The app changes real Windows settings, and only when you apply a protection or a preset. Windows, Windows updates or other software can change these settings afterwards. The app can show you when that has happened and, if you turn on automatic reapply, set them again.
Full trust desktop app
Needed to read and change Windows settings outside the app's own sandbox. The app starts without administrator rights.
Internet access
Used only for the requests listed in section 4.
Per-user settings
Camera, microphone, location and Bluetooth access, advertising ID, inking and typing personalisation, Recall data analysis, SmartScreen reporting, lock screen and Start menu suggestions, online speech recognition and tailored experiences are Windows settings stored in your user registry. They are read and changed by a short-lived helper process (PowerShell) that the app starts, because a packaged app cannot reach the real user registry directly.
Machine-wide policies
Diagnostic data level, activity history, app diagnostics, Recall, clipboard sync, handwriting data sharing, feedback prompts and update peer sharing are Windows policy values under the machine registry. Changing them needs administrator rights, so the app asks Windows for permission with the standard administrator prompt, and you approve it yourself. Turning a policy off removes the value the app added.
Bluetooth devices
When you turn the Bluetooth protection on, the app disables your Bluetooth adapter and its devices through an administrator step, which disconnects paired keyboards, mice and headphones. Turning the protection off enables the same devices again.
Camera and microphone devices
When you block the camera or microphone, the app also disables the matching camera, imaging or audio capture devices in Windows using the same administrator step, and re-enables them when you turn the protection off.
Hosts file
The ad tracker protection adds a marked block of advertising, analytics and telemetry domain names, each mapped to 0.0.0.0, to the Windows hosts file, using the administrator step. It leaves the rest of the file as it was and removes only its own block when you turn the protection off.
DNS settings
The encrypted DNS protection changes DNS settings on your active physical network adapters, as described in section 4.
Per-app permissions
You can block or allow individual apps for capabilities such as camera, microphone, location, contacts and calendar. This changes that app's consent value in your user registry.
Startup entries
The app lists the programs set to start with Windows and lets you switch each on or off through the standard Windows startup approval setting. Entries for all users need the administrator step. It does not delete them.
Start with Windows
Off until you turn it on. It uses the Windows startup task, which you can also switch off in Windows Settings.
While the app is running
It re-reads the protections it applied every few minutes, and sooner when the relevant registry keys or the hosts file change. Nothing runs after you exit the app.
Automatic reapply
Off until you turn it on in Settings.
Report
The app can save a PDF report of your protection states, history and startup entries to a place you choose. It is not sent anywhere.
Administrator rights
Requested only for the machine-wide steps above or when you choose to relaunch as administrator. You approve the Windows prompt yourself.