The short answer: an ordinary VPN moves the entire phone through the server, including the apps that this breaks. A different approach works — route individual apps rather than the phone: whatever should stay direct, keep direct.
What actually changes when the tunnel comes up
An app on your phone does not know that you switched anything on. It knows one thing: the address it reached the network from. While the phone works through your carrier or home Wi-Fi, that address belongs to your provider and your city. The moment all traffic goes through a server, the address becomes the server's — a different carrier, a different country, and sometimes a history: someone else may have visited the same service from it before you.
To the app this looks like an abrupt change of surroundings. A second ago you were in one place, now you are in another, with no intermediate step and no explanation.
Why banking, government and delivery apps react more than others
For these apps the address you sign in from is part of the check. A bank looks at whether the sign-in looks unusual. A government service may only work inside its own country. A delivery service reads the city from the address and offers the wrong warehouse. None of them is broken — each does exactly what it was written to do.
Hence the symptoms people recognise: an endless spinner instead of the sign-in screen, a sudden request to confirm the login, being signed out, a message that the service is unavailable in your region, the wrong city in the delivery address.
Why switching it on and off is not the answer
The most common approach is to keep the tunnel off and turn it on by hand when it is needed. It works, but badly: you have to remember it every time, and half the moments when it is needed happen in the background, while the phone sits in your pocket.
The second approach is split tunnelling, where the app offers it. That is closer to the point, but in many apps it is a single switch — the whole list or nothing: no rules by address, and no fallback for when the server does not answer.
What works: a route for the app, not for the phone
The task is stated differently. Not "turn the VPN on", but "decide, for each app, which way it goes". Then banking, government and delivery apps stay on their usual route, no check is triggered, and through the server goes exactly what you needed it for.
That is how Stealtify is built. Apps are assigned to groups, the group carries a proxy, and the traffic of the apps in that group goes through it. Everything you did not tick goes direct — as if nothing were switched on at all.
One detail worth knowing in advance: while there is not a single rule in the client, a raised tunnel carries every bit of traffic. The moment one rule exists, the rules decide, and everything outside them goes direct.
When a rule by site address suits better than one by app
Sometimes what you need through the server is one site rather than a whole app. That is what domain rules are for: an exact address such as example.com, a subdomain like mail.example.com, or a mask such as *.example.com.
Domain rules have a limit that is best known in advance. The match is made on the host name visible while the TLS connection is established — not on the destination address. An app that resolves names over DNS-over-HTTPS, or keeps addresses hard-coded inside itself, will not be caught by a domain rule: route that one whole, with a rule by app.
What per-app routing does not fix
It solves exactly one problem — who goes which way. It does not make the connection faster: speed is set by the server and the distance to it. It does not hide you from whoever runs the server: they can see where you are connecting. And it does not remove the main condition — the access to a server is yours to bring. The client does not provide servers and does not sell them.
Where to start if you want to try
The order is this: install the client, add a server — your own, or one you already have access to — and assign to the group with that server only the apps that need a different route. Banking, government and delivery apps need no rule at all: without one they already go direct.