# Sandboxing applications **URL:** \ **Category:** BraX3\ **Created:** [August 10, 2025, 8:26pm UTC](https://community.braxtech.net/t/sandboxing-applications/1515 "2025-08-10T20:26:37Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![DonChevo502](https://community.braxtech.net/letter_avatar_proxy/v4/letter/d/bcef8e/32.png) [@DonChevo502](https://community.braxtech.net/u/DonChevo502)\ **Post date:** [August 10, 2025, 8:26pm UTC](https://community.braxtech.net/t/sandboxing-applications/1515/1 "2025-08-10T20:26:37Z")
Is anyone here sandboxjng applications for further privacy. If so, how is it done? ---
**Author:** ![0x7](https://community.braxtech.net/user_avatar/community.braxtech.net/0x7/32/192_2.png) [@0x7](https://community.braxtech.net/u/0x7)\ **Post date:** [August 10, 2025, 11:58pm UTC](https://community.braxtech.net/t/sandboxing-applications/1515/2 "2025-08-10T23:58:32Z")
My understanding is with the work profile you can sandbox/shelter apps. Essentially a partition. I haven’t tested it yet though. ---
**Author:** ![rik](https://community.braxtech.net/user_avatar/community.braxtech.net/rik/32/240_2.png) [@rik](https://community.braxtech.net/u/rik)\ **Post date:** [August 11, 2025, 4:45pm UTC](https://community.braxtech.net/t/sandboxing-applications/1515/3 "2025-08-11T16:45:59Z")
> [@DonChevo502](#): > > Is anyone here sandboxjng applications for further privacy. If so, how is it done? Yes, I use “Shelter” downloaded from `F-Droid` for a few apps I don’t want continually running in the background and to keep them away from my personal data. It will set up your “work profile” on your phone. In Shelter, it shows “Main” (normal apps). I then tap “Aurora Store” and “Clone to Shelter”, and launch that version to then install other apps in Shelter. All the apps I add to Shelter (that I want to disable when not using them) I then tap and tick “Auto Freeze”. Then I also select “Create Unfreeze and/or Launch Shortcut” which adds a launcher to that app on my home screen. Then if you click “Freeze” the actual app will be force stopped and removed from you app menu, but tapping that “Launch icon” will unfreeze and launch it again. Finally, in Shelter I tap “3 dots \> Create Batch Freeze Shortcut” and put that on my home screen. Tapping that will freeze _ **all apps** _ that you set to auto-freeze at once. Once all this is set up, you don’t need to open shelter itself to launch or freeze the apps, the shortcuts to launch and “auto freeze all apps” will be sufficient. ---
**Author:** ![DonChevo502](https://community.braxtech.net/letter_avatar_proxy/v4/letter/d/bcef8e/32.png) [@DonChevo502](https://community.braxtech.net/u/DonChevo502)\ **Post date:** [August 11, 2025, 6:21pm UTC](https://community.braxtech.net/t/sandboxing-applications/1515/4 "2025-08-11T18:21:22Z")
Thank you all for the detailed instructions. ---
**Author:** ![Mycenius](https://community.braxtech.net/user_avatar/community.braxtech.net/mycenius/32/181_2.png) [@Mycenius](https://community.braxtech.net/u/Mycenius)\ **Post date:** [August 12, 2025, 11:55pm UTC](https://community.braxtech.net/t/sandboxing-applications/1515/5 "2025-08-12T23:55:24Z")
Thanks @rik - that’s great info. I’m in a similar boat looking at sandboxing as I will be migrating from a iPhone with work and personal sims and for the former I have to have 2 Microsloppy apps installed (Outlook & Teams) as well. And I don’t want to resort to carrying a seperate non-private device for work… So hoping to lock those 2 apps down tight so they can’t see res of device or do anything other than their most basic function(s)… Assuming I will have a challenge sharing contacts from Outlook to phone for the work sim without opening up all contacts and such to it… ---
