Privacy Policy

Swadhin Bangla AI Security

A product of Fred Intelligence Limited, Dhaka, Bangladesh

Effective Date: 20 August 2026 · Last Updated: 9 November 2026 (Revision 9 — in the Android app: account deletion inside the App (Section 14), reporting scam callers and optional automatic scam-call blocking (Section 5.10); Section 4: incoming calls are checked on your phone only; Section 5.2: feature name updated; Sections 5.6 and 11: Tracker & Privacy Protection look-ups are standard DNS queries; Sections 9 and 20: Google Play Integrity and free trials; new Section 22: India; Sections 3, 5, 13, 18 and 21 updated to match. Revision 8, 8 November 2026 — an account is now required to use the App (Sections 4.1, 4.2, 5.9 and 20); new Section 5.10: reporting scam callers, automatic blocking and the public call-block list; call blocking and caller identification on iPhone (Section 5.9); Sections 3, 4, 8, 9, 12, 13, 14.3 and 21 updated to match. Revision 7.1, 3 November 2026 — Sections 3, 5.9, 12 and 21: block counts for Swadhin Bangla DNS on iPhone and iPad. Revision 7, 2 November 2026 — new Section 5.9: the iPhone and iPad app; Section 14: account deletion inside the App; Section 9: who receives information, named; Section 12: retention periods; new Sections 20 (EEA, UK and Switzerland) and 21 (California and other US states); Sections 1 to 4, 6 to 8, 10, 11, 13, 15, 17 and 18 updated to match)

1. Introduction

Fred Intelligence Limited (“Fred Intelligence,” “we,” “us,” or “our”), a company based in Dhaka, Bangladesh, develops and operates Swadhin Bangla AI Security (the “App”) for Android phones and for iPhone and iPad, together with the website at fredbd.com (the “Website,” and together with the App, the “Services”). This Privacy Policy explains what information we collect, how we collect it, how we use and share it, how long we keep it, and the choices and rights available to you. It applies to your use of the App, your visits to the Website, and any account you create with us.

2. Who Is Responsible for Your Information

Fred Intelligence Limited, Plot Kha-56, Amena Tower, Level 5, Shahjadpur, Gulshan, Dhaka-1212, Bangladesh, is the data controller responsible for the personal information described in this Policy. For any privacy question or request, contact us at support@fredbd.com (full contact details in Section 19).

3. Scope

This Policy covers information collected through the App on Android devices and on iPhone and iPad (iOS and iPadOS), the Website, and account registration and management. Sections 5.1 to 5.8 describe the Android app; Section 5.9 describes the iPhone and iPad app; Section 5.10 describes reporting scam callers and blocking scam calls. This Policy does not cover the practices of third parties we do not control, including other apps, websites, or services you may reach through links in the App or on the Website.

4. Information We Collect or Access

Depending on which features you use, we may collect or access:

• Account information: your name and email address (provided through Sign in with Google — see Section 4.1) and the mobile phone number you enter at registration, used to create and manage your account and license, to keep the free trial to one per person, and to contact you about your account, license and support.
• Device information: device or installation identifiers, including resettable or app-scoped identifiers, device model, and operating-system version, used to issue a device-scoped access token, to bind a license to one device and to support the Services. On iPhone and iPad this is an installation identifier created by the App (a random value beginning with “ios-”), kept in the device’s Keychain so that it stays the same if the App is reinstalled; it is used, like the Android device identifier, to apply one free trial per device and to bind a license to one device (see Section 5.9).
• License and payment records: your license and its status, and, when you buy a license through a payment link, the amount, date, payment method and the payment provider’s transaction reference. We never receive your card number, mobile-wallet PIN or banking password.
• Messages you send us: the content of support emails and requests you send, and our replies.
• Technical connection information: when the App connects to our servers, our servers and the network provider that carries the connection (see Section 9) receive standard technical information such as your IP address, the time of the request and the App version. It is used to deliver the Services and to keep them secure.
• File hashes for scanning (Android): when you use file, photo, or video scanning features, the App computes a cryptographic hash (SHA-256) of the relevant file on your device and sends only that hash for a reputation check. Photos, videos and your other files are never uploaded.
• Information about installed apps (Android): package names, signing-certificate fingerprints, which store installed each app, and — for apps installed from outside Google Play — the hash of the app’s installation file(s). See Section 5.4.
• App installation files you choose to scan (Android): when you tap “Scan Now”, the installation file (APK) of an app installed from outside Google Play may be uploaded to our servers for a full malware scan. Apps from Google Play and apps that came preinstalled on your phone are never uploaded. See Section 5.7.
• Phone numbers, message text and links you choose to check: only when you type, paste or share them into one of the App’s check tools and tap to check. See Sections 5.8 and 5.9.
• Scam-caller reports: when you choose to report a phone number as a scam caller, the number, your account ID and the time of the report. See Section 5.10.
• URL and link data (Android): when the App’s web-protection or messaging-link-protection features are active, it checks URLs against our threat-intelligence feed before you open them.
• Domain names: only if you turn on the optional Tracker & Privacy Protection feature on Android (Section 5.6) or Swadhin Bangla DNS on iPhone and iPad (Section 5.9). Our DNS server does not log or store these look-ups; for Swadhin Bangla DNS it keeps only block counts, as numbers, under a random code (Section 5.9).
• Notification-derived data and device permissions (Android): see Section 5 for exactly what is read and how.
• Website analytics: standard technical information, such as browser type and pages visited, when you visit fredbd.com.

