RWR 1.6.0

Servers behind authentik.

• If your RWR server sits behind authentik forward auth (e.g. Nginx Proxy Manager + authentik), RWR now signs in with authentik in the browser when pairing (OAuth 2 + PKCE), keeps an encrypted, revocable sign-in and renews it in the background. If authentik asks again, RWR shows a notification and a Sign in with authentik button in the Server section.
• No server update needed. Setup: docs/authentik.md (authentik client rwr-android).

SHA-256:

87e8559ebc6d983399bb1062553ca0f4b54ea8ce33f69ae9de187b2a0650f91e  RWR-1.6.0-arm64-v8a.apk
d43f0291641220ea0de19eb1e894972608080b5e13267bcd2a7bd0989c36cd36  RWR-1.6.0-armeabi-v7a.apk
bcf73d340345c2e6aaff1f77aa8ba0a7dff293b0e63b6f7438213249b51ce6a6  RWR-1.6.0-universal.apk

Signing certificate SHA-256: 0cc47cbec28c72addf57966d8aecf04e1636bc18d6dd75dfc90f2c47ee5d6675

RWR 1.5.0

Open-source face detection, no telemetry, ready for F-Droid.

• Face detection now uses the open-source YuNet detector (same as the RWR server) instead of Google ML Kit: about half the CPU, and good at small faces.
• MediaPipe's usage-statistics client can no longer send anything: its Google telemetry transport is replaced by a do-nothing stand-in.
• Fewer false alerts: far-away faces never count, every candidate face is verified, an onlooker must stay half a second.

Privacy note: MediaPipe (eye tracking) contains a usage-statistics client that can send anonymous events to Google. Versions 1.1.0–1.4.0 had internet permission (for the RWR server), so it could have sent some. 1.5.0 removes the sending code entirely.

SHA-256:

56d3d39e858f5826271a6c4ed7cf795cf38b79b3b361fd414ea6af592c90cdff  RWR-1.5.0-arm64-v8a.apk
3a3b22d42ab8aa69dd4bbd63422247e48c116109667aa9cdb6c4bcda6b41d2c0  RWR-1.5.0-armeabi-v7a.apk
80dce229e769fcb9978fc6f5ffd33f9714316e26bf569b16d9f239f5f198c574  RWR-1.5.0-universal.apk

Signing certificate SHA-256: 0cc47cbec28c72addf57966d8aecf04e1636bc18d6dd75dfc90f2c47ee5d6675

RWR 1.4.0

Fewer false alerts, on the phone and on the server (server 1.4.0):

• Faces narrower than 7% of the picture (about 2 m or more away, too far to read your screen) never trigger an alert. Nearly all false alerts were tiny "faces" like ceiling fixtures, bags, hands or distant crowds.
• Every face that would trigger an alert is now checked by the face-landmark model.
• A person must stay in about the same place for half a second before an alert, at any frame rate (in server mode this used to be only 0.15 s).
• Debug view: "too small" faces are shown in grey.

Server users: update to ghcr.io/revocx35/rwr-server:1.4.0.

SHA-256:

8c62c3db47cfdc3d318507dea3f1e1464c738474329420f4dc2ab7b4e0439512  RWR-1.4.0-arm64-v8a.apk
672bba63459b7d05588fe3ac789608562b761acaf8cbcf2ceac333fad71f7f32  RWR-1.4.0-armeabi-v7a.apk
6ccfee14e10a575f6767efc024e0ae9e980e7f0155a6fe3020912bdac0e720ed  RWR-1.4.0-universal.apk

Signing certificate SHA-256: 0cc47cbec28c72addf57966d8aecf04e1636bc18d6dd75dfc90f2c47ee5d6675

RWR 1.3.0

• Server live view: when your RWR server's web UI is watching your camera live (new Live page, server 1.3.0), the app says so in its notification ("Live view open on your RWR server") and on the main screen.
• Server settings: clearer hint that the Immich API key must be re-entered to change the Immich address (server 1.2.1 security fix).

Server users: update to ghcr.io/revocx35/rwr-server:1.3.0. The live view is off until you switch it on in the web UI's Settings.

SHA-256:

c344b2beefdba28b12d4337ee1c7fb12136da1ff403e9f57a67fd1a68c1639ff  RWR-1.3.0-arm64-v8a.apk
2120983ab574de40a1e2188ea494ca8f0872cc86cde2e74ddffaf6c8c5c2bd09  RWR-1.3.0-armeabi-v7a.apk
92d73c43fc5dc076776c97651874e681fffb1a72dfbee86b910265f4cfc9b264  RWR-1.3.0-universal.apk

Signing certificate SHA-256: 0cc47cbec28c72addf57966d8aecf04e1636bc18d6dd75dfc90f2c47ee5d6675

RWR 1.2.0

New: Debug view (main screen → Troubleshooting). A live look at what detection sees: every face, whether it counts as you, as looking or not (and why), head/eye/gaze angles and laser rays, analysis time and fps. Works for detection on the phone and on the server. Nothing is saved; the pop-up is held back while it's open.

Server users: update to ghcr.io/revocx35/rwr-server:1.2.0 for the debug view in server mode (docker compose pull && docker compose up -d).

SHA-256:

287dec8d344b91d9e70be5c22291b57d2fb5b40317cc5946784b9607fce76ba4  RWR-1.2.0-arm64-v8a.apk
62c7cb69906c55837b1f241533bc31e4e8e46f2031ac74e2a085e8d39fdb69fa  RWR-1.2.0-armeabi-v7a.apk
a95999a964f30aeb3d1e671a398f75c6bc9e3b0c96aca44c07cc4be164d82e73  RWR-1.2.0-universal.apk

Signing certificate SHA-256: 0cc47cbec28c72addf57966d8aecf04e1636bc18d6dd75dfc90f2c47ee5d6675

RWR 1.1.1

Fixes false alerts when only you are in view (both detection modes, on the phone and on the server).

