Phone Guard catches a wrong unlock because Android tells it. When someone types a wrong PIN, password or pattern on your lock screen, Android reports the failed attempt to Guard, and Guard tries to take a photo with the front camera at that moment. The photo is encrypted for your vault as soon as it is taken, so only you can see it, inside the unlocked vault.
How does Guard find out about a wrong code?
Android has exactly one way to tell an app that a wrong unlock code was entered: the device administrator feature, in its “watch login” form. That is why Guard asks you to turn on unlock detection when you set it up. Android lists it as “Stillgarth Guard unlock detection”.
Unlock detection only lets Guard be told about wrong codes. It cannot lock, wipe or change your phone, and it never learns the digits or the pattern that were typed, because Android doesn’t give apps that.
Guard also notices when the phone is unlocked correctly. By default it takes a photo then too (“Photo on unlock”), so you see who got in, not only who failed. You can turn that off in Guard settings, and you can turn off photos for failed unlocks too if you only want the log.
What do you need to set up?
Guard’s setup screen walks through four steps:
- Camera (required): takes the front-camera photo.
- Unlock detection (required): Android’s device-admin permission, described above.
- Notifications (required): Guard shows a small status notice while it is on, and asks you to re-arm it after a restart.
- Keep running (recommended): find Stillgarth in Android’s battery list and choose “Unrestricted”, so Android doesn’t shut Guard down to save battery.
The Guard screen then shows a check for each one: “Camera ready”, “Unlock detection on” and “Status notification on”. If any of them says “Set up”, tap it.
Where does the photo go?
Once you have a vault, each photo is encrypted for it the moment it is taken. Guard itself never shows the picture. In Guard’s log you see the time and a lock tile that says the photo is sealed. The next time you unlock the vault, the photo moves into a folder called Guard photos, under Failed unlocks or Successful unlocks, dated when it was taken.
If you haven’t set up a vault yet, photos are kept in the app’s private storage, still shown only as a tile, and they move into the vault once it exists.
Guard keeps the last 30 days or 500 events in its log, whichever comes first. With a vault set up, that limit never deletes a photo: only the log row goes, and the photo still moves into the vault at its next unlock. If the vault isn’t opened for a long time, Guard keeps at most 1,000 waiting photos, and photos of failed unlocks are kept longest.
When can’t Guard take a photo?
There are a few honest limits, all set by Android:
- After a restart or an app update. Android only lets an app use the camera in the background if its watcher was started while the app was on screen. So after a restart or an update, Guard shows a “Re-arm Guard” notification. Tap it and Guard starts watching again with the camera working.
- Before the first unlock after a restart. Android doesn’t allow photos that early. Guard tries to note the time of each wrong code instead and adds those rows to the log after you unlock. Whether a phone reports wrong codes that early depends on the phone.
- If the camera fails. The event is still logged, with the reason, instead of failing silently.
Can someone simply switch Guard off?
Not quietly, once your vault is set up. With “Ask for the vault to change Guard” on (it is on by default), turning Guard off, deleting an event or opening Guard settings asks for your vault password, PIN or fingerprint. The vault stays locked while it asks.
That stops a casual snoop who knows your phone’s PIN. It doesn’t stop a determined one: Android’s own settings can still turn off unlock detection, and Guard’s main screen then shows “Unlock detection off”.
What else can Guard record?
If you turn on Record what an intruder opens and grant Android’s Usage access, Guard watches more closely after a break-in. When the phone is unlocked within two minutes of a wrong code, Guard notes which apps were brought to the front, and for how long, until the screen turns off (or for up to 30 minutes). It never sees what was typed, sent or deleted inside those apps. The report is sealed into your vault, in a folder called Guard activity.
Guard is meant for your own phone. Please don’t use it to photograph people without their knowledge where that’s against the law. Everything it records stays on the phone: Stillgarth has no internet permission, so nothing is uploaded or emailed anywhere. Before you ever remove the app, read what to do before you uninstall, because unlock detection has to be turned off first.