We do not collect your precise location (GPS), contacts, call logs or the calls you make or receive, calendar, health or biometric data (Face ID, Touch ID and fingerprint unlock happen inside your device’s operating system and are never shared with us), or the content of your photos and files, except an app installation file you choose to scan (Section 5.7). If you turn on automatic call blocking on Android, the number of an incoming call is checked on your phone only and is not sent to us (Section 5.10).

The App does not inspect or process the content of your financial transactions within banking or mobile-financial-service apps, and does not collect payment card numbers, banking PINs, or passwords.

4.1 Sign in with Google

You create your account using Sign in with Google (see Section 4.2). When you do, and only after you choose a Google account and agree, Google shares the following with the App:

• your name and email address; and
• a digitally signed sign-in token (an “ID token”) issued by Google.

Our server checks the ID token with Google to confirm that the sign-in is genuine and to read your verified email address, which becomes the email address on your account and license. Your name is used to personalise the App, for example in the greeting on the home screen. We do not request access to your Gmail, Google Drive, contacts, calendar, photos or any other Google service, and we never see or store your Google password. On iPhone and iPad, the Google sign-in page opens in Apple’s own secure browser window (see Section 5.9).

Information we receive through Sign in with Google is:

• used only to create, verify and manage your account and license, and to contact you about them;
• never sold, never used for advertising, and never shared with third parties, except the infrastructure providers that host and carry our services (see Section 9) or where required by law;
• not used to develop, improve or train artificial-intelligence or machine-learning models; and
• retained and deleted as described in Sections 12 and 14.

You can remove the App’s access to your Google account at any time from the Third-party apps & services page of your Google Account. Doing so stops future sign-ins with Google but does not delete your Swadhin Bangla account; to delete your account and its data, follow Section 14.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4.2 An account is required

From Android version 6.2.9.3 and in the iPhone and iPad app, you need a Swadhin Bangla account to use the App. After the first screens, the App asks you to sign in with Google and enter your mobile phone number once (Section 4.1); until you do, only the emergency helpline numbers (such as bKash, Nagad, Rocket, Upay and 999) can be used. We ask for an account because your free trial and license belong to it, and because the App’s online checks and scam-caller reports work through it. Protections you had already turned on keep running. You can delete your account at any time (Section 14).

5. Device Permissions and Sensitive Access

This section describes, in plain language, the sensitive device permissions and special access the App may request, why each is needed, and — just as importantly — what each one does not do. Sections 5.1 to 5.8 apply to the Android app; Section 5.9 explains what is different on iPhone and iPad; Section 5.10 explains reporting scam callers and blocking scam calls on Android and iPhone.

5.1 Notification access (SMS-based phishing protection)

With your permission, the App inspects notifications from your device’s default messaging apps (such as Google Messages or Samsung Messages) for the sole purpose of detecting phishing (“smishing”) links. On your device, the App searches the notification text for a URL; if one is found, only that URL — never the surrounding message text — is sent to our threat-intelligence backend for a reputation check. The original notification or message content is never stored, logged, or transmitted off your device.

