Action log — specific things the apps did, in this range
Live feed — connecting…
Interaction threads — the inferred story: a notification, an app opened, what happened next
History — every day on record; click a day to inspect it
Activity timeline
Sessions
⛔ Blocked
The story
Auto-generated narrative of what this device was doing
Daily rhythm — every day on record; when the phone is awake, asleep, or off the network
00:0006:0012:0018:0024:00
Habits — what follows what
Most common app-to-app moves across every session
Typical day & binges
Which app usually dominates each part of the day
00040812162024
Security & anomaly watch — what's new and what never stops talking
Newly-seen domains — first appearance in 24 h
Always-on / beaconing connections
Notifications & attention — what pulls vs. what's chosen
Digital wellbeing — sleep, screen & focus
New apps & services — first-ever appearances, newest first
Registered domains this device had never contacted before, grouped and de-noised,
each classified by kind. Stays listed for the whole window, so a one-time open never scrolls
away. The strip highlights sensitive and app-like arrivals (dating, finance, health, AI…);
the table below classifies everything, background infra included.
Unidentified services — what the knowledge base cannot name yet
Domains this device uses regularly that match no rule, ranked by how much they are
used. Identify probes each one — TLS certificate owner, WHOIS registrant, then the site's
own title — and feeds the answer back through the same taxonomy, so an opaque domain resolves to
a real service and a category. That is how a name nobody catalogued still gets surfaced instead
of sitting in "other" forever. Nothing is probed until you ask: identifying opens a connection
from this machine to each domain.