Plain-language disclosure

DNS privacy & platform limits

What the mobile DNS layer does

The Android, iOS, and Quest options block DNS lookups for persistent.oaistatic.com and oaisidekickupdates.blob.core.windows.net. Other DNS requests are forwarded to Cloudflare’s public DNS-over-HTTPS resolver so ordinary Codex, web, and chat traffic continues to work.

What it cannot do

Android, iOS, and Quest sandbox third-party apps. Without device-owner, supervised MDM, or root/jailbreak control, this utility cannot stop Google Play, Apple App Store, or Meta Store from updating a separately installed app through shared Store infrastructure. It blocks Codex-owned network updater/runtime hosts, not the operating system’s entire app store.

DNS privacy

The resolver code does not intentionally store DNS queries or add analytics. Requests still pass through Cloudflare Pages and Cloudflare’s public DNS resolver, whose infrastructure and standard service policies apply. Remove the VPN or DNS profile at any time to return to the device’s prior DNS configuration.

Desktop scope

The desktop versions target validated Codex paths and record what they change. They intentionally leave shared HTTPS port 443 and normal API/authentication endpoints available. A future Codex release could introduce an unknown update mechanism; the release manifest identifies exactly what this version covers.