Download
USER GUIDE

WhoSees user guide

Everything you can do with WhoSees, step by step, with pictures from the app on a computer and an Android phone.

Getting started

First install WhoSees: see the step-by-step install pages for Android, Windows and Linux. Then open it. You'll see the start screen:

The start screen on a computer123
The start screen on a computer
  1. 1Start live view begins watching. Nothing runs until you press it.
  2. 2Deep mode switch (computers only): adds website names and catches every connection. More below.
  3. 3Your location: where the lines on the map start from.

Set your location

  1. Click or tap the place name next to Your location (or open Settings → Your location → Change).
  2. Start typing your city and pick it from the list. WhoSees looks it up on your device; it isn't sent anywhere.
Choosing your city1
Choosing your city
  1. 1Type your city, then pick it from the list.

Update checks

The first time you open WhoSees, it asks whether you'd like it to check for updates. It's off unless you choose Turn on update checks. If you do, once a day when you open WhoSees it asks whosees.app for the newest version number. That request shows your internet address, like visiting any website, and nothing else. When a newer version is out, a short note appears with a Download button that opens the right page; WhoSees never installs anything by itself. You can change this any time in Settings.

The first-launch question about update checks12
The first-launch question about update checks
  1. 1No thanks keeps it off.
  2. 2Turn on update checks

Start a live view

On a computer

  1. Press Start live view.
  2. In Standard mode it starts right away, no password needed.
  3. With Deep mode on, WhoSees first explains what's about to happen. Click Continue, then approve the request: Windows shows a Yes/No prompt; Linux asks for the password you log in with. Your password goes to your system, never to WhoSees.
Before Deep mode asks your system for permission12
Before Deep mode asks your system for permission
  1. 1Continue to Deep mode.
  2. 2Use Standard mode instead (no password).
STANDARD OR DEEP?

Standard shows apps, companies and places. Deep adds the names of the websites, labels trackers more precisely and catches very short connections. Both only look at where data goes, never what's inside it.

On an Android phone

  1. Tap Start live view.
  2. The first time, WhoSees explains that Android will ask about a VPN. Tap Continue.
  3. Android asks "WhoSees wants to set up a VPN connection". Tap OK. The VPN stays on your phone: nothing is sent to a VPN server.
Start screen on a phone12
Start screen on a phone
  1. 1Start live view
  2. 2Your location
WhoSees explains the VPN question first1
WhoSees explains the VPN question first
  1. 1Tap Continue.
Android's own question1
Android's own question
  1. 1Tap OK.

Read the live map

Within seconds, lines start flying from your location to the places your apps send data to. Each colour is a kind of company.

A live view on a computer123456
A live view on a computer
  1. 1Totals: how fast data is leaving now, how much has been sent, how many places and countries, and how many are trackers or advertisers.
  2. 2You: your location. Every line starts here.
  3. 3A destination: a company in another city. Brighter lines are active right now.
  4. 4Colour key: what the colours mean. Click a colour to hide or show that kind.
  5. 5Tabs: Apps, Feed, Places and Alerts.
  6. 6Stop turns WhoSees off.

On a phone, the same things are stacked: the map on top, and a panel underneath you can tap the little handle on to make it bigger or smaller.

A live view on a phone1234
A live view on a phone
  1. 1Totals
  2. 2You
  3. 3Tabs
  4. 4Stop

See which apps send the most

  1. Open the Apps tab. Apps are sorted by how much they've sent.
  2. Each row says how many places and countries the app talks to, and the main company.
  3. A red TRACKER label means the app talks to tracking or advertising companies.
The Apps tab123
The Apps tab
  1. 1An app, with the places and company it talks to. Click it for details.
  2. 2Tracker label
  3. 3Search apps, companies or countries.

