What it finds.What it can’t.

Lens glint. A camera lens, even a pinhole lens, is a retroreflector. Light that goes down the barrel bounces off the sensor and comes straight back along the same line. With the torch on, Clairix watches the viewfinder for small, round, bright spots and tracks each one from frame to frame. A screw head or a glass edge flashes and slides as you pan. A lens holds its place while the scene holds still. A spot that holds still for about two thirds of a second turns red; after about two seconds of stillness it is logged as a finding. If the camera pans, the tracker resets rather than guessing. Only the brightness channel of each frame is read, and no frame is ever saved.

Infrared. Night-vision cameras light the room with infrared LEDs around 850 nm. You cannot see them. Most phone front cameras have a weak infrared filter and can. Switch to IR mode, make the room dark, and point the front camera at smoke detectors, clocks, chargers, outlets and vents. If the room is too bright for a dot to stand out, Clairix says so instead of pretending to look.

Network. Joined to the venue’s Wi-Fi, Clairix sweeps the local subnet for devices that speak camera: the RTSP video ports, the recorder ports used by common surveillance brands, and web interfaces whose banner names a camera maker. It also sends an ONVIF discovery probe, which every ONVIF camera must answer, and browses mDNS for video services, including HomeKit cameras. A device with only a web page and nothing camera-like is not reported; that is every printer and router.

Wi-Fi setup hotspots. A camera that has not been given the venue’s Wi-Fi usually broadcasts its own open hotspot with the maker’s name and a few bytes of its hardware address. Clairix recognises the names used by common covert mini cameras and by mainstream brands, matching whole names so an ordinary network containing “cam” is not flagged.

Bluetooth setup beacons. The same idea over Bluetooth. Clairix listens for twenty seconds to every advertisement in range and reports the ones that name a camera or carry a known provisioning service.

Magnetic gauge. Most covert cameras are mounted with a magnet or sit inside a speaker. With the gauge on and the back of the phone flat to a surface, slide slowly along walls behind the bed, under tables and along shelves. The gauge learns the room’s baseline and shows the deviation. Drywall and wood do not move the needle. If the phone’s compass reports its own readings as unreliable, Clairix tells you to recalibrate rather than showing a false reading.

Guided sweep. Ten steps, from where to stand (the camera has to see its target, so stand where you would be exposed and look back) to the fingernail test for a two-way mirror. Each step is ticked off as you go.

Recognition. Clairix recognises the advertisements of AirTag and other Find My accessories, Tile, Samsung SmartTag and SmartTag 2, Chipolo and Chipolo Spot, Pebblebee, Orbit, Nut, Motorola tags, Invoxia and Eddystone beacons, as well as the generic Bluetooth modules used in hardwired GPS trackers. Known benign devices are filtered out so the list is not your headphones and your neighbour’s television.

Following through rotation. Trackers change their Bluetooth address every few minutes. Clairix links the new address to the old one in two ways. First by fingerprint: the parts of the advertisement that do not change. Second by cadence: how often the device advertises, how tightly it holds that interval, its transmit power and radio features. A link is made only when exactly one candidate fits. A wrong merge would be worse than a missed one, so ambiguity stitches nothing.

Proof of following. “Seen five times over ten minutes” describes a tracker in your bumper, and it equally describes a Tile through a wall. Only movement separates them. Clairix records where each device was heard and confirms a follower only when the same device has been heard at places far enough apart, over long enough, while you were actually travelling. Defaults are about ten minutes and three hundred metres, and you can adjust both. Without a location fix, the stronger claim is simply never made.

Alerts. When a device is confirmed, Clairix posts a high-priority notification that names the device, says how far apart it was heard, and tells you where to check: wheel wells, bumper covers, the OBD port, under seats, bag linings.

Locating. A phone has one antenna and no sense of direction for a Bluetooth signal, but it has a compass, and your body blocks the signal. Hold the phone in front of you and turn slowly. Clairix buckets signal strength by the direction you were facing and marks the strongest direction on a compass rose. Walk that way, watching the warmer-and-colder line and the distance estimate. The estimate is honest to roughly a factor of two indoors, and the screen says “about” for that reason.

