it's off by default), the sender is a contact you've flagged as a controller, and the text carries your command secret — which the phone stores only as a hash. Replies go only to the commanding number, and everything is written to the audit log.
Activate device admin (its policies are limited to lock and wipe — nothing else) and LOCK locks the phone for real. WIPE DEVICE is a separate, deliberately harder command: one text arms it for ten minutes, a second confirms. There is no in-app wipe button at all.
SMS travels through your carrier in the clear; carriers can read texts. The security here is authentication — the phone knows the command came from a controller holding the secret. Keep commands to controls, not secrets. The app says exactly this on its own setup screen.
Profile
Favorites, notification mutes, filter settings, bookmarks, contacts, channels, your background choice — and, since v1.3, your relay identity key — live in one versioned profile file. Export is encrypted-only (AES-256-GCM): there is no plaintext export path.
Protect the file with a passphrase (stretched 200,000 rounds) or a one-time random key. The file can travel by any channel — it's ciphertext.
The import QR carries the key and a fingerprint of the file; the fingerprint is verified before anything decrypts. NFC tag write/read works too; full phone-to-phone NFC transfer is the one piece still staged, and the app labels it that way.
No accounts means nothing to recover from a server. Import the profile and the new phone has your home screen, your people, your channels — and your identity, so your conversations continue as you.
Free, signed, and sideloaded — no store account, no ads, no subscription. Android 8 or newer.
Build history
Calm launcher, notification control, the DNS ad filter, built-in browser with Reader mode, chat, the encrypted portable profile, the 50-channel walkie-talkie over four roads, SMS remote control, the Activity screen, and the governed shell bridge.
Browser, Walkie, and Apps became swipeable pages of the home screen. A found-and-fixed bug had made app lists untappable. Added the set-as-default-home flow and device admin (real SMS lock, two-step device wipe), plus the first computer-free bridge-start machinery.
In-app wireless pairing implemented for real — it paired successfully with a real phone that same evening. Private-channel join codes became a first-class flow, QR pinned to the radio screen. Navigation became tiny page icons plus the long-press circle menu; the dock disappeared. Connections screen and the Android-style Settings with backgrounds arrived.
Matrix is gone: chat and the walkie internet road run on the Control Relay — no accounts, sealed messages, ciphertext-only storage. The app wears this page's design, the layout went spatial (Browser left, Walkie right, Apps from the bottom), and the bridge start was hardened with staged logging and a Diagnose action after a field report from a split-install phone.