Find out what an app sends

  1. In the Apps tab, click or tap an app.
  2. Read the plain-English summary at the top.
  3. Under What this app sent: Seen means WhoSees read it in data sent without encryption (like your location). Likely means the traffic was encrypted, so WhoSees tells you what that kind of company usually receives.
  4. The Privacy report gives a simple grade (Good, Fair or Poor) and why.
  5. Scroll down to see every place it sent data, then press Back.
An app's details4132
An app's details
  1. 1A plain-English summary.
  2. 2Privacy report grade.
  3. 3What this app sent: Seen and Likely.
  4. 4Back to the list.
The same on a phone (the panel is expanded)132
The same on a phone (the panel is expanded)
  1. 1Summary
  2. 2Privacy grade
  3. 3What it sent

Check a place on the map

On a computer, point at any dot. On a phone, tap it. A card shows the city, the company, what it likely receives, and which of your apps send data there.

Pointing at a place12
Pointing at a place
  1. 1Point at (or tap) a dot.
  2. 2The city, company, likely data, and the apps sending there.

See every company and country

Open the Places tab for a list of every company and place your data went, with a flag for each country. Click one to see which apps sent data there.

The Places tab12
The Places tab
  1. 1Places tab
  2. 2A company in a city, with how much was sent.

Watch connections as they happen

The Feed tab lists each connection the moment it happens, newest first: which app, which company and where.

The Feed tab12
The Feed tab
  1. 1Feed tab
  2. 2The newest connection.

Type in the search box above the list to find an app, a company or a country, for example google or Ireland. The list and the map show only what matches.

Searching for "google"12
Searching for "google"
  1. 1Type here.
  2. 2Only matching results are shown.

Technical details (Expert)

Switch from Simple to Expert at the top to see network addresses, ports, protocols and exact byte counts. Switch back to Simple any time.

Expert view12
Expert view
  1. 1Expert switch
  2. 2Technical details for each connection.

When WhoSees warns you

If an app connects to a known scam or malware website, or does something suspicious, a warning appears at once. On a phone you also get a notification.

  1. Read the warning: it says which app, where it connected and why that matters.
  2. Press Block now to stop it straight away (WhoSees keeps blocking a dangerous site in future live views), Details to see that app or place, or Trust if you recognise it and it's fine.
  3. If you don't recognise the app, remove it. On a computer, if it runs from your Downloads or a temporary folder, close it and delete the file.
  4. All warnings are kept in the Alerts tab until you stop.
A warning on a computer123
A warning on a computer
  1. 1The warning.
  2. 2Block now stops it.
  3. 3The alert badge: click to see all warnings.
A warning on a phone12
A warning on a phone
  1. 1The warning.
  2. 2Block now
The Alerts tab12
The Alerts tab
  1. 1Alerts tab
  2. 2Every warning from this session.

Block apps, companies and trackers

WhoSees can stop an app talking to a company, a website or a whole country, or stop every tracker and advertiser at once. Blocking works only while a live view runs, and WhoSees never blocks anything you didn't choose.

  1. A company, website or country: click it on the map (or in Places) and scroll to Block. Pick what to block.
  2. Every tracker and advertiser: open the Blocked tab and switch on Block all trackers and ads.
  3. A whole app (Windows and Android): open the app in Apps and choose Block … from the internet.
  4. Blocked places show a red ring on the map, with the number of attempts WhoSees stopped.

Block all trackers and ads goes by website names, never by guesses. Some trackers share a server address with ordinary websites (big content networks do this); WhoSees leaves such an address open, so the ordinary website keeps working.

Block from a place on the map123
Block from a place on the map
  1. 1Block the company.
  2. 2Or every tracker and advertiser at once.
  3. 3Or a whole country.
The Blocked tab on a phone12
The Blocked tab on a phone
  1. 1Block all trackers and ads
  2. 2Keep

Blocks end when you press Stop, so nothing stays blocked by surprise. To keep blocking something in future live views, press Keep next to it in the Blocked tab. Unblock removes it at once.

The Blocked tab123
The Blocked tab
  1. 1Block all trackers and ads
  2. 2Keep: keep blocking it next time.
  3. 3Unblock
ONWHAT BLOCKING NEEDS
AndroidNothing extra: blocking works in every live view.
WindowsDeep mode. WhoSees adds temporary Windows Firewall rules and removes them when you press Stop.
LinuxDeep mode. WhoSees adds a temporary firewall table (nftables, or iptables if nftables isn't installed) and removes it when you press Stop. Linux can't block a single app, only where apps connect to. Blocking a whole country needs nftables.

