Privacy policy

Effective 2026-11-06

Muhafiz is a phone security and family safety app for Android. This policy explains what information the app and its server collect, why, who it is shared with, how long it is kept and how you can delete it.

Information we collect and why

• Account: name, email, optional phone number and language. Passwords and the parent PIN are stored only as one-way hashes.
• Your phones: model, Android and app version, battery level, a push-notification token, and a SHA-256 hash of the SIM serial (never the SIM or phone number) to detect a SIM swap.
• Location, including in the background: to find a lost or stolen phone, to track it in lost mode, and to share it with family members only after they join your family circle with its invite code. Anyone can stop sharing or leave at any time.
• Thief photo: only if you turn it on, one front-camera photo after repeated wrong PIN attempts, sent to your account with the phone's location.
• Children's phones (parental control): the rules a parent sets (app limits, schedules, website filter, camera rules), per-app screen time, and requests to unblock a website. A paired child phone always shows that it is managed by Muhafiz, and the app is never hidden.
• Security scans: the names and permissions of installed apps, to rate their risk. File scanning sends only file hashes, never the files.
• Privacy monitor: which apps hold the camera, microphone or location permission is read and shown on the phone only; it is not uploaded.
• Trusted contacts: names and phone numbers you add, so they can be texted when theft or an SOS is detected.
• Breach check: when you tap "Check now", your account's own email is looked up with Have I Been Pwned. The result is not stored.
• Purchases: your Google Play purchase token and plan, to give you the features you paid for. We never see card or wallet details.

What we do not do

• We do not sell or rent personal data, and the app shows no ads.
• The website filter and VPN keep no browsing, traffic or DNS logs.
• Muhafiz does not use Android's Accessibility API, read your messages, or record calls or the screen.
• Muhafiz is for parents monitoring their own children and for people protecting their own phones. It must not be used to track another adult.

Who we share it with

• Google (Firebase Cloud Messaging for notifications, Google Play for billing).
• Our SMS provider, only the alert text and the trusted contact's number.
• Have I Been Pwned, only your email, only when you run a breach check.
• Our hosting provider, which stores the data for us. We disclose data to authorities only when the law requires it.

How long we keep it

Location history is deleted after 30 days, thief photos after 60 days and screen-time reports after 90 days. Everything else is kept until you delete your account.

Security

All traffic uses HTTPS. Passwords and PINs are hashed, purchase tokens and remote-command details are encrypted, and photos are kept in private storage that only your account can open.

Your choices and deleting your data

• Every permission is optional and can be turned off in Android settings; the feature that needs it then stops.
• Delete your account and all of its data in the app (Settings → Delete account) or on this page. Deletion is immediate and cannot be undone.
• Deleting the account does not cancel a Google Play subscription; cancel it in the Play Store.

Children

Muhafiz is designed for parents and adults. Parents set up and control a child's phone, can see and change everything collected from it, and can remove the child and its data at any time.

Changes and contact

We will post any change on this page with a new effective date. Questions or requests: a contact email will be added here before release.