সাইবার সুরক্ষা — Privacy Policy

Last updated: June 2025

1. Who We Are

Cyber Surokkha ("we", "our", "the app") is a free, public-interest cybersecurity awareness application built for the people of Bangladesh. It is not operated for profit.

2. Data We Do NOT Collect

• Your name, phone number, email address, or any identity information.
• Device scan results — these are stored only on your device, in your app's private local database, and are never transmitted to any server.
• Your location.
• URLs you check — the URL checker runs locally; a hash (not the URL itself) is used for blocklist lookups. If Google Safe Browsing is enabled, a partial hash is sent to Google under Google's own Privacy Policy.
• Call logs, SMS content, contacts, or media files.

3. Data We Process On-Device Only

• Device security scan: reads OS version, screen lock state, accessibility services, device administrator list, and app permissions. Results stay on your device.
• Phone number lookup: the number you type is converted to a SHA-256 hash on your device. Only the hash is sent to our server. We never receive or store raw phone numbers.
• QR code scanning: decoded entirely on-device using ML Kit. The decoded URL is then passed through the local URL checker pipeline.

4. Community Stories

If you choose to submit a story, you may provide a title, body text, district, category, and amount lost. You can mark your story as anonymous. We do not require or link stories to any identity. Stories are reviewed by volunteer moderators before publication and may be declined or edited for safety.

Story submissions are associated with an anonymous Firebase Authentication UID. This UID cannot be linked back to your identity by us or by third parties.

5. Anonymous Authentication

The app uses Firebase Anonymous Authentication to attach a random, non-identifying UID to your requests (e.g. voting on stories, submitting content). This prevents spam without requiring you to create an account. You can reset this by clearing app data. Firebase processes this UID under Google's Privacy Policy.

6. Analytics (Opt-In)

We use Firebase Analytics to understand which features are most useful. Analytics are disabled by default. You can enable them in Settings → Privacy → Share anonymous usage data. If enabled, we collect anonymous events such as "article viewed" or "scan completed" — no personal identifiers, no content of what you read.

7. Push Notifications

If you allow notifications, your device's Firebase Cloud Messaging (FCM) token is sent to our server. This token is used only to deliver security alerts and scan reminders. It is not shared with third parties and is deleted when you uninstall the app or disable notifications.

8. Content Sync

The app periodically fetches articles, alerts, tips, and blocklist updates from our backend server. These requests include no personal data — only a language preference and a timestamp for delta sync.

9. Third-Party Services

• Firebase (Google) — anonymous auth, FCM push, opt-in analytics, crash reporting. Governed by Google's Privacy Policy.
• Google Safe Browsing API (optional, requires API key) — partial URL hashes sent to Google for phishing detection. Governed by Google's Privacy Policy.
• VirusTotal (optional, requires API key) — SHA-256 hash of newly installed APKs sent for malware scanning. Governed by VirusTotal's Privacy Policy.

None of these services receive your identity, scan results, or story content.

10. Data Retention

• Local scan results: kept on your device until you clear app data.
• Community stories: retained on our server until you request deletion (email us — see Section 12).
• FCM tokens: deleted on uninstall or on your request.
• Anonymous UID: can be reset by clearing app data.

11. Children

Cyber Surokkha does not knowingly collect data from children under 13. The app contains no child-directed content.

12. Contact & Deletion Requests

To request deletion of any data associated with your anonymous UID or submitted stories, email us at: [support email — add before publishing]

We will respond within 14 days and delete all associated data within 30 days.

13. Changes to This Policy

If we make material changes, we will update the "Last updated" date above and, where appropriate, notify users via an in-app alert. Continued use of the app after changes constitutes acceptance.