LinkGuard Privacy Policy

Effective with LinkGuard 0.2.0

Short version: LinkGuard does not log, store or send the links you open. It has no accounts, no ads, no analytics and no trackers.

What LinkGuard does

When you tap a link, Android sends it to LinkGuard. LinkGuard checks the link on your phone, then opens it in the browser you chose, or shows a warning if the link looks like a scam. You can always open the link anyway.

What we do not collect

We do not keep a history of the links you open, on your phone or anywhere else.
We do not send the links you open to Dwarpal Labs. Our server only receives the short fingerprints described below, and links you choose to report.
No account, name, phone number, email address, contacts or location.
No advertising ID, no analytics, no crash-reporting service and no third-party trackers.
Android itself may record the addresses of links you open in its own system logs. LinkGuard cannot control that.

When LinkGuard uses the internet

Most checks run entirely on your phone. LinkGuard connects to the internet only in these cases:

Short links. For links such as bit.ly or t.co, LinkGuard asks the short-link service where the link leads, so it can check the real destination. That service would see the same request if you opened the link without LinkGuard.
Website age. To spot brand-new scam sites, LinkGuard may ask the official registry for a website's domain when it was registered. Only the domain name is sent, for example example.com, never the page address, and always over an encrypted connection. The answer is kept only until LinkGuard closes.
Known scam websites. For a website that isn't on LinkGuard's list of known-safe sites, LinkGuard asks Dwarpal Labs' server about it. It sends only the first 4 bytes of a scrambled fingerprint (SHA-256 hash) of the website's name, for example 3f9a1c2e. Many different websites share each fingerprint, so we cannot tell which website you opened, and the server keeps no record of these requests. The answer can be “known scam”, or “reported as a scam by N LinkGuard users this week”.
Safe-website list. About once a day, LinkGuard downloads Dwarpal Labs' list of known-safe websites, as fingerprints signed by Dwarpal Labs. The request contains no information about you or your links.

Settings

Your settings, such as which browser to open links in and which checks are turned on, are stored only on your phone. Uninstalling LinkGuard deletes them.

Reporting a link

If you tap Send report, LinkGuard sends the link, any note you wrote, the website's name and an anonymous code to Dwarpal Labs over an encrypted connection. The code is different for every website, so your reports can't be linked together or traced back to you; it only lets us count each phone once per website. When several different people report the same website within a week, other LinkGuard users see a soft warning automatically. Reports are never published and are deleted after 30 days.

Children

LinkGuard collects no personal data from anyone, including children.

Open source

LinkGuard's source code is public under the Apache-2.0 licence, so anyone can check that it does what this policy says: github.com/dwarpallabs/linkguard.

Changes

If this policy changes, we will update this page and its effective date. Any change that collects more data will be announced in the app's release notes before it ships.

Contact

Questions about privacy or LinkGuard: email support@dwarpallabs.com, or open an issue at github.com/dwarpallabs/linkguard/issues.