Doesn't iCloud Private Relay already do this?
Partially. iCloud Private Relay only protects Safari browsing and unencrypted HTTP. Third-party apps (Instagram, Mail, banking apps), system services, and the App Store still send traffic directly over your Wi-Fi — visible to anyone on the same network. A full-tunnel VPN like Doppler encrypts every app on the device.
Will Always-On VPN drain my iPhone battery?
Negligibly. VLESS-Reality is a low-overhead protocol. Always-On VPN with Doppler typically uses 1–2% additional battery per day — far less than a single notification-heavy app like Slack or Discord.
How do I sign in to hotel and airport captive portals?
Doppler detects captive-portal redirects and temporarily releases the tunnel so the portal sign-in page can load. Sign in, accept the terms, and Doppler re-engages automatically. No manual disconnect required.
Will banking apps still work?
Yes. The VPN exit IP looks like a residential connection in the country you're connected through. If you're abroad and want your bank to see a domestic IP, set Doppler's exit country to your home country. iOS also supports per-app VPN exclusion if your bank specifically flags VPN traffic.
Is this overkill for just checking email at Starbucks?
Email is exactly where this matters — IMAP and SMTP traffic on public Wi-Fi is one of the easiest things to intercept. Modern iCloud, Gmail, and Outlook do encrypt, but Mail.app can fall back to STARTTLS, and not every third-party email service forces TLS. A few seconds of Always-On setup eliminates the question entirely.
Does Doppler work on my iPad and Mac too?
Yes. The same subscription covers iPhone, iPad, and Mac. Install on each device with the same Apple ID — there's no device-count cap for personal use.
What can an attacker actually do on unsecured public Wi-Fi?
Plenty. SSL-stripping downgrades HTTPS connections so they can read your traffic. Evil-twin hotspots impersonate "Starbucks_WiFi" and route everything through their machine. Packet sniffers on the same network see unencrypted DNS queries, app-update checks, and metadata even when the actual page traffic is HTTPS. A VPN turns the entire connection into a single encrypted tunnel that none of these attacks can read.
Does Doppler also encrypt my DNS queries?
Yes. Doppler routes every DNS query through the encrypted tunnel to our resolvers, blocking the most common public-Wi-Fi attack: a malicious resolver telling your browser that "chase.com" lives at an attacker-controlled IP. This protection is on by default and cannot be bypassed by browsers using DNS-over-HTTPS.
What's the difference between using Doppler and just using cellular data?
Cellular data is more trustworthy than random public Wi-Fi, but your carrier still sees every domain you visit (T-Mobile, Verizon, and AT&T have all sold this data in the past). Doppler encrypts your DNS and traffic against the carrier too. And cellular is not free abroad — Doppler on hotel Wi-Fi avoids international roaming entirely.