**Author:** ![rik](https://community.braxtech.net/user_avatar/community.braxtech.net/rik/32/240_2.png) [@rik](https://community.braxtech.net/u/rik)\ **Post date:** [August 13, 2025, 7:35pm UTC](https://community.braxtech.net/t/sandboxing-applications/1515/6 "2025-08-13T19:35:21Z")
> [@Mycenius](#): > > Assuming I will have a challenge sharing contacts from Outlook to phone for the work sim without opening up all contacts and such to it… You have a few options, by default you are right, the “work profile contacts” won’t interact with your main / “personal profile” contacts. I don’t want my “Shelter profile” apps knowing anything about my personal contacts, so I have the hassle of maintaining WhatsApp & Telegram contacts separately than my personal profile contacts. Or if you do want to share your contacts between work and personal profiles, in Shelter when you tap the app, there is an option to “Allow Cross-Profile Interaction”. I am not certain if you do it there or instead if you make sure the “Contacts app” in your Shelter profile is set to share “cross profile” (or if you need both). It may take a bit of trial-and-error. Lastly on this front, for me I use DavX to sync contacts and calendar events across devices with Nextcloud (or you can use other caldav / cardav providers, I would guess even MS could be directly synced with DavX). So for you, you can add DavX to Shelter (either install normally, then “clone to shelter” or instead put f-droid inside Shelter, then install from there). Then use “Shelter DavX” to setup contact syncing. ---
**Author:** ![Mycenius](https://community.braxtech.net/user_avatar/community.braxtech.net/mycenius/32/181_2.png) [@Mycenius](https://community.braxtech.net/u/Mycenius)\ **Post date:** [August 14, 2025, 12:21am UTC](https://community.braxtech.net/t/sandboxing-applications/1515/7 "2025-08-14T00:21:55Z")
Thanks @rik that’s much appreciated! Gives me a good head start. And yeah I’d sooner have a hassle syncing the work contacts than end up with those MS apps able to access other data or contacts on the device - the MS ones seem to be getting more and more insidious (virtually) by the day… 👍 On a related note what’s your thoughts or approach on home & utility apps that ideally need sandboxing or is using a profile sufficient ‘isolation’? Ones I’m thinking in my case are Home Alarm System, Home CTV Security, Home AirCon System, Home Solar Power (Fronius & Tesla in my case - latter makes me squirm a bit as always feels intrusive), and Home Irrigation System. Others like my Gas Fireplace can be worked around if needed (use a remote instead of app), but all the others listed an app is the only practical way to manage them day to day… 🤔 P.S. as an aside I was big on home automation a while ago (10-15 years back, and even used to manage a retail business selling C4 for a couple of years); but have gone completely off it now (at least for any main basic home/house functions) for a couple of reasons (1) privacy & security, and (2) robustness (e.g. unusable in natural disaster, no power, etc) - hence why I have all those seperate apps above and not one centralised solution (like Control 4, Lutron, Homey or that Apple HomeKit thing). ---
**Author:** ![cloaked](https://community.braxtech.net/user_avatar/community.braxtech.net/cloaked/32/377_2.png) [@cloaked](https://community.braxtech.net/u/cloaked)\ **Post date:** [August 15, 2025, 4:36pm UTC](https://community.braxtech.net/t/sandboxing-applications/1515/8 "2025-08-15T16:36:55Z")
Add my thanks as well. I appreciate most things that save me time! ---
**Author:** ![Mycenius](https://community.braxtech.net/user_avatar/community.braxtech.net/mycenius/32/181_2.png) [@Mycenius](https://community.braxtech.net/u/Mycenius)\ **Post date:** [September 19, 2025, 10:26am UTC](https://community.braxtech.net/t/sandboxing-applications/1515/9 "2025-09-19T10:26:56Z")
I came across this DPS Blog post the other day that I found helpful in a general way, it’s not specific about Sandboxing (or Sandboxing apps like Shelter or Insular) but is a good general intro to profiles so thought I’d link it here for anyone reading this thread in future and new to the subject: > **[Enhance Privacy with Multiple User Profiles](https://digitalprivacy.shop/blog/android-multiple-user-profiles)** > > In this guide, we discuss how enabling multiple users on your Android phone enhances privacy and security ---
