Privacy Policy

Last updated: 15 May 2026  ·  Effective: 15 May 2026  ·  Questions: [email protected]

1. Data Controller Identity

This Privacy Policy describes how the Droidwatch platform ("Droidwatch," "we," "us," "our") processes personal data when you use the Service. For the purposes of the EU General Data Protection Regulation (GDPR) and UK GDPR:

Where Enterprise customers use the Service to process personal data belonging to their own users or customers, Droidwatch acts as a Data Processor on their behalf. A GDPR Art. 28-compliant Data Processing Agreement is available at /dpa.

2. Scope of This Policy

This policy applies to all personal data processed by Droidwatch in connection with:

• The Droidwatch web application and API.
• Account registration and management.
• File submission and analysis.
• Communications between you and Droidwatch.

It does not apply to third-party services linked from our platform. We encourage you to review the privacy policies of any third-party services you use.

3. Data We Collect

3.1 Submitted Files

When you upload an APK (or XAPK, AAB) for analysis:

• The file is stored in an isolated, access-controlled environment for the duration needed to complete analysis and for the retention period associated with your plan.
• We extract and store analysis results: security report, findings, behavioral metadata, and cryptographic hashes (MD5, SHA-1, SHA-256).
• The raw binary is permanently deleted according to the retention schedule in Section 9.

APK files may incidentally contain personal data (e.g., user data embedded in the app, developer credentials). We do not intentionally extract or store such data beyond what is necessary for security analysis. If you believe you have submitted a file containing sensitive personal data, contact us at [email protected] for early deletion.

3.2 Account Data (Registered Users)

• Email address — required for account creation, authentication, and transactional notifications.
• Username — chosen by you, displayed within the Service.
• Password — stored as a bcrypt hash with appropriate work factor. We never store or transmit your plaintext password.
• Two-factor authentication data — TOTP seed (encrypted at rest) and backup codes (hashed).
• Plan and subscription status — tier, quota usage, renewal dates. Payment card details are processed exclusively by our payment provider and are never stored on Droidwatch servers.

3.3 Usage and Technical Data

• IP address and user agent — used for rate limiting, abuse prevention, and security.
• Timestamps of analysis runs, API calls, and login events.
• Error and audit logs — no personal file content is included in error logs.
• Session identifiers for authentication.

3.4 Anonymous Sessions

Users without an account are identified by a temporary session token stored in the browser's localStorage. No persistent user profile is created. Anonymous session data (analysis runs) is deleted per the Anonymous plan retention period.

4. Lawful Basis for Processing (GDPR Art. 6)

For users in the EU/EEA or UK, we rely on the following lawful bases:

Processing Activity	Lawful Basis	GDPR Article
Creating and managing your account	Performance of a contract	Art. 6(1)(b)
Delivering analysis results and reports	Performance of a contract	Art. 6(1)(b)
Sending transactional emails	Performance of a contract	Art. 6(1)(b)
Security, abuse prevention, rate limiting	Legitimate interest	Art. 6(1)(f)
Improving detection rules (anonymized data)	Legitimate interest	Art. 6(1)(f)
Marketing and product communications	Consent (opt-in only)	Art. 6(1)(a)
Compliance with legal obligations	Legal obligation	Art. 6(1)(c)
Audit log retention for SOC 2 compliance	Legitimate interest / Legal obligation	Art. 6(1)(c)/(f)

Where processing is based on legitimate interest, you may object at any time (see Section 11). Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

5. How We Use Your Data

• Providing, maintaining, and improving the Service.
• Authenticating you and securing your account (including fraud detection and 2FA).
• Generating and displaying security analysis reports.
• Enforcing plan quotas and retention policies.
• Sending transactional notifications (analysis completion, security alerts, account changes).
• Complying with legal obligations, including responding to lawful requests from authorities.
• Investigating abuse and enforcing the Terms of Service.

6. Threat Intelligence Sharing

To improve collective security defenses, Droidwatch may:

• Query third-party threat intelligence services using the cryptographic hash (SHA-256) of submitted files — the file itself is never sent.
• Cross-reference extracted network indicators (IP addresses, domains, URLs) against threat databases (VirusTotal, AbuseIPDB, AlienVault OTX, URLhaus).
• Contribute anonymized indicators of compromise — file hashes, package names, network IOCs — to threat intelligence databases to benefit the broader security community.
• Use YARA matches and behavioral patterns from anonymized submissions to improve Droidwatch detection rules.

We do not share the raw APK binary, your account identity, your email address, or the full analysis report with any third party without your explicit written consent, except as required by applicable law.

7. Sub-processors and Third Parties

We use the following categories of sub-processors to deliver the Service. We maintain Data Processing Agreements with each where required by GDPR:

Sub-processor	Purpose	Data Shared	Location
Cloud infrastructure provider	Hosting, storage, database	All service data, encrypted at rest	EU / configurable per Enterprise plan
VirusTotal (Google)	Threat intelligence hash lookup	File hashes (SHA-256) only	USA (SCCs apply)
AbuseIPDB	IP reputation	IP addresses from submitted files	USA (SCCs apply)
AlienVault OTX (AT&T)	IOC enrichment	IPs and domains from submitted files	USA (SCCs apply)
URLhaus (abuse.ch)	URL reputation	URLs and domains from submitted files	Switzerland (adequacy decision)
Payment provider	Payment processing	Billing details (not stored by Droidwatch)	As per provider's policy
Transactional email provider	Email delivery	Email address, notification content	EU / SCCs apply

We do not use advertising networks, third-party analytics, or social media tracking pixels.