Identification and sound. Trackers that implement the industry standard for unwanted location tracking (the DULT accessory protocol) expose a service once they have been away from their owner for a while. Clairix connects once per device and asks it to name its maker and model, to return an obfuscated serial the maker can tie to an account under legal process, and, on your request, to play a sound. Clairix keeps only a hash of the serial. A tracker that refuses the connection is telling you something too: its owner is probably nearby.

Trip memory. Clairix notices when you are driving and scans intensively for the first minutes of each trip, when a tracker on a vehicle is most likely to wake. It remembers which devices were present on each trip. A device that rides along on three separate drives is in the car, even if it was too quiet to be confirmed on any one of them.

Self-test. Your phone can briefly advertise a tracker-like test signal so you can confirm that detection works. On some phones the Bluetooth controller cannot hear its own transmissions. The test says which case you are in rather than claiming a pass.

Pattern of life. From your own location history, Clairix finds the places you stay, works out which is home and which is work, measures how consistent your weekday departure times are and how often you take the same route between the same two places, and gives you a predictability score with suggestions. Everything runs on the phone. Nothing is sent anywhere.

Stalkerware scan. Every installed app is scored on the signals a monitoring app needs: installed from outside a store, or by an installer pretending to be a store; hidden without a launcher icon; enabled as a keyboard (which can log every keystroke); running as an accessibility service (which can read every screen) or a notification listener (which sees every notification, including one-time codes); able to act as the VPN (which sees every byte of traffic); holding an active device-admin grant (which can block its own uninstall); or running a background service for a week without ever showing a screen. Each signal adds to a score, and the score decides whether an app is shown as high, medium or low. Apps from the system image and from genuine stores are recognised, with the exception that a store app itself installed from outside is not trusted to vouch for anything. Clairix also lists every notification listener, accessibility service, VPN app, enabled keyboard and device admin on the phone, including the known-good ones, so you can see the whole picture.

Certificate audit. Your phone will accept a secure connection from any certificate authority in its trust store. A certificate someone installed by hand through Settings is the standard way to read a phone’s encrypted traffic with physical access or a management profile. Clairix lists user-installed roots as high severity and compares system roots against the stock Android bundle, flagging anything a carrier or vendor added.

Interception canary. If you use Comms, Clairix opens a raw connection to the relay every four hours and whenever the network changes, and checks whether the certificate it is shown is the one it pinned the first time. A different key means something between you and the relay is substituting certificates. Clairix also checks whether a proxy is configured on your phone or network and, if so, tests the connection through the proxy too. A corporate proxy that passes the real key through is reported as worth knowing, not as an attack.

Unlock ledger. With a one-time grant, Clairix records every lock-screen success, failure and credential change as it happens, and fills in history from the system’s usage log. It judges whether the phone was used while you slept and tells you in the morning. If someone revokes the grant, that is recorded too.

Biometric tripwire. Someone with your PIN can add their own fingerprint in under a minute and never need the PIN again. Clairix arms a hardware key that Android destroys the moment the set of enrolled fingerprints or faces changes, and checks it on every launch.

Screen recording. On Android 15 and newer, Clairix is told when its own window is inside a screen recording or cast, and warns you. With the app lock on, Clairix also blanks itself out of any recording.

Microphone, camera and audio routes. Clairix shows when another app is recording audio or using a camera. It also watches for a Bluetooth or USB microphone that attaches itself while nothing is playing and no call is up, which is how a paired earpiece left in a bag becomes a live microphone on your phone.

Phone health. One screen with the facts that matter: root, bootloader state, verified boot, SELinux, screen lock, storage encryption, USB and wireless debugging, developer options, installs from unknown sources, security patch age, VPN and private DNS, whether your phone’s Bluetooth name is your real name, and whether it is discoverable.

The canary network. A Karma-style attack works by saying yes to every network a phone asks for. On first run, Clairix generates a random network name that exists nowhere on earth and asks Android to probe for it as a hidden network. Nobody else knows this name. So any access point that answers heard the probe and lied. There is no benign explanation, and that is what zero false positives by construction means.

Bait rules. Early versions of this scanner flagged every carrier hotspot and every dual-band router in the country, which teaches people to ignore it. The rules now describe only what a normal network does not do: an open network using a carrier’s brand, an open twin of a secured network you can also see, and the default names of known interception and research equipment.

