GUIDE · THE PANEL
What each category and each colour means
Every row of the panel carries a category label with a coloured dot. This page says, word by word, what each one means and where it comes from. Everything here is an observation, never a verdict: GUARDIANA sees names, not content, and calls nothing «malicious».
The three colours
Green: normal
What a service needs to work: its website, its server, your account, updates, the content it downloads, your home network. No need to look at it.
Orange: worth a look
It measures what you do, serves ads or nobody knows it: advertising, telemetry, measurement, ads, unclassified. Not bad in itself; it is what you should look at, because you know what you opened.
Red: alert
A public list recognises it as tracking, the company is registered as a data broker, or the device tries to dodge the watch (DNS evasion). It is where to start if you are going to block something.
The colour comes from what the label already says, not from an opinion of the program: the list that recognises it, the word in the name itself, the broker registry, the evasion signal. Two rows with the same label always have the same colour.
What the lists say
| Label | What it means | Where it comes from |
|---|---|---|
| tracker | A public list recognises it as tracking: it serves to follow you from one site to another and join what you do on different sites. | Open tracking lists (EasyPrivacy, Peter Lowe), each with its date and licence in the panel, under «Status». |
| advertising | It is on the advertising lists: it serves to show you ads or to measure whether you saw them. | The same open lists. |
| telemetry | Usage data a program sends to its maker: how much you use it, what fails, on which computer. Not an ad, not a third-party tracker; the program itself telling about you. | Our telemetry list, open in the code. |
| normal | What a computer needs to work: system updates, the time, certificates, messaging, video calls, the resolvers, the licence gateway. Never cut by a wide rule. | Our «expected» list, open in the code. |
| local network | Devices of your home finding each other (the printer, the TV, the speaker). It does not go out to the internet. | The .local, .lan, .home names and the like. |
| delivery | A network that delivers other companies' content (Akamai, Cloudflare, CloudFront…) or a cloud where other companies host their servers (AWS, Azure, Google Cloud). Not the destination: the road. That is why it does not count in «who it talked to» nor in the countries. | Our «delivery» list. |
| service | A name of a known company that no list marks and whose own name does not say what it is for. The column next to it says the company. | Our company list: who owns the name, never what it does. |
| unclassified | Neither any public list nor our company list knows it. It does not mean it is suspicious: it means nobody has written it down yet. It is orange so that you look at it, since you are the one who knows what you opened. | — |
| buys and sells data | The company that owns the name is registered in California's public data broker registry: it declares that it buys and sells personal data. The panel says what it declares (precise location, minors, sales to third parties…) and links its rights page. | The CPPA public registry, dated, inside the program. |
What the name itself says
When no list knows a name but the company it belongs to is known, the panel looks at the part of the name before the domain (login., api., cdn., analytics.…) and says that word, nothing more. It is a hint the name gives, not a check.
| Label | What it means | Words in the name |
|---|---|---|
| its website | That company's page or app, the one you opened: the name is its domain or starts with «www». The panel's label opens that website. | www, web, home, portal, or the bare domain |
| its server | The program or the app talking to its own company's server to work. | api, gateway, backend, ws, rpc, app, services, data, search, live, edge |
| your account | Signing in or your account data at that company. | login, accounts, auth, oauth, sso, identity, passport, session, profile |
| payment | A payment or a subscription at that company. | checkout, pay, payments, billing, invoices, cart, orders, subscribe |
| measurement | It counts what you do in its app or its website, for the company itself. No public list marks it as tracking; the name says it. | analytics, metrics, stats, telemetry, pixel, beacon, tracking, collect, logs, events, insights, crash, sentry |
| ads | No list has it yet, but the name carries a technical word of the ad auctions. | prebid, rtb, ssp, dsp, adserver, ads, banners, cookiesync |
| notifications | The notifications that reach your device. | push, notify, notifications, fcm, apns, alerts |
| update | Download of updates or of the installer. | update, upgrade, patch, release, dist, installer, download |
| security | Security checks of the browser or the system. | safebrowsing, smartscreen, antiphishing, captcha, recaptcha, shield |
| Your e-mail. | mail, smtp, imap, pop3, mx, webmail | |
| messages | Chat and messaging. | chat, msg, messages, messaging, xmpp, mqtt |
| cloud copy | Backup or sync of your files. | backup, drive, onedrive, dropbox |
| content | Images, videos, fonts, files: what the site or the app downloads to show you. | cdn, static, assets, img, images, media, fonts, video, content, files, storage, cache, js, css, s3, blob |
| settings | The configuration the program fetches when it starts. | config, settings, flags, features, remoteconfig, bootstrap, discovery, geo, ip |
The signals
Besides the category, each row may carry one sentence per signal. Signals look at behaviour (when, how much, how regularly), not at the name.
- Beacon. It contacts the same destination at regular intervals, like a heartbeat: every 5 minutes, every hour. That is how programs that report on themselves talk… and also the ones that check the mail.
- New destination. This device had never looked for this service. Normal the day you install something; odd at three in the morning.
- Out of hours. It talks at hours this device does not usually talk at. Guardiana learns each device's hours for three days before saying so.
- DNS evasion. It tries to resolve names on its own, out of Guardiana's sight (its own encrypted DNS). Guardiana does not see where it goes; it says so, and the row goes red.
- Volume. It is asking much more than usual: several times the median of its active hours.
Block and unblock
Every row has its button. Block makes that name «not exist» for that device: the question does not leave home. Unblock undoes that block, also when Guard mode or a wide rule (home-wide, or a category) made it: in that case a rule that allows that name on that device is created, and it wins for being more specific. Nothing is blocked without your decision, and everything is undone in one click under «Rules». A block does not erase what was already sent, and does not stop whoever uses their own encrypted DNS or a VPN.
What this is not
It is not an antivirus, not parental control, and it sees no content: it sees which names each device tries to talk to, and tells you in the words above. What GUARDIANA does not do is written, dated, in the open code.
If a label or a word on this page does not match what you see in your panel, write to hola@guardianagroup.com with the name: we review it, dated.