8. International Transfers

Droidwatch is designed to minimize international data transfers. Where transfers outside the EU/EEA are necessary (e.g., threat intelligence lookups against US-based services), we rely on the following safeguards:

• Standard Contractual Clauses (SCCs) — EU Commission-approved SCCs are in place with all US-based sub-processors.
• Adequacy decisions — transfers to countries with an EU adequacy decision (e.g., Switzerland, UK) rely on those decisions.
• Minimization — only the minimum necessary data (e.g., hashes and indicators, not raw files or account data) is transferred to threat intelligence providers.

Enterprise customers may request that all data remain within a specified geographic region. Contact [email protected] to discuss data residency options.

9. Data Retention

Plan	Analysis Reports	Raw APK File	Account Data
Anonymous	3 days	Deleted after analysis	N/A (no account)
Free (registered)	7 days	Deleted after analysis	Until account deletion
Pro	90 days	30 days	Until account deletion
Enterprise	365 days	Per agreement	Per agreement

Audit logs are retained for a minimum of 12 months for SOC 2 compliance and security purposes, even after account deletion, unless a longer period is required by law.

You may request early deletion of any of your analysis runs from within the app or by contacting us. Account deletion requests are processed within 30 days. We may retain anonymized, non-identifiable data derived from your submissions after deletion.

10. Data Security

• All data is transmitted over TLS 1.2 or higher (HTTPS).
• APK files are analyzed in isolated sandbox environments with no network access to production systems.
• Sensitive fields (TOTP seeds, API keys) are encrypted at rest using AES-256-GCM.
• Passwords are hashed with bcrypt and never stored in plaintext.
• API tokens use signed JWTs with configurable expiration.
• Access to production infrastructure is restricted to authorized personnel using multi-factor authentication.
• The audit log is append-only and protected against modification by database-level triggers.
• Worker processes run with dropped Linux capabilities and a restrictive seccomp profile.

Despite these measures, no system is completely secure. In the event of a personal data breach that is likely to result in high risk to your rights and freedoms, we will notify you and the relevant supervisory authority without undue delay and within 72 hours of becoming aware, as required by GDPR Art. 33–34.

11. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Access (GDPR Art. 15) — request a copy of the personal data we hold about you.
• Rectification (Art. 16) — request correction of inaccurate or incomplete data.
• Erasure (Art. 17) — request deletion of your account and associated personal data, subject to legal retention obligations.
• Restriction (Art. 18) — request that we limit processing of your data in certain circumstances.
• Portability (Art. 20) — receive your analysis reports in machine-readable JSON format via the dashboard or API.
• Object (Art. 21) — object to processing based on legitimate interest, including at any time where processing is for direct marketing purposes (absolute right).
• Withdraw consent — where processing is consent-based, withdraw at any time via account settings or by contacting us.
• Not be subject to automated decisions (Art. 22) — our risk scoring is advisory only and does not produce legal or similarly significant effects without human review.

To exercise any of these rights, contact [email protected]. We will respond within 30 calendar days. We may ask you to verify your identity before processing the request. No fee is charged for reasonable requests.

If you are dissatisfied with our response, you have the right to lodge a complaint with your national data protection supervisory authority.

12. Cookies and Local Storage

Droidwatch does not use advertising cookies, cross-site tracking cookies, or third-party analytics scripts. We use browser localStorage only to store:

• Your authentication token (JWT) — removed on logout.
• User interface preferences (theme, settings).
• Temporary session identifiers for anonymous users.

No third-party tracking pixels or social media scripts are loaded. Cloudflare Turnstile (CAPTCHA) may set a functional cookie to verify human users on login and registration; no persistent tracking is performed by this widget.

13. Children's Privacy

The Service is intended for security professionals and software developers aged 18 and over. We do not knowingly collect personal data from minors under 18. If you believe a minor has created an account, please contact us at [email protected] and we will promptly delete the account and associated data.

14. Enterprise and Data Processing Agreements

Enterprise customers who use the Service to process personal data on behalf of their own users or customers act as Data Controllers, and Droidwatch acts as their Data Processor. In this capacity, we commit to processing data only on documented instructions from the customer and in accordance with GDPR Art. 28.

Our standard Data Processing Agreement (DPA) is available at /dpa. It covers:

• Subject matter, duration, and nature of processing.
• Categories of data subjects and personal data.
• Processor obligations and sub-processor controls.
• Data breach notification (72-hour commitment).
• Deletion or return of data upon contract termination.
• Audit and inspection rights.

Customers requiring customized DPA terms should contact [email protected].

15. Changes to This Policy

We may update this Privacy Policy to reflect changes to our Service, sub-processors, or legal obligations. For material changes, we will provide at least 30 days' notice via email (for registered users) or a prominent notice in the Service. The "Last updated" date at the top of this page reflects the current version. Previous versions are available upon request.

16. Contact and Complaints

• All inquiries — privacy, data rights, legal, and security disclosures: [email protected]
• DPA and Enterprise agreements: /dpa

If you are located in the EU/EEA, you have the right to lodge a complaint with your national data protection authority. A list of supervisory authorities is available at edpb.europa.eu.