**Author:** ![Mycenius](https://community.braxtech.net/user_avatar/community.braxtech.net/mycenius/32/181_2.png) [@Mycenius](https://community.braxtech.net/u/Mycenius)\ **Post date:** [September 20, 2025, 7:45am UTC](https://community.braxtech.net/t/sandboxing-applications/1515/10 "2025-09-20T07:45:22Z")
> [@rik](#): > > It will set up your “work profile” on your phone. In Shelter, it shows “Main” (normal apps). I then… > > …if you click “Freeze” the actual app will be force stopped and removed from you app menu, but tapping that “Launch icon” will unfreeze and launch it again. Finally, in Shelter I tap “3 dots \> Create Batch Freeze Shortcut” and put that on my home screen. Tapping that will freeze _ **all apps** _ that you set to auto-freeze at once. > > Once all this is set up, you don’t need to open shelter itself to launch or freeze the apps, the shortcuts to launch and “auto freeze all apps” will be sufficient. So I’ve got `Shelter` installed with the 2 key work apps I need to have on my phone (`Microsoft Outlook & Teams`) - what I am finding is every time I freeze them, then reopen them (from my home screen), it recreates a second app shortcut for the same app - so I have the one `Shelter` created (with the ‘_humpty-dumpty_’ icon) but it then keeps recreating a second **Work Profile** one with ‘_briefcase_’ icon as well - and if I delete it it recreates it again next time I open the app (via the `Shelter` app shortcut). I’m wondering if I have done something wrong, or if its supposed to behave like that? Or is there a setting somewhere to disable auto-creation of shortcuts on the home screen for the work profile? EDIT: Just an update - I’ve noticed the additional shortcut appears when you launch the app from the `Shelter` ‘_unfreeze & launch_’ app shortcut, then disappears again when you use the ‘_freeze all_’ shortcut from `Shelter`. So maybe it is expected behaviour? But still seems a bit odd so presume you must be able to turn it off somewhere… 🤔 ---
**Author:** ![Mycenius](https://community.braxtech.net/user_avatar/community.braxtech.net/mycenius/32/181_2.png) [@Mycenius](https://community.braxtech.net/u/Mycenius)\ **Post date:** [September 24, 2025, 9:40am UTC](https://community.braxtech.net/t/sandboxing-applications/1515/11 "2025-09-24T09:40:13Z")
> [@Mycenius](#): > > I’ve noticed the additional shortcut appears when you launch the app from the `Shelter` ‘_unfreeze & launch_’ app shortcut, then disappears again when you use the ‘_freeze all_’ shortcut from `Shelter`. Just confirming this is continuing to happen for any apps - it seems to vaguely match the description of the process however that you provided - if that’s what you meant: > [@rik](#): > > Then if you click “Freeze” the actual app will be force stopped _ **and removed from you app menu** _, but tapping that “Launch icon” will unfreeze _ **and launch it again** _… EDIT: 28 September - Due to no more that 3 consecutive posts limit (so can’t post this as a new post): @rik - your help please if that’s okay - should iodé app be showing in Shelter Work Profile (or should it have cloned itself there), or do you need to install a separate copy there - do you know? I am finding none of my Shelter Work Profile apps activity show in the default iodé app so I’m suspecting they are getting full access to internet, there is no cloned copy in Shelter, and in Shelter Main there is no iodé app listed to clone into Shelter? So is the correct action to ‘install’ another copy of iodé app into Shelter Work Profile? ---
**Author:** ![LostEther](https://community.braxtech.net/letter_avatar_proxy/v4/letter/l/7ab992/32.png) [@LostEther](https://community.braxtech.net/u/LostEther)\ **Post date:** [October 6, 2025, 9:41am UTC](https://community.braxtech.net/t/sandboxing-applications/1515/12 "2025-10-06T09:41:19Z")
[quote=“rik, post:3, topic:1515”] Yes, I use “Shelter” downloaded from `F-Droid` for a few apps I don’t want continually running in the background and to keep them away from my personal data. It will set up your “work profile” on your phone. In Shelter, it shows “Main” (normal apps). I then tap “Aurora Store” and “Clone to Shelter”, and launch that version to then install other apps in Shelter. All the apps I add to Shelter (that I want to disable when not using them) I then tap and tick “Auto Freeze”. Then I also select “Create Unfreeze and/or Launch Shortcut” which adds a launcher to that app on my home screen. Then if you click “Freeze” the actual app will be force stopped and removed from you app menu, but tapping that “Launch icon” will unfreeze and launch it again. Finally, in Shelter I tap “3 dots \> Create Batch Freeze Shortcut” and