v1.11.0

Better at the calls and texts that scams lead to, and your own lists now survive a damaged database. The complete list is under v1.11.0 in CHANGELOG.md.

New

• Calling back a scam text. The outgoing call check now also holds a call to a number that showed up in a text CallShield flagged as spam during the last 30 days. Fake bank and delivery texts ask you to call back, and the hold notice tells you which day that text arrived. Contacts and allowed numbers still go straight through.
• A warning about codes during a call. If a one-time code arrives while you're on a call with someone who isn't in your contacts, or in the 10 minutes after, CallShield warns you not to read it out. Bank imposters ask for exactly that code. It has its own notification channel if you'd rather turn it off.
• Reply bait. A first text from a stranger that fishes for an answer without a link, like "Hi mum, this is my new number" or "Is this Sarah?", is caught in English, Spanish, German, Dutch, Portuguese, Italian, French and a few more. On its own it only blocks in aggressive mode, since a real kid with a new phone writes the same thing.
• Trusted number blocks. A doctor's office that calls from 555-234-5601 one day and 555-234-5617 the next can be allowed by its last 2 or 3 digits, from the entry's menu.
• A release card on Home. When a newer CallShield is out, Home shows a card that links to it. The notice is a signed file that syncs with the database, so nothing unsigned can fake it.
• Recommended blocklists. Settings > External blocklists offers OpenCallShield (Colombia), SpamChile (Chile) and Turkish Spam Numbers (Turkey). Nothing downloads until you add one.
• Undo instead of "are you sure?" Clearing the blocked log, blocking an area code and temporary allows or blocks happen right away, with Undo on the message that follows.

Fixes

• Your own lists survive a damaged database. Android deletes a database file as soon as it finds a bad page, and your blocks, allow list and rules used to go with it. They're now copied out first and put back. The screener also stopped letting every call through after a rebuild.
• Restored phones download the whole spam list. After a cloud restore the settings claimed the list was current, so only the changed parts came down.
• Disguised spam. Look-alike letters, invisible characters and fullwidth text are undone before the text checks and your keyword rules run.
• Links that hide their host. A host ending in a dot (evil.com.), a user name in front of the host (paypal.com@evil.com) or a backslash (evil.com\@paypal.com) no longer hides the real one.
• Opt-out footers. In aggressive mode a business's text that says who sent it isn't blocked for its "Reply STOP to opt out" line alone any more.
• Outside North America. A ten-digit number the phone couldn't place isn't scored by North American rules (toll-free, VoIP ranges, campaign ranges, neighbor spoofing and campaign bursts). Phones in the US and Canada behave as before.
• Database numbers keep blocking while any of their evidence is current. A number backed by both an FCC complaint and the database used to stop blocking once the complaint aged out. Phones fix their stored copy once, right after the update.
• Expecting a call lets hidden callers ring too, and on a locked phone the Quick Settings tile asks you to unlock first.
• Settings opens on Blocking, Safety, Notifications and Appearance. What happens to a blocked call now sits in one card under Advanced.

Data

• Database v52 holds 51,363 numbers and 651 ranges. The community report queue was merged, and 366 reported numbers are waiting on more reporters.
• The report Worker runs current code again, with a daily reporter bucket and limits per network.
• A number I've reviewed by hand can now be taken back out of the database, and its community reports go back through the usual checks.

Installing

Download CallShield-v1.11.0.apk below and install it over your current version. Releases since v1.7.37 share one signing key, so the update keeps your settings and blocklist.

Signer certificate SHA-256:

92:0E:58:3A:E6:CE:9F:38:63:A6:B3:B8:84:7E:92:7D:53:A6:6C:38:A2:45:E1:2E:30:CE:12:4C:9F:4A:75:F5

What was checked

1,831 JVM unit tests and the data pipeline suites pass, along with lint, detekt, ktlint and the release build's drift, SBOM and reproducibility checks. On a Galaxy S22 with Android 16 I installed this APK fresh, finished setup and synced the database (51,363 numbers). The in-app changelog shows 1.11.0, Settings lists the three recommended blocklists from the catalog that ships inside the app, and Lookup flags the Munich number from #27 as a reviewed database entry. Protection test passed 25 of 28. The misses were SMS interception, which Android 16 treats as advisory, notification access, which I skipped in setup, and the phone's own security patch level. The test phone has no SIM, so no real call or text was screened. The callback hold, the code warning and the text checks were covered by their tests rather than on the phone.