This page sets out, in one place, what Vift AI accesses on your phone, why, what leaves the phone,
and the rules we follow. Vift AI is operated by BrainyBolt, House No. 5, Paivazhi Junction, Kulanada, Pathanamthitta, Kerala 689503, India (viruxaai@gmail.com). It complements the Privacy Policy.
Permissions and why each is needed
- All files access / storage — File Shield checks files as they arrive. File contents
never leave your phone; only a one-way fingerprint (SHA-256) may be checked online.
- Query all packages — to check installed apps for malware, spyware and remote-access
tools, and to show which apps hold sensitive permissions.
- Usage access — to show when an app last ran and to notice a payment app being
opened during a call. Not used for analytics.
- Phone state — to know a call is in progress (no numbers are read or uploaded).
Call screening (Android 10+, optional) — to check a call from a number not in your
contacts; Vift AI never blocks a call.
- Precise location — Android requires it to read whether your Wi-Fi is encrypted and
to list nearby networks. No location is ever stored or sent.
- Notifications — to warn you. Camera — only if you choose to take a
profile photo. Background and boot permissions — so the shields keep running.
- No SMS, call-log, contacts or microphone permission is requested.
What leaves your phone
- A file's SHA-256 fingerprint (never the file), and a flagged app's package name and permissions.
- The host name of a link in a message you choose to check (Cortex) — never the message.
- A device identifier and your plan status, so a subscription works. Your account email if you
create one.
- Nothing is sold, and nothing is used for advertising. The app contains no ads and no analytics or
session-recording SDK.
Security of our servers
- All traffic is encrypted (HTTPS). Passwords are stored only as salted bcrypt hashes.
- Requests are rate-limited; repeated failed sign-ins lock the account for 15 minutes; attacks are
logged.
- Secrets and keys live only in the server's environment, never in the app or in source control.
- The app never connects to the database. Only our server can, with credentials held in its environment, over an encrypted connection.
Retention
- Threat events: deleted automatically after 90 days. Sender reports: kept for at most 180 days.
- Account and subscription records: until you delete them in the app or ask us to.
- Scan history, findings and the quarantine vault: on your phone only, removed when you uninstall.
Your rights
Under India's Digital Personal Data Protection Act 2023, the GDPR, the CCPA and similar laws you may
ask to access, correct or delete your personal data, withdraw consent, and nominate someone to act for you.
Use Settings → Privacy & data → Delete my data in the app, or write to
viruxaai@gmail.com. We respond within 30 days, and acknowledge
grievances within 48 hours.
Where data is processed
Our servers are run by Render and Neon and may be located outside your country, including in the United
States. Purchases are processed by Google Play and verified by RevenueCat.
Payments
Prices, renewal and cancellation terms are shown next to the purchase button and in the
Terms of Use. Payments in India are processed under the RBI framework by Google
Play and its authorised payment partners.
Age
Vift AI is for adults (18+). We do not knowingly process children's data.