How to Use Shelter to Create a Work Profile and Isolate Apps on Android (No Root)

Why isolate apps without rooting?

Many Android users want to keep certain apps—social media, finance, or experimental tools—separate from their personal data. A work profile gives you a sandboxed space that behaves like a second device on the same hardware. It prevents apps in the profile from accessing contacts, photos, or other personal files unless you explicitly share them. Unlike rooting, a work profile does not break the device’s warranty, does not expose the system to malware, and can be removed cleanly at any time.

What Shelter does

Shelter is an open‑source app that leverages Android’s ManagedProfile APIs to create a work profile without needing a corporate device‑owner. It works on Android 5.0 (Lollipop) and newer, and it is available from the Google Play Store and F‑Droid. Because it uses the official work‑profile mechanism, the isolation is enforced by the OS, not by a third‑party sandbox.

Before you start

• Android version: 5.0 or later. Newer versions (Android 10+) provide tighter privacy controls, but Shelter works across the range.
• Internet connection: Required to download Shelter and any apps you plan to move.
• Backup your data: While Shelter does not touch your primary profile, creating a work profile modifies system settings. A recent Google Drive backup or a manual adb backup is recommended.
• Battery level: Keep the device above 40 % or plug it in to avoid interruptions.
• Device admin permission: Shelter will ask to become a device administrator; this is safe and can be revoked later.

Step 1 – Install Shelter

If you use F‑Droid, the app may be signed with a different key. In that case, Android will ask you to allow installation from unknown sources. Navigate to Settings → Security → Install unknown apps, select your browser or file manager, and toggle Allow from this source. Then return to Shelter and tap Install again.

Step 2 – Grant Device Administrator rights

Granting this permission does not give Shelter root access; it merely allows the app to ask the OS to create and manage a work profile.

Step 3 – Create the work profile

If the device reports “Unable to create work profile”, check the Device admin status again and ensure the manufacturer has not disabled managed profiles (some custom ROMs do).

Step 4 – Move apps into the work profile

Shelter can import apps from the personal side or install fresh copies from the Play Store within the profile.

Cloned apps retain their data only within the work profile. If you uninstall the profile later, that data disappears without affecting the personal version of the app.

Step 5 – Configure permissions and storage

Android’s permission model applies separately inside the work profile. This means you can grant a less‑privileged set of permissions to the same app in the sandbox.

To share a file, use the Share button and choose the personal profile as the target. Android will copy the file across the profile boundary instead of moving it.

Step 6 – Back up the work profile

Because the work profile is a managed profile, Android’s built‑in backup service can store its data in your Google account, but only if you enable it.

If you prefer a local backup, Shelter includes an Export feature that creates a .tar.gz of the work‑profile app data. Open Shelter, tap the three‑dot menu, choose Export profile, and follow the prompts. Store the archive on a secure cloud service or external SD card.

Step 7 – Managing notifications and UI separation

By default, Android mixes notifications from both profiles, which can defeat the privacy goal. Shelter offers a simple switch:

You can also set a distinct wallpaper for the work profile (Settings → Display → Wallpaper) to give a visual cue that you are operating inside the sandbox.

Step 8 – Removing apps or deleting the work profile

If you no longer need an isolated app, you can delete it without affecting the personal copy.

After deletion, the briefcase icon disappears, and the device returns to a single‑profile state.

Troubleshooting common issues

1. Work profile fails to create

• Cause: Device admin not enabled or manufacturer disables managed profiles.
• Fix: Re‑enable the admin permission (Settings → Security → Device admin apps). If the device is from a brand that blocks work profiles (e.g., some Chinese OEMs), you may need to flash a stock ROM or use a different device.

2. Cloned app crashes immediately

• Cause: The app uses a signature‑based licensing check that fails when duplicated.
• Fix: Install the app directly from the Play Store inside the work profile instead of cloning. Some games and streaming apps do not support work‑profile installations.

3. Backup does not include work‑profile data

• Cause: Android backup is disabled for the profile.
• Fix: Open work‑profile Settings → System → Backup and ensure the toggle is on. Verify that the same Google account is selected.

4. Excessive battery drain after enabling Shelter

• Cause: Background sync of apps inside the profile.
• Fix: Open each app’s battery settings (Settings → Battery → [App]) and restrict background activity where appropriate. Also, consider disabling the Hide work profile notifications toggle if you notice a constant polling service.

Edge cases and manufacturer quirks

While Shelter works on the vast majority of AOSP‑based devices, a few manufacturers implement custom restrictions:

• Huawei / Honor: EMUI may hide the ManagedProfile APIs on older Android versions. Updating to EMUI 10+ usually restores compatibility.
• Samsung: If you already have Samsung Secure Folder enabled, Shelter will detect the existing work profile and refuse to create a second one. You can either use Secure Folder or uninstall it before proceeding.
• Android Go devices: Limited storage can make the .tar.gz export fail. Use the built‑in Google backup instead.

Security considerations

Even though Shelter isolates apps, the host OS still controls the hardware. Keep these points in mind:

• Device admin rights: Revoking Shelter’s admin status removes the work profile. Do this only after you have deleted the profile, otherwise the profile may become orphaned.
• Network separation: Apps inside the work profile share the same network interface as the personal side. If you need network isolation (e.g., a VPN only for work apps), configure a per‑app VPN in Android 10+ or use a third‑party VPN that supports split tunneling.
• Data leakage via shared storage: Copying files from the work profile to the personal side creates a duplicate; the original remains in the sandbox. Review shared files regularly to avoid accidental exposure.

Advanced tip: Using ADB to script profile management

For power users, Android’s pm (package manager) and dpm (device policy manager) commands let you automate profile creation and app installation. Example:

# Create a work profile (requires device owner; Shelter sets this automatically)
adb shell dpm set-profile-owner com.jakewharton.shelter/.ProfileOwnerReceiver
# Install an app into the work profile
adb shell pm install-create --user 10 /sdcard/Download/app.apk

Replace 10 with the user ID of your work profile (you can find it via adb shell pm list users). This method is optional and primarily useful for developers or IT admins who need to provision many devices.

Wrapping up

Using Shelter gives you a fully functional work profile without ever rooting your phone. You gain:

• Strong data isolation for selected apps.
• Separate backup and restore cycles.
• Fine‑grained permission control per app copy.
• The ability to delete the sandbox cleanly when you’re done.

Because the solution relies on Android’s native managed‑profile framework, it works across most devices, respects manufacturer security policies, and can be removed without leaving traces. Follow the steps above, keep a backup of any important work‑profile data, and you’ll have a privacy‑first environment ready in under ten minutes.