Vigil Privacy Policy

Effective Date: March 6, 2026  |  Last Updated: October 13, 2026

1. Who We Are

Vigil is developed and operated by Kaiastra, and is published on Google Play by developer Krishna Kadaba. It is based in Hyderabad, Telangana, India. Vigil is a mobile security app that scans URLs and QR codes to protect you from phishing, malware, and online fraud.

2. Data We Collect — The Complete List

Below is an exhaustive list of every data point Vigil collects. There is nothing beyond this list.

2.1 During Device Registration (one-time)

When you first open Vigil and accept the privacy policy, the app registers your device with our server. The following is sent:

Data	Example	Why
Random device ID	a1b2c3d4-e5f6-...	To authenticate your device (this is NOT your IMEI, phone number, or Google account)
Platform	"android"	To serve the correct responses
OS version	"14"	To handle version-specific behaviour
App version	"1.8.0"	To ensure compatibility
Device manufacturer	"Samsung"	To troubleshoot device-specific issues
Device model	"Galaxy S21"	Same as above
Device language	"en"	To localise content
Country code	"IN"	To match you with the right reporting authorities

Our server returns a random authentication token and a signing secret. These are stored encrypted on your device using Android Keystore (AES-256-GCM). We store only a one-way hash of your token on our server — we cannot read your token from our database.

2.2 During URL Scans

When you scan a URL (manually or from a QR code), the following is sent to our server:

Data	Sent?	Details
URL hash (SHA-256)	Always	A one-way fingerprint of the URL. We check this against our threat database first.
URL features	Yes	Computed characteristics: URL length, whether it uses HTTPS, number of subdomains, top-level domain, whether it's a shortened URL.
Local risk score	Yes	A 0–100 score computed on your device before sending to the server.
Source	Yes	"manual_scan" or "android" — tells us how the scan was started.

2.3 Periodic Heartbeat

The app periodically sends a lightweight status update to our server:

• Total count of URLs scanned (just the number, not the URLs)
• Total count of threats detected (just the number)
• Device language and country code
• Current timestamp

2.4 If You Report a URL

If you choose to report a URL to authorities through the app, the following is sent:

• URL hash and the threat type you selected
• Your optional description of why it's suspicious
• Your country code (to match the right authority)

2.5 If You Submit Feedback

If you voluntarily submit feedback through the app, your star rating (1–5) and optional message are sent. No personal information is attached — only your anonymous device token for authentication.

2.6 Clipboard Monitoring (Optional)

If you enable clipboard monitoring in Settings, the app watches your clipboard for copied URLs so it can warn you before you open a dangerous link. Exactly the same rule applies: only the URL is extracted and processed. The rest of whatever you copied is discarded immediately and never sent to our server or stored. This feature is disabled by default.

3. Data We Explicitly Do NOT Collect

• Contacts — we do not read your contacts
• Location — we do not request location permissions
• Your personal photos, files, or media — we have no access; retained images come only from the public webpage you selected for scanning
• Call logs — we do not request this permission
• Your identity — no name, email, phone number, or Google account is collected
• IMEI or hardware serial numbers — we generate a random ID instead

We also do not use any third-party analytics, crash reporting, or advertising libraries. There is no Firebase Analytics, Google Analytics, Facebook SDK, Sentry, Mixpanel, or any similar tracking in Vigil.

4. Where Your Data Is Stored

4.1 On Your Device (Local Storage)

• Scan history — stored in a local database (Room/SQLite). Contains: the URL, risk score, verdict, threat type, confidence, reasoning, and scan source. This never leaves your device unless you explicitly share it.
• API credentials — your device token and signing secret, stored in EncryptedSharedPreferences (AES-256-GCM via Android Keystore).
• Transparency log — a local-only record of every interaction between the app and our server. You can view this in Settings at any time. This is never transmitted.
• Settings and preferences — your scanning toggles, theme, language, and consent state.
• Threat database cache — a periodically updated dataset from our server used for fast local lookups. Contains no personal data.

4.2 On Our Server

• Device record — your random device ID, token hash (one-way, not reversible), platform, OS version, app version, manufacturer, model, language, country, registration date, and last active date.
• Page snapshots — the original/final URL, redacted visible text, page title, form-field descriptions, and up to three validated raster images fetched from the selected public page. Raw HTML, cookies, and form values are not stored. Snapshots are kept for no more than 30 days.
• Threat intelligence — URL hashes, domain hashes, threat types, risk scores, proprietary reasoning, and red flags. This data is shared across all users to improve protection.
• Reports — URL hash, threat type, your description, and country code.
• Feedback — your rating and message.

5. Third-Party Services

Vigil interacts with a small number of third-party services. Here is the complete list:

5.1 Google Play Integrity API

We use Google's Play Integrity API to verify that your device is running a genuine, unmodified version of Vigil. During attestation:

• A cryptographic nonce (random challenge) is sent to Google
• Google returns a signed token confirming whether the app is genuine and the device is not compromised
• Our server verifies this token and stores the attestation verdict (pass/fail) on your device record

Google's Play Integrity API privacy policy applies to this interaction. We do not send Google any personal data — only the nonce and your app's package name.

5.2 Google ML Kit (On-Device Only)

The QR code scanner uses Google ML Kit's barcode scanning library. This runs entirely on your device. Camera frames are processed locally — no images or data are sent to Google.

5.3 Threat Databases (Server-Side Only)

Our server checks scanned URLs against threat databases sourced from multiple trusted security intelligence providers, including VirusTotal. Your device does not contact these providers directly — only our server does, on your behalf. What is shared with these providers is the URL (or its hash) being checked; no personal data, message content, or sender information is ever included.

