Privacy Policy & Legal Terms: LinkShield

Official policy URL: https://beforeopen.app/privacy/linkshield/
Last updated: 25 October 2026
Package name: com.linkshieldapp.shield

LinkShield ("the Application", "we", "us", or "our") is dedicated to protecting user privacy while providing link verification and security assessment tools. Our core operating principle is Privacy by Design, operating under a strict zero-permission model.

This document outlines how data is handled, processed, and protected when using LinkShield, as well as the terms governing the use of the Application.

1. Zero-Permission & Local Privacy Model

LinkShield is designed to minimize data exposure. The Application does not request or use invasive system permissions:

No Access to SMS or Messages: We do not read, access, or store your SMS inbox or messaging apps.
No Accessibility Services: We do not track screen activity, monitor inputs, or collect keystrokes.
No System Overlays: We do not draw over other applications without user interaction.
No Access to Personal Files or Contacts: We do not access contacts, location data, camera, photos, or device media.

2. URL Processing & Security Verification

To assess whether a link presents potential cyber threats, phishing risks, or malicious intent, LinkShield performs automated URL verification:

Local Automated Analysis: Basic URL formatting, structural checks, and risk detection are performed locally on your device.
Encrypted Security Lookups:
To verify web safety against updated threat registries, the Application communicates with industry-standard security services via encrypted protocols (e.g., DNS-over-HTTPS and, for Pro users, Google Web Risk). To perform a check, the web address of the link you chose to verify (with common tracking parameters removed) is sent to these services, and, like any internet request, your device's IP address is visible to them. No name, account, advertising ID, or other personal identifier is sent with the address. For DNS-over-HTTPS the Application contacts the DNS service directly, and we do not receive the results of these lookups on any server of ours. Google Web Risk checks (Pro) are the exception, described below.

Our server and Google Web Risk (Pro). To check an address with Google Web Risk, the Application sends it to a server we operate (hosted by Cloudflare), which passes it to Google and returns the answer. The server receives the address (without the part after # and without any user name or password in it), the pass described below and the IP address of the connection. We do not store the address or your IP address, and we keep no request logs; we keep only anonymous counts of error types. To limit Pro Web Risk checks to 30 per subscription in 24 hours, the server counts them under a keyed, one-way hash of the anonymous code in your pass. That hash is held only in the server's memory (never written to storage or logs) for up to 24 hours and then discarded. When the Application asks for a pass, a keyed, one-way hash of the connection's IP address is held the same way for at most 60 seconds, to block floods of requests. Above the limit, Web Risk is unavailable until those 24 hours end, and links are still checked with the lists on your device and encrypted DNS. The server keeps no database and no cache of results. Like any internet service, our hosting provider sees the IP address of the connection while it passes through.

To let only Pro users use this server, the Application asks Google Play (Play Integrity) to confirm that it is the genuine app on a genuine device, and our server asks our subscription provider (RevenueCat) whether your Pro purchase is active, using the anonymous purchase identifier the Application already has. The Application sends our server that anonymous identifier, the Application's package name and the Play Integrity confirmation, never together with a web address. If both checks pass, the server gives the Application a short-lived pass (about 24 hours) that is kept on your device. The pass contains an anonymous code derived from the identifier, not the identifier itself. We do not store the identifier.

When Web Risk starts. After you become Pro, or after the pass has expired, Web Risk checks may start a few seconds to a few minutes later, and longer if the connection fails (the Application retries a few times a day). In the meantime every link is still checked with the lists on your device and encrypted DNS. Devices that Google Play does not confirm (for example rooted devices or unofficial builds) do not receive a pass and use those checks only. If you turn off Google Threat Intelligence in Settings, the pass is deleted and no request is made to our server. Users who are not Pro send nothing to our server.