5.2 Accessibility Service access (optional, feature-specific)

The App may request Accessibility Service permission to power up to three optional, narrowly-scoped protection features. Each is off by default, is explained to you in the App before you are asked to enable it, and can be turned off at any time from your device’s Accessibility settings.

• App Lock: detects, using only the name of the application currently in the foreground, when you open an app you have chosen to protect, and shows the App’s own PIN or biometric unlock screen. It does not read any on-screen text or content.
• Browser Protection: reads the address-bar URL from Google Chrome only, and sends that URL to our server over an encrypted connection, where it is checked against our threat-intelligence feed and our registry of official websites. It reads only the address-bar text — never passwords, form entries, page content, or any other on-screen data. It also detects, using only the app’s name, when a supported banking or mobile financial service app opens, so it can briefly pause Web Protection and let that app work normally; it does not read anything inside that app. Web Protection pauses only for the genuine app — one installed from Google Play, preinstalled on your phone, or whose digital signature has been verified (see Section 5.4); a copy of that app from anywhere else does not pause it.
• Payment App Fraud Protection — Smart Alert: detects, using only the name of the application currently in the foreground, when a supported mobile financial service or banking app opens, and shows a brief reminder to verify the recipient before you complete a transfer. It does not read transaction details, recipient information, or any on-screen content.

5.3 Usage access (app-usage detection)

Used solely to determine which application is currently in the foreground, so that the App’s local, on-device VPN filter can apply protections on a per-application basis — for example, to notice when a supported banking or mobile financial service app opens, so that Web Protection can pause briefly for it (see Section 5.2). No browsing history, screen content, or other usage data is read or transmitted.

5.4 Installed-application visibility

Used to detect malicious, cloned, or sideloaded applications and to let you choose which installed apps to protect with App Lock. We compare installed package names and signing certificates against known-malware and known-good lists on our servers; the list of installed application names is not sold or shared with third parties for advertising purposes.

For each app being checked, the App sends our server its package name, the fingerprint (SHA-256) of its signing certificate, which store installed it (for example, Google Play) and whether it came preinstalled on your phone. For an app installed from outside Google Play, the App also sends the SHA-256 hash of the app’s installation file, and of each of its split files if it has any. These details are used only to check the app against our threat-intelligence data and our registry of official banking, mobile-financial-service and payment apps.

These checks happen:

• when you run a Threat Scan;
• during an automatic scan about every 15 days, which you can turn off on the Scan screen — the automatic scan never uploads any app file (see Section 5.7); and
• when an official banking or mobile-financial-service app is installed or updated on your phone, so the App can warn you at once if that copy is not the official Google Play version.

For official financial apps the App has verified, it keeps the signing-certificate fingerprints on your device, so that Web Protection treats only the genuine app as genuine (see Section 5.2). This information stays on your device.

5.5 Wi-Fi network information

The App does not use GPS or network-based location and does not track your whereabouts. This permission is required only because, since Android 9, reading the name (SSID) and address (BSSID) of the Wi-Fi network you are connected to requires this permission to be granted — a requirement of the Android platform, not a feature of the App. We use this information solely to detect connections to insecure or spoofed Wi-Fi networks as part of our Wi-Fi security scanning feature. We never read or store your GPS coordinates, location history, or any geofencing data.

5.6 Local VPN protection

The App’s on-device VPN filters outgoing DNS queries against a threat-intelligence blocklist to block known phishing and malware domains in real time. Your app traffic is not routed through any remote VPN server operated by us or anyone else — the VPN interface runs locally, on your device, for this filtering purpose only. The only exception is the optional feature below, which sends domain names (not your traffic) to our DNS server.

Tracker & Privacy Protection (optional, off by default): when you turn it on, the domain name an app on your device is about to contact (for example, example.com — never the full web address, page content, app data or messages) is sent to our own DNS server. That server blocks known tracking domains and forwards every other look-up to a public DNS resolver (Cloudflare 1.1.1.1 or Google 8.8.8.8). These look-ups travel as standard, unencrypted DNS queries, like those sent to any public DNS server. Our DNS server does not log or store these look-ups.

