The practical details
Privacy, made clear.
Vipera ("we", "us", "the app") is an Android security tool that checks APKs in shared storage, reviews user-installed apps, and looks up known threat hashes. It does not inspect every file type or guarantee detection of every threat. This policy describes what information Vipera accesses, stores, and sends to the network — and the controls available to you.
1. Account & sign-up
Vipera does not ask you to create an account, provide an email address, or choose a username. To securely call Vipera's cloud features, the app may create an anonymous Supabase authentication session tied to that installation. This session is not intended to identify you by name or email, but it is used to associate lookup limits, scan requests, Premium entitlements, and promo redemptions with the installation's anonymous account. Session tokens are stored in the app's private storage and can be removed by clearing app storage or uninstalling Vipera.
In-app purchases are processed by Google Play Billing; Vipera does not see or store your payment card, billing address, or Google account details. Google Play may provide purchase verification data needed to activate Premium.
2. Permissions Vipera requests
| Permission | OS version | Reason |
|---|---|---|
INTERNET | all | Reach Vipera backend (supabase.co) which queries MalwareBazaar, YARAify/ThreatFox (abuse.ch), AlienVault OTX* and MetaDefender* (*premium) and NVIDIA* verification. Declared in AndroidManifest.xml:5. |
MANAGE_EXTERNAL_STORAGE | API 30+ | Locate and hash .apk and EICAR test files in shared storage (/sdcard) to look up known threat hashes. Core AV use. Declared AndroidManifest.xml:6. |
READ_EXTERNAL_STORAGE | API ≤29 | Same as above for Android 10 and below. maxSdkVersion 29. Declared AndroidManifest.xml:7. |
QUERY_ALL_PACKAGES | API 30+ | Enumerate installed apps for App Manager and Deep tier / App Shield. Not analytics. Declared AndroidManifest.xml:14 with tools:ignore. |
POST_NOTIFICATIONS | API 33+ | Show scan-completion and App Shield / Real-time Guard install alerts. Declared AndroidManifest.xml:17. |
FOREGROUND_SERVICE + FOREGROUND_SERVICE_DATA_SYNC | API 28+/34+ | Run long scans and Real-time Guard (Download FileObserver + package install) as visible foreground dataSync. Declared AndroidManifest.xml:18-19. |
com.android.vending.BILLING | all | Google Play Billing for Premium. Declared AndroidManifest.xml:20. |
com.google.android.gms.permission.AD_ID | all | AdMob rewarded interstitial for one-time Premium Deep scans. Declared AndroidManifest.xml:21. |
ACCESS_WIFI_STATE + NEARBY_WIFI_DEVICES (+ location on older Android) | API 29+/33+ | Wi-Fi Security tool lists nearby networks and their security type on-device; no location is stored or transmitted. NEARBY_WIFI_DEVICES uses neverForLocation on Android 13+. |
CALL_SCREENING role | API 29+ | Call Guard screens incoming calls only after you explicitly grant the caller-ID & spam role; block/trust lists stay on-device. Bound via BIND_SCREENING_SERVICE. |
Permissions are explained before they are requested. You can deny or revoke permissions through Android Settings; Vipera will continue in a reduced-capacity mode where possible.
3. What Vipera stores on your device
Vipera stores scan summaries, onboarding state, protection toggles, and a Premium state cache in app-private storage. This data is scoped to your install and is erased when you uninstall the app or clear its storage.
We do not store your name, email, phone number, contacts list, location history, photo library contents, or an identifier cross-linkable to you across apps.
4. What Vipera sends over the network
Hash-only threat lookups go through the Supabase threat-lookup edge function (quota-limited): Vipera sends only the file's SHA-256 hash, which the backend checks against MalwareBazaar, YARAify and ThreatFox (abuse.ch), AlienVault OTX, and MetaDefender Cloud. File contents are never uploaded as part of a hash lookup.
URL lookups go through the Supabase url-lookup edge function, which checks URLhaus and, when configured, Google Safe Browsing (free tier). Breach checks go through the Supabase breach-check edge function, which queries Have I Been Pwned (when configured) or XposedOrNot (free) server-side using only the normalized email address.