• Your face is no longer mistaken for an onlooker when something bigger shows up (a finger near the lens, a half face at the edge of the frame): the owner is the largest face turned toward the camera, followed as you move.
• Phantom faces (stickers, patterns, dark noise) are checked with the landmark model and dropped.
• An onlooker must stay at about the same place for 2 of 3 frames.

Server users: update to ghcr.io/revocx35/rwr-server:1.1.2 (docker compose pull && docker compose up -d).

SHA-256:

20c15d7d85e032e1a0289bedd8dd827fa4789bc65207597dcd71b77e76855d58  RWR-1.1.1-arm64-v8a.apk
58747025f1a86b871398181ffea7966115d9afd29e3085ef5287c6cf4f7c7bc9  RWR-1.1.1-armeabi-v7a.apk
80a815f082b24c2eb7ab53c9d8b6276a4c6673367af71d54ff4e7b4879f98255  RWR-1.1.1-universal.apk

Signing certificate SHA-256: 0cc47cbec28c72addf57966d8aecf04e1636bc18d6dd75dfc90f2c47ee5d6675

RWR 1.1.0: eye tracking, server, clips, Immich

What's new

• Eye tracking: choose Head tracking or Eye tracking in the app. Eye tracking follows the irises
  (MediaPipe Face Landmarker) together with head pose, so it alerts only when the eyes point at your screen,
  even if the head is turned away. Snapshots show "laser eyes" where they look.
• Video clips: save a photo or a clip from N seconds before to N seconds after the alert (0–30 s each).
• Save to Gallery, Immich, or both.
• RWR server (optional, Docker Compose): the phone streams frames to your own server, which runs
  stronger detection (YuNet + iris tracking on every frame), so the phone spends no CPU on detection.
  Pair with a QR code. Server settings can be changed from the app or the web UI.
  Setup: see README.
• Security:
  • TLS everywhere, with the server key pinned via the QR code.
  • Admin login with argon2id, lockouts and optional TOTP 2FA.
  • CSRF protection and a strict CSP on the web UI.
  • Revocable device tokens, encrypted on the phone by the Android Keystore.
  • Write-only Immich API key; hardened container.

The app now requests the Internet permission. It is used only to talk to a server you pair. Without
one, nothing leaves the phone.

Which APK?

File	For
RWR-1.1.0-arm64-v8a.apk	almost every phone from the last ~8 years (recommended)
RWR-1.1.0-armeabi-v7a.apk	older 32-bit phones
RWR-1.1.0-universal.apk	any device (bigger)

Installs over v1.0.x (same signing key).

SHA-256:

ef6904645c794232d7765a20c744933b726c9419f6eca909a75a8af5268320cd  RWR-1.1.0-arm64-v8a.apk
3661892288f42ffeaeb636f63a991cb07415d0dba15c846770c7bc7f7359148e  RWR-1.1.0-armeabi-v7a.apk
edb0db4ec5f6d4841bfffd16137df0af0a2543f56b642a5ba73e6343be1fd2b2  RWR-1.1.0-universal.apk

Signing certificate SHA-256: 0cc47cbec28c72addf57966d8aecf04e1636bc18d6dd75dfc90f2c47ee5d6675

RWR 1.0.1 — battery settings

Battery improvements. Installs over 1.0.0 (same signing key).

New: Battery settings

• Camera frame rate: 5 / 10 / 15 / 30 fps (default 5). The camera itself now runs slower instead of the app throwing away extra frames. If your phone can't go that low, the closest rate it supports is used (often 15).
• Camera resolution: Low 640×480 (default) or High 1280×720 for sharper snapshots.
• Convert only analysed frames (default on): stops converting camera frames that are never looked at.

Changes apply immediately while watching.

How much does it save?

On an Android 17 emulator, CPU use while watching dropped from ~21% to ~17% of one core. The emulator's camera is simulated, so it can't show the saving from the real camera running at a lower frame rate, which is expected to be the bigger part on a phone. Real-device battery numbers are welcome.

Verify

• APK SHA-256: bd076ef775dcf2e4340363877583973ad3fe5b4882a2d430d6c030e521788c3f
• Signing certificate SHA-256 (unchanged): 0c:c4:7c:be:c2:8c:72:ad:df:57:96:6d:8a:ec:f0:4e:16:36:bc:18:d6:dd:75:df:c9:0f:2c:47:ee:5d:66:75

RWR 1.0.0

First release.

RWR watches through the front camera for people looking at your screen from behind. When it sees one, it shows a pop-up with their snapshot over whatever app you're using, posts a notification, and saves the photo to Pictures/RWR.

Install

1. Download RWR-1.0.0.apk below and open it on your phone (allow "install unknown apps" for your browser/file manager).
2. Open RWR and grant Camera, Notifications and Display over other apps.
3. Tap Start watching, or add the Onlooker alert tile to Quick Settings.

Requires Android 10+ and a front camera. Everything runs on-device; the app has no internet permission.

Notes

• Android shows the green camera dot while RWR is watching. The camera is released while the screen is off.
• After a reboot, turn it back on from the tile (Android doesn't let apps start the camera in the background).
• Tested on an Android 17 emulator; feedback from real devices is welcome.

Verify

• APK SHA-256: fbe8da21c044e9dcbfe5fdc425aa550aeba71624b195b06faffe0195dc97a8ed
• Signing certificate SHA-256: 0c:c4:7c:be:c2:8c:72:ad:df:57:96:6d:8a:ec:f0:4e:16:36:bc:18:d6:dd:75:df:c9:0f:2c:47:ee:5d:66:75