Trust Center
How we handle your data and what we commit to never doing.
Privacy commitments
Metadata-only, always
We never inspect message content, browsing history, keystrokes, or any sensitive data. Only behavioral metadata.
No TLS interception
We will never perform man-in-the-middle attacks on encrypted traffic. Your HTTPS stays encrypted end-to-end.
Local-first storage
All data lives on your device by default. Cloud backup would require explicit opt-in.
User-controlled exports
You will be able to decide what data to export and when. Sanitized exports will remove personal identifiers.
Transparent about limits
We clearly communicate what Android allows and what it does not. No overselling capabilities.
What we collect and what we do not
Never stored
Message content
Example: SMS, WhatsApp, Signal messages
Browsing content
Example: Web page HTML, form data, search queries
Keystrokes
Example: Passwords, credit cards, personal notes
Screen contents
Example: Screenshots, OCR data, visible text
Decrypted traffic
Example: HTTPS response bodies, API payloads
Stored on-device (metadata only)
Network metadata
Example: Destination IP, port, request count, timing
Permission events
Example: When apps request camera, location, etc.
App metadata
Example: Package name, version, install source
Behavioral patterns
Example: Background activity frequency, wake locks
Data retention and controls
These controls are planned for the Privacy Center UI and are not yet implemented.
Baseline data
Rolling 30-day window by default. Configurable to 7, 14, or 90 days.
Incident logs
Kept for 90 days by default. Individual or bulk deletion available.
Complete purge
A "Delete All" option that wipes the local database. Irreversible.
What we will not build
Remote VPN servers
Our VPN is entirely local. We will never route your traffic through our servers or offer exit nodes in other countries.
TLS man-in-the-middle
We will never install a root certificate to intercept HTTPS traffic. Content inspection is incompatible with our metadata-only commitment.
Cloud-based threat intelligence
We do not send hashes of your installed apps to cloud servers for reputation lookups. All analysis is local.