When you use the fake-app review tool, Vipera sends a limited list of installed-app labels, package names, permissions, and accessibility-use indicators to the backend for optional classification. The app does not send APK or personal-file contents for these features.
Vipera does not include analytics or crash-reporting SDKs. The free version shows ads through Google AdMob; Google may use your device's advertising ID for ads according to the consent choices you make in Google's consent form (shown where required) and Google's own policies. You can reset or delete the advertising ID in Android Settings. Cloud requests require the anonymous session described above.
Device check (Google Play Integrity)
To stop free scan quotas and promo codes from being abused with throwaway accounts, Vipera asks Google Play Integrity to confirm that requests come from the genuine Vipera app installed from Google Play on a device that passes Google's integrity checks. Along with Google's signed result, the app sends a device key: a one-way SHA-256 hash of Android's app-specific device identifier (ANDROID_ID) combined with Vipera's package name. The original identifier is never sent, and the key is different for every app, so it cannot be used to track you across apps.
Vipera's backend never stores the device key as received: it keeps only a keyed hash of it (HMAC with a server-side secret), together with the integrity result (pass or the failure reason), the check time, and when it expires. This is used only for fraud prevention and to apply free-use limits and promo-code limits per device. It is not used for advertising or analytics and is not shared with third parties.
5. Security activity logs
Vipera records privacy-preserving security activity summaries associated with the app's anonymous installation session so the owner can monitor service health across devices. Scan logs contain aggregate counts, scan type, result status, app version, device model, and timestamp; they do not contain file contents, file paths, file names, or file hashes. Fake-app, URL, and threat-lookup activity is retained as limited security metadata. These records are restricted by database access controls to the authorized owner account and are automatically deleted after 90 days.
6. International transfers
Third-party providers may operate servers in the United States, European Union, or other jurisdictions. Review their own policies for details about their processing and data residency.
7. Data retention
On-device data remains until you uninstall Vipera, clear app storage, or wipe the device. Vipera's backend stores account-associated threat lookups, URL lookups, fake-app scan summaries, Premium entitlement records, and promo redemption records to provide those features and enforce limits. Scheduled retention cleanup removes threat and URL lookup records older than 90 days; entitlement and redemption records may be retained while needed for billing, fraud prevention, support, and accounting. The hashed device key is kept with the device-check record until you delete your data or the anonymous account is removed; daily per-device usage counters hold only the hashed key and a count and are deleted after 7 days; a promo redemption may keep the hashed key so the same device cannot redeem a code twice. Third-party providers may retain request metadata according to their own terms. Vipera does not sell personal information.
8. Your controls
- Revoke permissions in Android Settings.
- Clear Vipera storage to erase local history, settings, and the anonymous session on that device.
- Disable auto-scan, File Guard, or App Shield in the app.
- Withdraw consent for cloud threat lookups, or delete your data, at any time in Vipera's Settings. Deleting your data removes the anonymous account together with its lookups, scan summaries, device-check record and usage counters from Vipera's backend.
- Contact us with privacy questions or requests. We can explain the available process for reviewing or deleting backend records associated with your anonymous session; we may need limited information to locate the correct records.
How to delete your Vipera data
- Open Vipera: Mobile Security and go to Settings.
- Tap Delete my data and confirm.
This permanently deletes the anonymous account from Vipera's backend together with its threat and URL lookups, scan summaries, fake-app review results, breach-check history, device-check record (hashed device key), usage counters, and promo redemptions, and clears the session on your device. Google Play purchase records are kept by Google, and an active subscription must be cancelled in Google Play; after deletion, Premium can be restored with Restore purchases. Per-device daily usage counters that hold only a hashed device key and a count are removed automatically within 7 days. If you can no longer open the app, email softwareblankcanvas@gmail.com and we will explain how we can locate and delete the records.
9. Changes to this policy
We will update this page when material data practices change and revise the date above.
10. Contact us
For privacy questions or data-flow explanations, email softwareblankcanvas@gmail.com.