How hado99 works
hado99 is an Android app, requiring Android 8.0 (API level 26) or later. It works in four steps: a local DNS-only VPN, an on-device blocklist check, encrypted resolution for what is allowed, and an on-demand explanation for what is blocked.
1. A local VPN that only sees DNS
hado99 uses Android's VPN service API to start a VPN that runs entirely on the device. It does not route your general internet traffic and there is no remote VPN server — it exists only to intercept DNS queries so they can be checked before resolution. Because of this, hado99 does not hide your IP address from the sites and apps you use; it is not an anonymity tool.
2. Blocklist check, on-device
Every DNS query is checked against a blocklist of roughly 93,000 domains, compiled from the StevenBlack/hosts project and covering advertising, tracking, and known malware domains. The check happens on the phone itself, using no network call, so the decision to block or allow is made locally and instantly.
3. Allowed queries: encrypted resolution
Domains that pass the blocklist check are resolved using DNS-over-HTTPS against Cloudflare's
resolver (cloudflare-dns.com). This encrypts the query in transit so it cannot
be read by your network provider. Cloudflare, as the resolver, does see the domain queried
and the public IP address the query came from.
hado99 keeps a short list of recent queries in memory so you can see recent activity. That list is never written to disk and is cleared when the app stops.
4. Blocked domains: explanation on demand
When you tap a domain that was blocked, the app sends only that domain name to
brain.hado99.com. Nothing else is attached — no device identifier, no history.
This request only happens when you tap; the app never sends domains in the background or in
batches.
The server may pass the domain name to a language model to generate a plain-language explanation. Explanations are cached by domain and shared across all users, so a domain that has already been explained for someone else is typically served from cache.
What hado99 does not do
- It does not hide your IP address from the sites and apps you visit.
- It does not scan other apps or remove malware already on the system.
- It cannot guarantee every site or app keeps working while filtering is on.