RAKSHABYTE / privacy policy
Updated 11 October 2026. This policy describes confirmed data flows. Production AI-provider details, retention periods and the account-deletion workflow are still being finalized.
RakshaByte is operated by ValueNum Technologies Pvt. Ltd. For privacy questions or to initiate an account and associated-data deletion request, email support@rakshabyte.com. This policy covers the RakshaByte Android app and website.
RakshaByte requires account creation or sign-in through Microsoft Azure AD B2C. Microsoft processes authentication and account information. Account identifiers and authentication tokens are used to authorize access to the RakshaByte backend.
Caller telephone numbers are transmitted over HTTPS to the RakshaByte backend for reputation checking and may be forwarded to AbstractAPI. DynamoDB reputation records use an HMAC-hashed telephone number as the record key rather than the raw number. This is pseudonymous information, not guaranteed anonymity. The reviewed call-screening flow does not record or transmit call audio or conversations.
With AI Message Validation disabled, RakshaByte analyzes supported WhatsApp, WhatsApp Business and SMS/RCS notification text locally on your device. This feature does not transmit notification text or URLs to the backend while disabled. It analyzes text exposed in supported notifications, not chat history or content hidden from notifications.
AI Message Validation is optional and OFF by default. When enabled, up to 2,000 characters of notification text, extracted URL domains, local risk scores and security signals may be sent to the RakshaByte backend and forwarded to its configured AI provider. URLs may also remain within the notification text. The app and backend attempt to mask obvious telephone numbers, OTPs, PINs and passwords, but this does not remove all personal information or secrets. You can disable the AI message analysis control in the Android dashboard at any time; this stops subsequent uploads through the feature and does not retract data already transmitted. Notification access can also be revoked in Android settings.
The backend supports a configured AI provider. The currently deployed provider and its retention and training configuration have not yet been verified. The reviewed adapter requests store: false; that setting alone does not establish zero retention or provider training practices. Provider-specific disclosures will be updated after the production configuration is verified.
The full selected URL is sent to the RakshaByte AWS backend for security analysis when an authenticated cloud check is available. A URL may contain personal information or tokens in its path or query. The reviewed backend normalizes the URL list to domains before further analysis, but the full selected URL has already left the device.
The APK file itself is inspected locally and is not uploaded in this analysis flow. Its SHA-256 hash, package name, requested permissions, local risk score and detected risk signals may be sent to the backend for additional assessment.
App Monitor processes Android-visible third-party app and security information locally for risk assessment, including installation source, relevant requested and granted permissions, readable security-access state, install/update times and signing fingerprints. The reviewed implementation does not upload the installed-app inventory or inspect other apps’ private data. Android package visibility limits coverage.
AWS provides backend/API processing and DynamoDB reputation and report storage. Phone reports can contain a keyed telephone-number hash, authenticated reporter IDs, counts and timestamps. Confirmed blocklist records have no automatic expiry in the reviewed implementation and remain until administrative removal. Reporter associations and shared reputation records must be addressed in the account-deletion process.
Google Play provides app distribution, updates, subscriptions and purchase-status handling. Applicable purchase and subscription information is used to determine access entitlement. The reviewed implementation does not identify Firebase or VirusTotal integrations. Exact purchase-record storage and retention remain to be confirmed.
The website is hosted on Microsoft Azure App Service. When enabled, support forms send your email, topic, message and consent confirmation to the configured backend; deletion forms send your account email and request confirmation. Cloudflare Turnstile processes browser/challenge information to prevent automated abuse. The website adapter does not itself log or persist request bodies. Hosting, identity and backend services may process network and security metadata. Online request forms currently remain disabled until their backend and CAPTCHA settings are configured. Email support@rakshabyte.com instead. Public website number/link checks, scam reports and web sign-in are not available yet.
Feature data is processed by the relevant providers: Microsoft Azure AD B2C for authentication, Azure App Service for website hosting, AWS for backend and DynamoDB processing, AbstractAPI for applicable telephone-number lookups, the configured AI provider for optional analysis, Google Play for distribution and purchases, and Cloudflare Turnstile for enabled web forms. Reviewed integrations use HTTPS and authenticated API access. Provider credentials are held on the backend. These measures reduce risk but cannot guarantee absolute security. Production storage, logging, provider locations and retention settings remain subject to verification.
Local threat history stores up to 100 entries with up to 300 characters of recorded input and assessment details; the oldest entry is removed when the limit is exceeded. Entries can be deleted from RakshaByte history, which does not delete original messages, remote data or your account. The 24-hour window used to combine recent risk signals is not a deletion period. You can disable optional AI analysis, pause Call Shield or Web Shield, and revoke Android permissions or special access. Turning a feature off does not erase previously transmitted information.
The reviewed phone-reputation backend defaults to a 24-hour normal cache expiry and a 15-minute provider-fallback expiry, both configurable. DynamoDB TTL cleanup is eventual and depends on deployment settings. These defaults are not a confirmed production retention schedule. Exact retention periods for account information, security/reputation reports and reporter identifiers, application/API/identity/hosting logs, support records and backups still need to be defined and verified. Confirmed blocklist records have no reviewed automatic expiry. This policy does not promise a retention duration or automatic erasure that has not been established.
To initiate a request, email support@rakshabyte.com. The external resource is https://rakshabyte-web.azurewebsites.net/delete-account and can be accessed without signing into the website. Its automated form is currently disabled. Ownership verification may be required before destructive action. The in-app account-deletion path, processing timeframe, identity-provider and backend erasure behavior, backup deletion schedule and legitimate retention exceptions are still being implemented or verified. No completed account-deletion workflow or deletion deadline is promised at present. Signing out, uninstalling the app or disabling an account does not by itself delete the cloud account. Account deletion must cover associated user data, not just deactivate access. Manage subscription cancellation separately through Google Play; do not assume an account request cancels billing.
Information transmitted off your device is collected by the receiving services even when processed briefly. This policy will be updated as the production provider, retention and deletion practices are verified. The Google Play Data Safety declaration must match the deployed app and these actual cloud flows. This version is not a confirmation that all Google Play submission requirements have been completed.