Trust Center

How we handle your data and what we commit to never doing.

Privacy commitments

Metadata-only, always

We never inspect message content, browsing history, keystrokes, or any sensitive data. Only behavioral metadata.

Architecture decision

No TLS interception

We will never perform man-in-the-middle attacks on encrypted traffic. Your HTTPS stays encrypted end-to-end.

Architecture decision

Local-first storage

All data lives on your device by default. Cloud backup would require explicit opt-in.

Architecture decision

User-controlled exports

You will be able to decide what data to export and when. Sanitized exports will remove personal identifiers.

Design commitment (planned)

Transparent about limits

We clearly communicate what Android allows and what it does not. No overselling capabilities.

Ongoing commitment

What we collect and what we do not

Never stored

Message content

Example: SMS, WhatsApp, Signal messages

Browsing content

Example: Web page HTML, form data, search queries

Keystrokes

Example: Passwords, credit cards, personal notes

Screen contents

Example: Screenshots, OCR data, visible text

Decrypted traffic

Example: HTTPS response bodies, API payloads

Stored on-device (metadata only)

Network metadata

Example: Destination IP, port, request count, timing

Permission events

Example: When apps request camera, location, etc.

App metadata

Example: Package name, version, install source

Behavioral patterns

Example: Background activity frequency, wake locks

Data retention and controls

These controls are planned for the Privacy Center UI and are not yet implemented.

Baseline data

Rolling 30-day window by default. Configurable to 7, 14, or 90 days.

Incident logs

Kept for 90 days by default. Individual or bulk deletion available.

Complete purge

A "Delete All" option that wipes the local database. Irreversible.

What we will not build

Remote VPN servers

Our VPN is entirely local. We will never route your traffic through our servers or offer exit nodes in other countries.

TLS man-in-the-middle

We will never install a root certificate to intercept HTTPS traffic. Content inspection is incompatible with our metadata-only commitment.

Cloud-based threat intelligence

We do not send hashes of your installed apps to cloud servers for reputation lookups. All analysis is local.

Frequently asked questions

Security contact

Found a security issue? Please report it responsibly.

security@baselyt.com