How does Fold'em block gambling?

The app layer

Fold'em asks Apple's Screen Time to shield a set of apps. The set comes from Apple's own picker, which hands back opaque tokens rather than names, so Fold'em blocks exactly the apps you selected and can never add one on your behalf. That is also why setup is a guided search: the checklist names ten sportsbooks and casinos to look for, and Fold'em counts how many tokens came back without ever learning which app each one is.

Three browsers sit on that same checklist. Chrome, Firefox and Edge are sealed as apps rather than filtered, because Screen Time's web filter only reaches Safari. Safari itself is never sealed as an app, because it is the browser the filter can reach.

There is one optional addition. Sealing the Games category asks Screen Time to shield every App Store game, including ones installed later, which catches a betting app filed under Games that no list could have named in advance.

The web layer, and three different outcomes

Three separate mechanisms can stop a gambling site, and each one looks different on screen. Knowing which one you are looking at is how you tell a working block from a broken one.

An address on the web shield's list never loads. The shield is an encrypted DNS resolver Fold'em runs, and iOS is asked to use it for every request the phone makes. When a name matches, the resolver returns no usable address and the browser reports that the server could not be found. This is the layer that reaches every browser, and the phone's own tile states the count it covers: 356,500 sites.

An address on the curated Screen Time list shows Apple's page, not ours. Ten named sportsbook and casino domains are handed to Screen Time's content filter, which is Apple's machinery and draws Apple's own restricted site notice. It applies in Safari only.

A website you added yourself shows Fold'em's wall. Sites you pick are held by Screen Time as shielded web domains, and those are the ones that raise Fold'em's own block screen with a line from the pack you chose.

What keeps both layers on

Nothing about either layer loosens on the phone's own decision. When you ask to leave early, the request goes to the server, your keyholder can keep the lock remotely in one tap, and an approval has to be given in person by scanning the code on their Wallet pass. A keyholder cannot approve an exit remotely from any page, pass or email. With nobody named, the same request approves itself and the wait runs fourteen days instead, so the layers hold either way.

After an approval the server writes a wait of at least 72 hours and holds it. When the wait ends the server marks a release as available and the phone still keeps every shield up until you take it, so nothing opens by itself. The phone never uses its own clock to decide any of this, which is why an offline phone stays blocked.

Where to check that both are holding

What this does not do

Neither layer reaches off this phone. A second phone, a laptop, a betting shop and cash are outside both of them, and no iOS app can block them. The app layer covers exactly the apps you picked plus the Games category if you sealed it, so a sportsbook filed under another App Store category and never added by hand is not covered.

The web shield is a resolver and not a tunnel: no traffic is routed through Fold'em, and nothing you browse is sent anywhere. That also means another VPN or a private relay answering DNS in front of it takes the shield out of the path, and the tile says so rather than pretending otherwise. The list the shield answers from comes from public gambling lists, so a brand new domain can be missing until those lists catch up.