If you choose to turn on the optional, off-by-default advanced decoding setting and agree to its notice, the names of the websites that the page being checked connects to are also sent to the secure DNS service (Quad9) together with your device's IP address, and the device's built-in browser component may send short hash prefixes of the addresses it loads to Google (Google Safe Browsing). The same no-identifier terms apply, and these lookups do not pass through any server of ours.
Other lookups and contacts: Domain age (all users): the registered domain name (for example example.com, never the full address) is sent to the registry that runs its top-level domain, over an encrypted connection; for .ru, .it, .jp, .cn, .edu and .il the request is not encrypted. DNS provider: the host name of each address in the chain goes to Quad9 or, if you select it in Settings, to Cloudflare. VirusTotal (Pro, only if you enter your own key): the address is sent to VirusTotal without the part after # and without tracking parameters; an address that looks like it contains a password, key, token or sign-in code is not sent. The link itself: the the Application visits the link and each page it redirects to directly from your device, so the site can see your device's IP address and the time of the visit and can set cookies, which are kept only in memory until the check ends. To avoid repeating lookups, the Application keeps a list of recently checked domain names with their registration dates on your device for up to 7 days (no full addresses), only while history is on and incognito mode is off. An address you check can itself contain personal details (for example an e-mail address inside a link); they are not removed and are part of what the services above receive.
Built-in Threat List (On-Device): The Application includes lists of known phishing and malware-distribution websites (compiled from public sources and bundled with the Application). Links are matched against these lists entirely on your device; no link is sent anywhere for this check.
No Centralized Browsing Logs: Apart from the Pro Web Risk relay described above, we do not operate proxy servers to route your traffic, nor do we build profiles or retain central logs of your browsing history or visited URLs.

3. Data Storage & User Control

On-Device Storage: Any scan records, safety scores, or preferences created during use are stored strictly on your local physical device within the Application's isolated storage.
Sensitive Settings: The parental-lock PIN (kept only as a salted, one-way hash) and the optional VirusTotal API key that you enter are stored in encrypted storage protected by Android on your device. If your device cannot provide such protected storage, the Application does not save these items in readable form: it tells you that they were not saved, and the parental lock or the key is simply not set. Nothing is sent to us in either case. The Web Risk pass described above is also kept in encrypted storage on your device.
User Control: You may clear your local scan history at any time through the Application settings.
Secure Export: If you choose to export your local data, all actions are executed using standard Android system sharing mechanisms without granting external storage permissions to the Application.

4. Third-Party Services & Payment Processing

No Third-Party Advertising or Tracking: LinkShield does not integrate third-party advertising networks, marketing trackers, or telemetry analytics SDKs.
Open-Source Data: The built-in threat lists are compiled from open-source and publicly available data. The notices are available in the Application under Settings > Open-source licenses.
In-App Purchases: All financial transactions, subscriptions, and billing are processed exclusively and securely by Google Play. We do not receive, process, or store credit card or financial account information. Subscription status is managed with RevenueCat, which receives an anonymous purchase identifier from the Application and tells our server, when asked, whether your Pro purchase is active.

5. Disclaimer of Warranties & Limitation of Liability

PLEASE READ THIS SECTION CAREFULLY.

"AS IS" and "AS AVAILABLE" Basis: LinkShield is provided on an "AS IS" and "AS AVAILABLE" basis without warranties of any kind, whether express, implied, statutory, or otherwise, including but not limited to implied warranties of merchantability, fitness for a particular purpose, accuracy, or non-infringement.
No Guarantee of 100% Security Detection: Cybersecurity threats constantly evolve. While LinkShield employs automated risk assessment methods, we do not guarantee or warrant that the Application will identify all malicious URLs, phishing attempts, malware, or software vulnerabilities, or that false positives/negatives will not occur.
Limitation of Liability: To the maximum extent permitted by applicable law, in no event shall the developers, owners, or affiliates of LinkShield be liable for any direct, indirect, incidental, special, consequential, or punitive damages (including, without limitation, loss of data, security breaches, financial losses, device damage, or interruption of service) arising out of or in connection with your use of, or inability to use, the Application or reliance on any security score or assessment provided by the Application.
User Responsibility: You acknowledge and agree that your decision to open, click, or interact with any URL or web content is at your own sole risk and discretion.

6. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements or Application functionality. The updated version will be indicated by the "Last Updated" date at the top of this document.

7. Contact Us

If you have any questions, concerns, or legal inquiries regarding this Privacy Policy or Application practices, please contact us at:
Email: privacy@beforeopen.si