put that on my home screen. Tapping that will freeze _ **all apps** _ that you set to auto-freeze at once. [/quote]to remind you @rik since it is a very bad advice you are giving there. Work profile has been advised against by google themselves. They have modified their code to do so accordingly and that from the beginning of android 13 to 14. They after reverted back the changes in android 15 by pressure of major actors who wanted to keep their work profiles running for their employees. Let’s say more accurately their neighbours of Alpahabet Campus. > **[Android 14 changes how the work profile is turned off | Jason Bayton](https://bayton.org/android/android-14-work-profile-behaviour/)** > > Simplifying modern Android management So your shelter app which is working… well not so good for privacy. @Mycenius There is no real sandboxing on android. That’s the short answer. Not as understood by cybersec experts as me and working the field. There is “some” sandboxing which is not exactly the same thing. Even if the dictator, yet competent, from grapheneOS is banning everyone having a counter expertise as his from his matrix server. A real sandboxing would mean that the OS layer can’t have access to any information from the APP and vice verca. That it would be 2 black boxes with some input and output. That there would be no interconnection or requirements to check up with the play store for example, or maybe just with heavily ressourced software infrastructure distirbuting tokens for that effect. With also randomnized IDs so you could have even cloned apps on that thing without having to ressource to “partitions” ans whatnot. etc For all that reasons, you don’t have cybersec firms or agencies running malwares in “sandboxes” as browser companies and phones companies pretend to do sandboxing. Or else you can easily understand that we would live in a very nice world where you could have 10 tabs of META products opened with 10 different profiles and META would not be able to recognize you. This is not the world we live in. META is able to, Google is, Apple is not even trying to do anythign about it with good reasons, even github you can’t have their system detecting that you have several profiles even on 2 different browsers running on the same OS. For that you would need a VM. The advised way by graphene and by google is to create another user on your phone. But as you will be able to see, the system has still knowledge of all the apps installed and installers do too. If installers do, then every bit of software having some kind of request having some kind of ressemblance to the android API of those installers have also knowledge of what is installed on your phone. And that even with another user partition activated. This is really easy to check out by the way. So believe what you want from the iodeteam and others, on phone there is no real “sandboxing”. This is the same debate over and over we have about “sandboxing webbrowsers”, same debate same joke. > **[Work Profile vs. User Profile - GrapheneOS Discussion Forum](https://discuss.grapheneos.org/d/115-work-profile-vs-user-profile)** > > GrapheneOS discussion forum You will see in this thread, people have not even bothered verify what was exactly in the code and what were the API calls being made and how it is being done. But still you will be able to read about work profile and why it is even worst than user profile, which is exact, not same encryption key etc. So the bullshits about apps being siloed and so forth and so forth… Well there a big fucking long “IFs” to add to that bit. On a separate subject just to prove a point which is purely software wise as would be silo§ing apps Actually they have that bad implementation about mostly everything that even randomizing MAC wifi address is a challenge for them: that was the case in 2017 > **[MAC randomization: A massive failure that leaves iPhones, Android mobes open...](https://www.theregister.com/2017/03/10/mac_address_randomization/)** > > Security flaws smash worthless privacy protection a study 3 years later > **[popets-2021-0042.pdf](https://petsymposium.org/popets/2021/popets-2021-0042.pdf)** > > 537.81 KB still the case in 2023 > **[iPhones have been exposing your unique MAC despite Apple’s promises otherwise](https://arstechnica.com/security/2023/10/iphone-privacy-feature-hiding-wi-fi-macs-has-failed-to-work-for-3-years/)** > > “From the get-go, this feature was useless,” researcher says of feature put into iOS 14. And I am pretty sure I found somewhere a study about Apple being better than android at mac randomnization in 2025 ---
