Because the breach-letter cycle is exhausting.
I’m Tek. I piled up third-party apps for every layer of privacy — each one another company I had to trust. Every few months another breach letter arrived from a company I’d never heard of, holding data a company I did know had moved, sold, or leaked.
I stopped trusting third parties for the parts that mattered. I didn’t want to ask anyone to trust me more than the companies that burned them either. So I built Wraith on infrastructure I operate end-to-end, with a posture that’s inspectable rather than opaque.
Four things, done carefully.
Operator-grade trust, stated plainly.
This is how Wraith is actually built. Each claim is inspectable on docs.katafract.io/trust.
WireGuard via our own WraithGate fleet
Every exit node is operated by Katafract — not rented from a reseller, not shared with a brand we don’t control. IPs are listed publicly so you can verify each one.
Haven DNS runs on the node itself
Your DNS queries never leave the tunnel. AdGuard + OISD filter lists block ads, trackers, and known-malicious domains before your apps even see them.
Kill switch + local network passthrough
If the tunnel drops, the app blocks traffic. Your local network — home printers, Plex server, LAN cameras, smart-home devices — stays reachable while your internet traffic tunnels. No toggle, no config; LAN just works.
No-logs posture — architectural, not promised
No connection timestamps, no assigned-IP records, no DNS query logs. The code to collect those was never written. Read the full policy at docs.katafract.io/trust/logs/.
Token-based identity, not your email
Apple handles sign-in. Wraith receives a token that grants access. We don’t learn your name, your email, your billing address, or what else you own.
Verify the fleet
Every exit IP is documented on docs.katafract.io/trust/infrastructure/. Check them against public WHOIS, ASN, and your own traceroutes.
People who prefer knowing who they’re trusting.
Privacy-conscious travelers, journalists, operators, and anyone tired of VPN brands that treat their customer list as the product.
Public Wi-Fi is a hostile network. One tap on Wraith and your DNS, your traffic, and your real IP stop leaking to whoever else is on the SSID.
Connect to a hotel network anywhere in the world. Haven DNS keeps blocking ads and trackers even on networks that inject both.
Per-device kill switch means your phone won’t silently leak to your ISP if the tunnel blips. Works alongside home routers via our separate router endpoint.
Inspectable, not opaque.
We publish the posture. You decide whether it holds up.
In Apple review.
Wraith is currently in Apple's review queue. We'll announce pricing and availability here when the app is approved.