RWR 1.1.0: eye tracking, server, clips, Immich

What's new

• Eye tracking: choose Head tracking or Eye tracking in the app. Eye tracking follows the irises
  (MediaPipe Face Landmarker) together with head pose, so it alerts only when the eyes point at your screen,
  even if the head is turned away. Snapshots show "laser eyes" where they look.
• Video clips: save a photo or a clip from N seconds before to N seconds after the alert (0–30 s each).
• Save to Gallery, Immich, or both.
• RWR server (optional, Docker Compose): the phone streams frames to your own server, which runs
  stronger detection (YuNet + iris tracking on every frame), so the phone spends no CPU on detection.
  Pair with a QR code. Server settings can be changed from the app or the web UI.
  Setup: see README.
• Security:
  • TLS everywhere, with the server key pinned via the QR code.
  • Admin login with argon2id, lockouts and optional TOTP 2FA.
  • CSRF protection and a strict CSP on the web UI.
  • Revocable device tokens, encrypted on the phone by the Android Keystore.
  • Write-only Immich API key; hardened container.

The app now requests the Internet permission. It is used only to talk to a server you pair. Without
one, nothing leaves the phone.

Which APK?

File	For
RWR-1.1.0-arm64-v8a.apk	almost every phone from the last ~8 years (recommended)
RWR-1.1.0-armeabi-v7a.apk	older 32-bit phones
RWR-1.1.0-universal.apk	any device (bigger)

Installs over v1.0.x (same signing key).

SHA-256:

ef6904645c794232d7765a20c744933b726c9419f6eca909a75a8af5268320cd  RWR-1.1.0-arm64-v8a.apk
3661892288f42ffeaeb636f63a991cb07415d0dba15c846770c7bc7f7359148e  RWR-1.1.0-armeabi-v7a.apk
edb0db4ec5f6d4841bfffd16137df0af0a2543f56b642a5ba73e6343be1fd2b2  RWR-1.1.0-universal.apk

Signing certificate SHA-256: 0cc47cbec28c72addf57966d8aecf04e1636bc18d6dd75dfc90f2c47ee5d6675