**Author:** ![Mycenius](https://community.braxtech.net/user_avatar/community.braxtech.net/mycenius/32/181_2.png) [@Mycenius](https://community.braxtech.net/u/Mycenius)\ **Post date:** [October 7, 2025, 3:21am UTC](https://community.braxtech.net/t/sandboxing-applications/1515/13 "2025-10-07T03:21:08Z")
> [@LostEther](#): > > So your shelter app which is working… well not so good for privacy. > > @Mycenius > There is no real sandboxing on android. > That’s the short answer. Not as understood by cybersec experts as me and working the field. There is “some” sandboxing which is not exactly the same thing. Thanks - oddly enough I was starting to suspect that the sandboxing was not exactly as I had assumed, as I was seeing some behaviour I wouldn’t expect. It does sort of work but inter-connectivity is still easily present in some ways (e.g. iodé app in main profile seems to be able to see activity of apps in work profile - but don’t know android and the system architecture well enough to be able to speculate why). While not can expert I ran a Corporate IT team for many years and my basic knowledge and expectations of sandboxes (from a server environment, etc) isn’t the same as what appears to happen on the phone, but as mentioned I can’t tell if that’s just from convenience functionality or the sandbox effect not being fully encompassing. > [@LostEther](#): > > Even if the dictator, yet competent, from grapheneOS is banning everyone having a counter expertise as his from his matrix server. Yes, well, that kinda speaks to some of the concerns I’ve developed around Graphene. > [@LostEther](#): > > The advised way by graphene and by google is to create another user on your phone. But as you will be able to see, the system has still knowledge of all the apps installed and installers do too. I Yep - my original plan was this, with about 3 secondary ‘user’ profiles for different groupings of apps - but as per your second sentence realised this didn’t achieve the root objective of stopping cross pollination of data… Hoped Work Profile with Shelter would do that, or at least as close as possible as you can on Android. I’m not expecting to be Edward Snowden and be untraceable, just want to make the phone as secure as is reasonable but more importantly get control on the privacy and shut down all the tracking and data sharing. > [@LostEther](#): > > have also knowledge of what is installed on your phone. And that even with another user partition activated. This is really easy to check out by the way. That’s (last comment) is good to know - is it covered on one of the links you shared? > [@LostEther](#): > > But still you will be able to read about work profile and why it is even worst than user profile, which is exact, not same encryption key etc. Is that different if you have a company controlling the phone’s work profile, or just across the board with work profile regardless of user implementation/situation? e.g. in my case I don’t have a company accessing the device in anyway, other than 2 Microsoft apps that are connected to company servers/network. > [@LostEther](#): > > And I am pretty sure I found somewhere a study about Apple being better than android at mac randomnization in 2025 I recall a commentary somewhere relatively recently saying something like that (Apple is better) but don’t recall where and don’t know if there was any reference for it. I have not thought much about randomised mac addresses, assumed they were good practice now as I do recall some concerns expressed originally back whenever (2017?) but assumed that had long since been resolved. ---
