ShieldPal — Privacy Policy
Developer: Faraz Labs · Last updated: 3 October 2026
In short: ShieldPal has no account and no servers of its own. Your messages, notifications, app list and scan results are checked on your phone and are never uploaded. A few optional online checks send one small piece of data (for example a website name) only when you use them. No ads, no tracking, and we never sell or share your data.
1. What stays on your phone
- Live Guard reads the text of new notifications (WhatsApp, SMS, Telegram…) to look for scam links and messages. The check happens on the device. If something dangerous is found, a short snippet plus the app and chat name are saved in your Threat Log on the phone. Nothing is uploaded.
- Message Check, the scam-detecting AI model, Number Check, Safe QR (camera pictures never leave the phone), Password strength, Family Safe-Word, the pet, coins and settings all work on the device.
- 2FA Vault secrets, API keys you add and your app-lock PIN are stored encrypted (Android Keystore). The PIN is stored only as a hash.
- Deep Scan reads your installed apps, their permissions and your phone's security settings on the device. The result is never uploaded.
- Contacts (optional): if you allow it, ShieldPal looks up the name you saved for a number you are checking. This happens on the phone; contacts are never uploaded or stored by ShieldPal.
2. Account and identity
ShieldPal needs no sign-up. We do not know who you are, and we do not collect your name, e-mail, phone number, location or advertising ID.
3. What can leave your phone (optional)
Only when you use the feature. Everything is sent over HTTPS.
- Link Check · Cloudflare Security DNS: the domain name of the link (for example "example.com"), never the full address or any personal detail. You can switch this off in Settings → Online services & AI.
- Link Check · Google Safe Browsing (only if you add your own key): the link address.
- Link Check · urlscan.io cloud browser (only if you add your own key and switch it on): the link address. urlscan.io opens the page far away from your phone and keeps the scan unlisted.
- Password Check · Have I Been Pwned: only the first 5 characters of the password's SHA-1 fingerprint (k-anonymity). Never the password itself.
- Pal AI · Free online AI (pollinations.ai): the text of your chat with Pal AI, only after you agree to it. Do not type passwords or codes into the chat. Turn it off any time in Settings; Pal AI also works fully offline.
- Pal AI · Claude by Anthropic (only if you add your own key): your chat messages, sent with your own key. Anthropic's privacy policy applies.
- Shield VPN: this is a local VPN on your phone. It does not send your traffic to ShieldPal or to any VPN server. Only your device's DNS lookups (the domain names your apps ask for) go to the DNS provider you choose in the app (Cloudflare, Google, Quad9, AdGuard or OpenDNS) — the same kind of lookups your phone normally sends to your mobile network. It does not hide your IP address.
- Remote VPN (optional): runs a WireGuard config that YOU paste. All your traffic then goes to the VPN server named in that config, so that provider can see it. ShieldPal stores the config encrypted on your phone only and never sends it anywhere else.
- Check my IP (optional button): asks ipwho.is for your public IP and country.
- Spoken warnings use the Android text-to-speech engine on your phone.
These services have their own privacy policies. ShieldPal gets none of this data.
4. Permissions and why we ask
- Internet — the optional online checks above.
- Notifications — to show threat alerts.
- Notification access — Live Guard (reading notifications on the device to find scams). You turn it on yourself in Android settings and can turn it off any time.
- Installed apps list (QUERY_ALL_PACKAGES) — Deep Scan and new-app warnings. The list stays on the device.
- Request delete packages — the one-tap "Remove" button for dangerous apps (you still confirm).
- Screen-lock strength — to tell you if your lock is weak (never your PIN).
- Camera — Safe QR scanner. Pictures are not saved or uploaded.
- Biometrics — fingerprint / face unlock for the app lock.
- Contacts (optional) — to show the saved name of a number.
- VPN service — the local DNS filter (Shield VPN). You approve the Android VPN dialog yourself.
5. Security
Online requests use HTTPS. Secrets are encrypted with the Android Keystore. The PIN is hashed. The app lock can use your fingerprint or face. ShieldPal does not back up its data to the cloud (allowBackup is off).
6. Children and teens
ShieldPal is made for everyone, including teenagers and families. It does not create accounts and does not knowingly collect personal data from anyone, including children under 13.
7. Your choices and deleting your data
- Settings → Privacy → "Delete all my data" erases everything ShieldPal stores on your phone: settings, threat log, 2FA codes, keys, PIN and pet progress.
- Uninstalling the app also removes all of it.
- You can revoke any permission or turn off Live Guard and Shield VPN in Android settings at any time.
- We hold no data about you on any server, so there is nothing to request from us. For data held by a third-party service, contact that service.
8. Changes to this policy
If features change, we update this policy here and in the app, and change the date above.
9. Contact
Questions? Email usmanfaraz1818@gmail.com or reach out on LinkedIn.