If you press Block while Deep mode is off, WhoSees offers to turn it on for you.

Save a report (PDF)

A report is a PDF of everything a live view found, to keep, print or share: a map, the key findings in plain English, every app with its privacy grade, every company, country and tracker, any threats and blocks, and a list of every connection.

  1. During a live view, click the report button at the top (on a phone: Settings → Report). After you press Stop, you can also use Save a report of this live view.
  2. Pick a style (Dark, or Light to save ink when printing) and a paper size (Letter or A4), then Save PDF.
  3. On a computer, choose where to save it. On Android, the phone's print screen opens: choose Save as PDF at the top, then tap the round PDF button.
Save a report1234
Save a report
  1. 1The report button
  2. 2Style
  3. 3Paper size
  4. 4Save PDF
On Android: the phone's print screen1
On Android: the phone's print screen
  1. 1Choose Save as PDF here, then tap the round PDF button.

The report is made on your device and isn't uploaded anywhere. It covers the live view you just ran: starting a new one starts a new report.

The first two pages of a report: the summary with a map, and the key findings.
The first two pages of a report: the summary with a map, and the key findings.

Missing website names on Android (Private DNS)

If your phone uses Private DNS with a named provider, website names are encrypted before WhoSees can see them. WhoSees tells you when you press Start:

  1. To see website names, tap Open Settings, search for Private DNS, choose Off, then come back and press Start.
  2. Or tap Start anyway: you'll still see the app, company and country.
  3. Turn Private DNS back on when you're done. WhoSees reminds you when you press Stop.
The Private DNS notice12
The Private DNS notice
  1. 1Open Settings
  2. 2Start anyway

More in What is Private DNS on Android?

Settings

Click or tap the gear at the top right.

SETTINGWHAT IT DOES
AppearanceFollow your system, or always dark or light.
Your locationWhere the lines start from. Change to pick another city.
Deep mode(Computers) Website names and every connection; asks for permission each time you press Start.
Threat alertsWarn about dangerous websites, malware servers and suspicious behaviour. On by default.
Include local networkAlso list devices in your home, like printers and TVs.
ReportSave a PDF of what the current or last live view found.
Check for updatesOff unless you turn it on. When on, once a day when you open WhoSees it asks whosees.app for the newest version number and tells you if there's a newer one. Check now checks straight away.
AboutVersion, data credits and Open-source licences.
Settings1
Settings
  1. 1The gear opens Settings.

Stop WhoSees

Press Stop at the bottom of the map. WhoSees stops completely: nothing keeps running in the background, and any blocks end (except the ones you chose to Keep, which return in your next live view). Closing the app does the same. On Android the VPN key icon disappears.

Support WhoSees

Every feature is free. If WhoSees is useful to you, open Settings → Support WhoSees (or the coffee section on this website) and pick $5, $10 or $15. It opens PayPal in your browser; WhoSees never sees your payment details, and tipping doesn't change anything in the app.

Buy me a coffee1
Buy me a coffee
  1. 1Pick an amount to open PayPal.

Troubleshooting

PROBLEMWHAT TO DO
Nothing appears after StartUse a few apps or open a website; connections appear within seconds.
The password window doesn't appear (Linux)It may be behind the WhoSees window. Check your taskbar.
"Deep mode didn't start"The password was wrong or the window was closed. Choose Try again, or Keep Standard view.
Windows says "Windows protected your PC" when installingClick More info, then Run anyway. Why this happens.
"Is another VPN app on?" (Android)Android allows one VPN at a time. Turn off the other VPN app, then press Start.
No website names (Android)Private DNS is on. See above.
An app shows as "Windows service" or "Short-lived program"A protected Windows service, or a program that ran for only a moment. Deep mode names more of them.

Questions

I pressed Start but nothing appears.

WhoSees shows connections as they happen. Open a few apps, a website or a video, and they'll appear within seconds.

Does WhoSees slow down my internet?

No. It only notes where each connection goes. Streaming, browsing and downloads run at normal speed.

Can WhoSees read my messages or passwords?

No. It sees where your data goes, never what's inside encrypted traffic.