Cell tower baseline. A fake tower cannot be told from a real one by looking at the spectrum, but it does change what your modem reports: which cell serves you, on what technology, how loud, with how many neighbours. Clairix samples these every fifteen seconds while the scanner runs and builds a baseline of the cells you normally see at the places you normally are. It then scores indicators such as a downgrade to an older network technology, a cell ID that does not belong in the area it claims, an area change while you are standing still, an unusually strong signal, an unknown cell at a familiar place, a tower that lives for seconds, rapid switching between cells or technologies, a cell with no visible neighbours, and a transmitter that is physically within about eighty metres of you. Scores accumulate. One indicator is noise; several at once are a problem, and that is when you are told.

Honest about maturity. Rules that describe standing still are only applied when the phone knows it is stationary. The screen shows how mature the baseline is and how many cells and visits it is built on, so you know how much to trust the score.

Clairix numbers. At registration our relay gives your phone a random nine-digit Clairix number. It is not a phone number: it cannot call or text a phone, and a phone cannot reach it. What it buys you is a handle you can give someone without giving them your real number or your identity. You can choose whether your number can be looked up. Unlisted numbers are reached only by scanning your QR code in person.

Pairing. Two people pair by scanning each other’s QR code in person, or by entering a listed number and then comparing safety numbers. From then on each phone has the other’s identity key pinned.

Encryption. Every message is encrypted on your phone for one contact with the Olm double ratchet, using vodozemac, the audited Rust implementation used by Matrix. Each message uses a fresh key, so a key stolen later cannot decrypt earlier messages, and a session recovers on its own after a compromise. The encrypted message is then sealed in an anonymous envelope to the recipient’s sealing key, so the relay cannot tell who sent it. The security page has the details.

Delivery. A live connection delivers messages the moment they are queued while Clairix is open or kept online in the background. Otherwise your phone can be woken through UnifiedPush, an open push standard served by a distributor you choose. The push carries only the word “wake”. There is no Google service in the path.

Calls. Voice calls use WebRTC between the two phones. The keys that protect the audio travel inside the encrypted envelopes, so neither the relay nor a TURN server can read or replace them. Calls connect directly when both networks allow it, otherwise through a TURN relay that forwards packets it cannot decrypt. Incoming calls ring over the lock screen like a phone call.

Voice notes, photos and video. Voice notes of up to thirty seconds are compressed to fit inside a single encrypted envelope and the recording is deleted from the phone as soon as it is sent. Photos and videos are split into encrypted chunks and reassembled on the recipient’s phone.

Groups. A group is a list of members held on the phones, not on the relay. Messages fan out from your phone to each member, each one separately encrypted. The relay sees no group.

On your phone. Your identity keys are stored under a key held in Android’s hardware keystore. Message bodies in the local database are encrypted with the same keystore. A copy of the app’s files taken off the phone is unreadable.

SOS. One tap reads your position and sends it, end-to-end encrypted, to every member of every group you are in. Location is read at that moment only.

Duress phrase. Set an ordinary-looking sentence. Type it into any Clairix conversation and the message goes out as written while the SOS fires underneath. The phrase itself is stored encrypted and compared only in memory. It is never written to a log, a notification or the timeline.

Fake call. Schedule an incoming call for 30 seconds, 2 minutes or 5 minutes ahead, from a contact of your choosing. The phone rings with its real ringtone and vibration, over the lock screen, honouring silent mode. Answer it to hold a pretend call with a timer and an end button, or have it place a real encrypted call to the contact’s Clairix number. The screen is excluded from your recent apps so nothing is left behind.

App lock. A passcode gates the whole app. The passcode is never stored; only a verifier made with a key in the phone’s secure hardware is, so a copy of the app’s files cannot be used to guess it offline. Every attempt is counted before it is checked, so killing the app mid-guess buys nothing. You choose what repeated failures do: an escalating lockout, or a wipe after a number of attempts you set. A separate duress passcode wipes immediately. The lock screen never says how many attempts remain or that a limit exists. Optional biometric unlock uses a hardware key that Android destroys when a new fingerprint or face is enrolled, so a newly added finger cannot open Clairix.

Panic wipe. Asks the relay to delete your account, then deletes every keystore key, every preferences file, every database and every file Clairix holds, including cached map tiles, and restarts the app to a blank slate. Once started it cannot be stopped. It wipes Clairix’s own data, not your phone.