5.7 App-file scanning (“Scan Now”)

When you tap “Scan Now”, the App can check the installation file (APK) of an app that was installed from outside Google Play with a full malware scan on our servers. This is how it works:

• Only apps installed from outside Google Play are included. Apps from Google Play and apps that came preinstalled on your phone are never uploaded.
• The App first checks the file’s hash. If the hash is already known as malicious, no upload is needed.
• Otherwise, the installation file (up to 100 MB) is sent over an encrypted connection to our own servers. There it is examined, without ever being run, by our malware-scanning engines in an isolated environment.
• The file is used only for that scan. It is not shared with any third party, and it is not kept after the scan is finished. We keep the scan result, recorded against the file’s hash, so that the same file does not need to be scanned again.
• To keep the service fair and protect it from misuse, full file scans have a daily limit per account. For this we keep a record of each upload — the time, the file size, the file’s hash, the app’s package name and the scan result — linked to your account, for 30 days, after which it is deleted automatically.
• If a full scan is not possible — for example, the daily limit has been reached, you are not signed in, or the file is larger than 100 MB — the App checks the app by its hash, package name and signing certificate instead, and does not upload the file.
• The automatic scan every 15 days never uploads any app file.

5.8 Checks you start yourself

Some tools in the App check information only when you enter it and tap to check:

• SMS check: the sender name or number and the message text you type or paste are sent to our server, to check for fraud and phishing patterns and to return a result.
• Phone number check: the number you enter is sent to our server and checked against our threat-intelligence data on scam numbers.
• Link check: a web address you enter is sent to our server and checked as described in Section 4.
• Password leak check: the password you enter never leaves your device. The App computes its SHA-1 hash on your device and sends only the first 5 characters of that hash to the Have I Been Pwned “Pwned Passwords” service (api.pwnedpasswords.com). That service returns a list of known breached-password hashes that start with those characters, and the match is checked on your device. The service never receives your password or its full hash.

These checks are separate from Notification access (Section 5.1). Notification access sends only the link found in a message, never the message text.

5.9 iPhone and iPad

Apple does not allow apps on iPhone or iPad to scan other apps, lock apps, read notifications or scan files, so the features in Sections 5.1 to 5.5 and 5.7 exist only in the Android version. On iPhone and iPad:

• Sign in with Google (required): works as described in Sections 4.1 and 4.2. The sign-in page opens in Apple’s own secure browser window; the App does not use Google’s sign-in software library and never sees your Google password. You then enter your mobile phone number once, as on Android.
• Stored on your device: your sign-in state, the access token our server issues and your license key are kept on your iPhone or iPad (the token and license key in the device’s Keychain). Signing out removes the token; the license key stays on the device because the license is bound to it.
• Checks you start yourself: a link, phone number or SMS text you type, paste, share to the App (Share → Swadhin Bangla Check), send through the Shortcuts action, or read from a QR code is first checked on your device. A check you start inside the App is also sent to our server and checked as described in Section 5.8, and the result screen says so. Checks through Share and Shortcuts run on your device only.
• QR codes: camera images used to read a QR code are not saved or sent. A photo you choose with the photo picker is read on your device only; the App gets no access to your other photos.
• SMS filter (optional): if you turn it on in Settings, iOS gives the App’s filter the text of messages from unknown senders. The filter decides on your device whether a message goes to Junk. Message text is not stored or sent anywhere. iOS never passes messages from your contacts or iMessage to the filter.
• Safari content blocker (optional): a list of ad and tracker domains is given to Safari, which applies it on your device. The App does not see the pages you visit.
• Swadhin Bangla DNS (optional): if you turn it on, your device sends the domain names it looks up (for example, example.com — never full web addresses, page content or app data) over an encrypted connection (DNS-over-HTTPS) to our own DNS server, through Cloudflare’s network. Our server blocks known ad, tracker, phishing and malware domains, never blocks the official bank and mobile-financial-service domains in our registry, and forwards other look-ups to a public DNS resolver (Cloudflare 1.1.1.1 or Google 8.8.8.8). Our DNS server does not log or store these look-ups. You can turn it off at any time in Settings.
• Block counts for Swadhin Bangla DNS: the App gives your device its own DNS address containing a random code that is created on your device and is not linked to your account, name, email address, phone number or device ID. For that code our server keeps only numbers — how many look-ups were made and how many ad, tracker and harmful-site look-ups were blocked, in total and per day for the last 8 days. It never keeps which domains were looked up, and it does not keep your IP address. The App reads these numbers to show its Protection summary, including an estimate of the mobile data and money saved. The counts of a code that has not been used for 90 days are deleted; removing the DNS profile (or turning Swadhin Bangla DNS off) stops the counting.
• Call blocking and caller identification (optional): if you turn it on in Settings (Apps → Phone → Call Blocking & Identification), the App’s call-blocking extension downloads the public call-block list (Section 5.10) from our server, about once a day and when you tap to update, and gives it to iOS. iOS then blocks calls from those numbers itself. The extension also gives iOS labels for official helplines (such as bKash 16247, Nagad 16167, Rocket 16216 and Upay 16268), so that iOS can show “official” when such a number calls. The download contains no information about you, and the App and its extension never see your calls, your call history or who calls you — iOS does the matching on your device.
• Reporting scam callers: under the result of a phone number check you can report the number as a scam caller (Section 5.10).
• Password tools: the password leak check works as described in Section 5.8. The password generator runs on your device; a copied password stays on that device (not shared through Apple’s Universal Clipboard) and is cleared from the clipboard after 2 minutes.
• Protection summary and history: the App keeps counts of the checks you have made (for example, how many were high risk) on your device only — never what you checked. The list of recent checks is kept only while the App is open.
• Delete your account: in the App, open Profile and tap Delete account (Section 14).

