Privacy Policy

Last updated: 7 October 2026

Vift AI is operated by BrainyBolt, House No. 5, Paivazhi Junction, Kulanada, Pathanamthitta, Kerala 689503, India (viruxaai@gmail.com).

Most analysis happens on your device. This policy says exactly what leaves it, and exactly what does not. Where the two differ we describe the difference rather than round it off.

What stays on your phone, always

• Every file we scan. Files are checked entirely on your device. Their contents are never uploaded, and neither are their names.
• Every message you check. When you share or paste a message (an SMS, WhatsApp, email or anything else) into Message Shield, it is checked on your device. The text is never sent to us. Vift AI does not read your inbox or your incoming texts, and it cannot modify or delete a message.
• Privacy Watch. Which apps can reach your camera, microphone, location, SMS and files — and which apps can read your screen or your notifications — is read from your phone's own records and stays there.
• Payment Scam Guard. Detecting that another app can see or control your screen during a call or a payment happens on your device. No call is recorded and no call details are uploaded.

What is sent to us

• Threat indicators, and nothing else. When a file is scanned, its SHA-256 hash — a one-way fingerprint — is checked against known-malware databases. The filename is not sent, and neither are the contents; the file cannot be reconstructed from a hash. Package names of flagged apps may be checked the same way.
• The host name of a link in a message you check (for example example.com), on plans that include online link checking. Never the message, never the sender, and never the rest of the link.

There is no path in Vift AI that sends your message text, your files or your photos to us.

What we collect

• A device identifier — a per-device id used to remember which device holds a subscription. No account, email or phone number is required to use Vift AI.
• Account data, if you create one — an email address or mobile number, and a securely hashed password. An account exists only so a subscription you already bought can be restored onto a new phone.
• Subscription status — whether a plan is active, and when it expires. Payments are handled entirely by Google Play; we never see your card.
• Findings you have not yet acted on — stored on your device so the app can show them to you. This does not leave your phone.
• Crash and performance data, if you opt in.

What we never collect

• The contents of your files or photos.
• Your contacts.
• Your call history, or any recording of any call.
• Your browsing history. Vift AI does not filter or monitor web traffic at all.
• The text of messages you did not personally submit for checking.

SMS permission

Vift AI does not request any SMS permission. It cannot read, receive, send or delete your text messages. Message Shield checks only a message you choose to share or paste into it.

Third parties

• Google Play handles all payments and subscriptions. We receive only whether a subscription is active and when it ends.
• RevenueCat verifies purchase receipts on our behalf.
• Threat-intelligence services may be queried with a hash or a package name to check whether something is already known to be malicious. We send only the indicator being checked.

Where your data is stored

Findings, scan history and your shield settings are stored on your device. Vift AI is excluded from Android's automatic cloud backup, so none of it is copied to your Google Drive. Subscription records are held on our servers.

Deleting your data

Settings → Delete my data removes your subscription record from our servers permanently. Uninstalling the app removes everything held on your device. If you created an account, deleting it also removes its associated records. You may request access to or deletion of your data under GDPR, CCPA and India's DPDP Act where those apply.

How long we keep data

Threat events are deleted automatically after 90 days, and sender reports after at most 180 days. Account and subscription records are kept until you delete them. Everything on your phone is removed when you uninstall.

Where data is processed

Our servers are run by Render and Neon and may be located outside your country, including in the United States.

Your rights

You may ask to access, correct or delete your data, withdraw consent, or nominate someone to act for you (India's DPDP Act 2023, the GDPR and the CCPA, where they apply). We respond within 30 days. Grievances are acknowledged within 48 hours: write to viruxaai@gmail.com with the subject "Grievance".

Children

Vift AI is for adults (18 or older). We do not knowingly collect data from anyone under 18; if you believe a child has created an account, tell us and we will delete it.

Analytics and advertising

The app contains no advertising and no analytics or session-recording SDK. Nothing is sold.

Changes

If this policy changes in a way that affects what leaves your device, we will say so in the app rather than only updating this page.

Contact

Privacy questions and support: viruxaai@gmail.com