**Author:** ![LostEther](https://community.braxtech.net/letter_avatar_proxy/v4/letter/l/7ab992/32.png) [@LostEther](https://community.braxtech.net/u/LostEther)\ **Post date:** [October 7, 2025, 9:14am UTC](https://community.braxtech.net/t/sandboxing-applications/1515/14 "2025-10-07T09:14:29Z")
sandboxing is a larger term which has been deployed broader than its original and current use by security services for example. So no we should not have called that sandboxing. Because they are calling the fact of pooling fingerprinting together as sandboxing also → which is not. So work profile → no good. User profile → a bit better because different encryption key different password etc. And It’s not about being Edward Snowden here. It is about the fact that you are being lied to by a technical term which was relevant to very specifically things. You don’t need a link to verify that. Do a simple test. Use an intaller tool on user profile one and user profile 2. Try to install the same app with the same ID. You should get an error from this. If not, good that means they have finally accepted to implement cloned ids of the same app. But that was still current one year and a half. As mentioned in the link I have given ,but you can read the whitepapers about it which are freely available on privacy guides for the average people. Different encryption key etc. This is not the case for the work profile. Work profile it’s ACLs basically. Let’s say you have Pegasus infected your phone or one of the dozen derivatives in circulation at this very moment including poisoning malware on whatsapp coming in. And no you don’t need to be a spy to be infected by those. This is used by local police in western europe on regular basis. The head commissionner from several western european countries of different capitals have been invited to Israel during the last 2 months and they had to decline because of the public outrage because of the palestinian genocide. That was directed for NSO’s and other firm new products presentations. This include new cellebrite version, briefcam etc etc. So really we are not talking about being Snowden here, this is for the average commoner. And I won’t even mentionned the US with their yottabytes of datacenter in Utah here created by the NAVY for the main purpose of the NSA + all the similar DC who have popped up around that same datacenter from big Tech(doing mostly the exact same thing but that’s for another debate). So back to our story, when the DI have a doubt about you and your activities, they will ask the equivalent of the DA here in Europe for a communication interception and following procedure through camera. Which is done by infecting your phone by some cases and following you through ANPR camera with the briefcam software which uses AI to follow you camera by camera. So those piece of software, like Pegasus, will have access to your entire phone whether or not it is a work profile, another user profile or whatever. That’s why sandboxing you can just trash that word in that context. I don’t have a real problem with that per se, I have problem with that because : 1/ crippeling cryptography 2/ Interpol database, same as the NSA 3/ no judicial oversight. done by executive branch. Officers are abusing their powers most of the time and don’t even have a degree, so no knowledge of the penal code. 4/ corruption of those same police officer having those tools at hand. no Randomization of MAC address have not been resolved. This is a complex algorithmic issue. And should I remind you since you have worked in tech, that we are still not mitigating all the risk of precticable branches on CPU after now, more than 8 generations of CPUs. There are even more and more breaches being discovered. Wifi is still not secure since even wpa3 is crackable. And only the Chinese have broken the barrier of the 8,5Gb limit that we have on consumer fiber with their OTN up to 10Gb. And they know have a better algorithm of Djikstra that I am sure yo uhave used for years thinking this is the best we can do because this was considered as a Neperian logarithmic problem → so unsolvable according to us. Well they did solve it. So really no, don’t assume things. Ask people who actually knows in depth the fields you are researching. P.S.: one last bit of pointers @Mycenius you need to understand that we are in the timeframe of “store and decrypt later” . If you don’t know what I am talking about, you can search about it or participate to actual non profit who organizes such talks every months in most western countries. Or talk to people like me. ---