5.4 AI Analysis Providers

When a URL requires deeper analysis (its hash isn't already in our threat database), our server sends the URL and technical features derived from it — including redacted visible page text, redirect chain, and structural characteristics — to third-party AI model providers via OpenRouter, which routes the request to large language models to help classify the threat. Retained page-image binaries are not sent to those AI providers. What is never sent: your device identity, message text (unless you explicitly shared it via the app's share feature), sender information, or any other personal data. These providers process the request to return a classification and do not receive any way to link it back to you.

5.5 No Other Third Parties

Beyond what's listed in 5.1–5.4 above, we do not use any advertising networks, social media SDKs, analytics platforms, or data brokers. There are no hidden trackers in Vigil.

6. How Data Is Protected In Transit

All communication between Vigil and our server is protected by two layers of encryption:

• Layer 1 — TLS (HTTPS) with certificate pinning to our server's certificate. This prevents man-in-the-middle attacks, even if a certificate authority is compromised.
• Layer 2 — Application-level encryption using AES-256-GCM. Every request body is encrypted with a key derived from your device's signing secret before being sent. Even if TLS were somehow broken, the data would still be encrypted.

Additionally, every request is signed with HMAC-SHA256 to prevent tampering.

7. How URLs Are Classified

Before a URL is classified as safe, suspicious, or malicious, it passes through a 74-point proprietary inspection pipeline spanning both your device and our server:

• 15 on-device checks
• 59 server-side checks

This multi-layered approach ensures that threats are caught even when they evade individual detection methods. The specific techniques and scoring algorithms used are proprietary to protect them from being reverse-engineered by attackers.

8. Permissions — Why Each One Is Needed

Permission	Why It's Needed	Optional?
Camera	To scan QR codes using the built-in scanner	Yes — only used when you open the QR scanner
Clipboard access	To detect and warn about dangerous URLs you've copied (see 2.6). No special Android permission is required for this.	Yes — disabled by default
Notifications	To alert you when a threat is detected	Yes — disabled by default
Display over apps	To show a floating warning when you're about to open a dangerous link	Yes — disabled by default
Internet	To communicate with our scan server	Required
Network state	To check if you're online before making requests	Required
Run at startup	To restart protection after your device reboots (only if you've enabled scanning)	Automatic if scanning is enabled
Foreground service	To keep the scanning service running reliably	Automatic if scanning is enabled
Vibrate	To provide haptic feedback on threat detection	Automatic

All sensitive permissions (Camera, Notifications, Overlay) are disabled by default and require your explicit action to enable. You can revoke any permission at any time through Android Settings or within the app.

9. Data Retention & Deletion

9.1 On Your Device

Local scan history is kept until you delete it. You can delete individual entries or all history from Settings.

9.2 On Our Server

• Device records — kept while your device is active. Deleted when you request data deletion.
• Scan logs — plaintext URLs are kept for no more than 30 days and then cleared. When you request data deletion, plaintext URLs are cleared immediately and your device ID is removed; URL hashes and verdicts may remain as anonymous threat intelligence.
• Page snapshots and images — automatically deleted within 30 days, or immediately when you request data deletion.
• Reports and feedback — deleted when you request data deletion.
• Threat intelligence — URL hashes, threat types, and verdicts are retained permanently as part of our shared threat database. This data is anonymous and cannot be linked back to any individual user.

10. Your Rights Under DPDPA

In accordance with India's Digital Personal Data Protection Act (DPDPA), 2023, you have the right to:

• Withdraw consent — tap "Withdraw Consent" in Settings. All scanning stops immediately, both background services are shut down, and the app resets to the onboarding screen. Your local scan history is preserved (in case you want to re-consent later), but no new scanning occurs.
• Delete your data — tap "Delete My Data" in Settings. This erases all local data and anonymises your server-side data as described above.
• Access your data — view your complete scan history within the app. View the transparency log in Settings to see a record of every interaction between the app and our server.
• Correct your data — if you believe a scan result is incorrect, you can report it through the app.

11. Transparency Log

Vigil includes a built-in transparency log that records every communication with our server. For each interaction, the log shows:

• The timestamp
• The type of interaction (URL Scan, Quick Scan, Device Registration, Feedback, etc.)
• Exactly what data was sent to the server
• What data was explicitly NOT sent

This log is stored only on your device and is never transmitted. You can view it at any time in Settings. We created this log because we believe you should be able to verify our privacy claims for yourself.

12. Family Mode

Vigil includes an optional Family Mode that allows family members to coordinate protection settings. All family data (family code, member list, roles, protection profiles) is stored locally on each device only. There is no central server-side family management. Family data is never transmitted to our server.

13. Children's Privacy

Vigil is not directed at children under the age of 18. We do not knowingly collect data from children. If you believe a child has provided data through Vigil, please contact us for immediate deletion.

14. Data Sharing

Anonymised threat signatures (URL hashes, threat type, risk score) may be shared with trusted security partners and used across products to protect more people. These signatures contain no personal data, message content, or sender information — only the mathematical fingerprint of the malicious URL and the type of threat it poses.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes through the app. Continued use of Vigil after such updates constitutes acceptance of the revised terms. You can always review the latest version in Settings or at this URL. All previous versions will be archived and available upon request.

16. Open Questions? Contact Us

If you have any questions about this Privacy Policy, want to know exactly what data we hold about your device, or want to request deletion, contact us at:

Email: support@kaiastra.in

Developer: Kaiastra, Hyderabad, Telangana, India

We aim to respond to all privacy-related enquiries within 48 hours.