**Author:** ![Mycenius](https://community.braxtech.net/user_avatar/community.braxtech.net/mycenius/32/181_2.png) [@Mycenius](https://community.braxtech.net/u/Mycenius)\ **Post date:** [October 7, 2025, 11:13pm UTC](https://community.braxtech.net/t/sandboxing-applications/1515/15 "2025-10-07T23:13:09Z")
> [@LostEther](#): > > one last bit of pointers @Mycenius you need to understand that we are in the timeframe of “store and decrypt later” Oh yes, absolutely! I am fully across that - talked about it extensively, especially a lot a couple of years ago when LastPass had that massive data breach and many of the vaults stolen had older levels of encryption - people were all “its okay its encrypted they can’t get in” - trying to explain to them its a ticking time bomb and eventually (sooner or later) that data will be cracked was a lost cause!! Not helped by LP’s incompetence (or rather negligence) where some customers vaults were only hashing a handful of times as they weren’t auto updating to latest level of encryption (or at least notifying customers to manually change it)! ---
**Author:** ![LostEther](https://community.braxtech.net/letter_avatar_proxy/v4/letter/l/7ab992/32.png) [@LostEther](https://community.braxtech.net/u/LostEther)\ **Post date:** [October 8, 2025, 7:05am UTC](https://community.braxtech.net/t/sandboxing-applications/1515/16 "2025-10-08T07:05:39Z")
I am not worried about hackers having the capabilities to decrypt those data dump any time soon. There are more urgent matter than this honestly. ---
**Author:** ![Mycenius](https://community.braxtech.net/user_avatar/community.braxtech.net/mycenius/32/181_2.png) [@Mycenius](https://community.braxtech.net/u/Mycenius)\ **Post date:** [October 8, 2025, 6:24pm UTC](https://community.braxtech.net/t/sandboxing-applications/1515/17 "2025-10-08T18:24:16Z")
> [@LostEther](#): > > I am not worried about hackers having the capabilities to decrypt those data dump any time soon. Yeah, ditto - but they will one day - I really just mentioned it as a simple example of how all encryption will eventually be broken - just needs enough time and enough computing power in some combination, etc, if the level of encryption remains static… ---
**Author:** ![ChinPerfe](https://community.braxtech.net/letter_avatar_proxy/v4/letter/c/ebca7d/32.png) [@ChinPerfe](https://community.braxtech.net/u/ChinPerfe)\ **Post date:** [November 22, 2025, 9:47pm UTC](https://community.braxtech.net/t/sandboxing-applications/1515/18 "2025-11-22T21:47:20Z")
Wow…my lack of fear (being able to undo whatever I did) bit me in the donkey. I didn’t follow what you were saying…those steps are either different now (we’re on iode 6.9), or you didn’t show your work. Either way, I just gave it a go…big mistake. And uninstalling, then re-installing the Shelter app leads to errors, now (I guess I have to delete my work profile…wherever that menu combination is located). In any case, if anyone can point to a step-by-step demo or maybe a video, _please_ share. * * * Edited to add…I read the rest of the thread, so it seems pretty pointless to worry about a Work profile, since the data seems to get mined regardless. * * * Edited to add another comment…doing a search for “work profile” on the Brax3 gets a result labeled “More security & privacy". Select it. Scroll down and tap of “Device admin apps.” You should be able to use that to remove the work profile. Hope that helps someone else (not commenting on the merits or lack thereof of work profile…there’s conflicting information there…this is just if you decide to un-do the Shelter app’s efforts on your behalf). ---
**Author:** ![ChinPerfe](https://community.braxtech.net/letter_avatar_proxy/v4/letter/c/ebca7d/32.png) [@ChinPerfe](https://community.braxtech.net/u/ChinPerfe)\ **Post date:** [November 24, 2025, 4:47pm UTC](https://community.braxtech.net/t/sandboxing-applications/1515/19 "2025-11-24T16:47:41Z")
“…tap on…” not of. iode [says (or maybe implies)](https://blog.iode.tech/iodeos-6-9-update-auto-reboot-private-space-and-more/) that separate users and profiles are a good security practice. Maybe not sandboxing per se, but without getting in to the weeds…is what is discussed in this thread (and at that link) still a best practice? (I honestly don’t know…I’m asking)