The iPhone and iPad app does not track you as Apple defines tracking: it does not use the advertising identifier, contains no third-party advertising or analytics code, and does not link your information with other companies’ data.

5.10 Reporting scam callers and the call-block list

If a number called you to cheat you, you can report it in the App — in the iPhone and iPad app, and in the Android app from version 6.2.9.6 (Tools → Call & SMS Filter, under the result of a number check). This is how it works:

• What is sent: the reported number and your account’s access token. We store the number, your account ID and the time. Nothing about the call itself is collected, and your own phone number is not attached to the report.
• Limits: each account can report a number only once, and up to 20 numbers a day. Only Bangladeshi mobile numbers can be reported, so official short codes (such as 16247) can never be reported or blocked.
• Automatic blocking: when three different accounts have reported the same number, it is added automatically to our call-block list, and our phone number check shows it as a known scam number. We review blocked numbers; if a number was blocked by mistake or reported on purpose to harm its owner, we remove it, and it is never blocked automatically again.
• The call-block list is public: so that call blocking on iPhone and Android works without signing in, the list of blocked numbers can be downloaded from our server by anyone. It contains only the blocked numbers — never who reported them or how many reports there were.
• Automatic call blocking on Android (optional, Android 10 and later): if you turn it on (Tools → Call & SMS Filter → Turn on) and choose Swadhin Bangla as your phone’s “Caller ID & spam app”, Android lets the App see the number of incoming calls so that it can be checked. The App compares the number with the call-block list stored on your phone (downloaded from our server about every 12 hours) and, if the number is on the list, rejects the call and shows a notification; the call still appears in your call log. The caller’s number, the time of the call and whether it was blocked are not sent to us or to anyone else — the check happens only on your phone. The App does not read your call log or your contacts and does not use the Phone or Call log permissions. The list and a count of the calls it blocked are kept on your phone. You can turn it off in the App, or in Android Settings → Apps → Default apps → Caller ID & spam app.
• If your number was blocked: contact us at support@fredbd.com (Section 19). We will check and remove a number that should not be on the list.

6. How We Use Information

We use the information described above to:

• provide the checks and protections you use, and show you their results;
• create and manage your account and license, keep the free trial to one per person and per device, and send you emails about your account, license and payments;
• answer your questions and requests;
• detect and block security threats, keep the Services secure and prevent fraud and misuse; and
• keep records that tax and accounting law requires, and comply with other legal obligations.

We do not sell your personal or sensitive user data. We do not use it for advertising, we show no advertisements, and we do not track you across other companies’ apps or websites. The App (on Android, iPhone and iPad) contains no third-party advertising or analytics tools.

7. Artificial Intelligence and Automated Analysis

The App uses machine-learning models and threat-intelligence feeds to classify files, URLs, and other indicators as safe or malicious. Automated security analysis can produce false positives or false negatives; you can report suspected misclassifications through the App or by contacting us. A result such as “No clear risk found” is not a guarantee that something is safe.

8. Legal Grounds for Processing

Where applicable law requires a legal basis, we rely on:

• Performance of our agreement with you — to provide the Services you ask for: your account and license, the checks you start, the protections you turn on, and support.
• Your consent — for optional features that need special access or send data you choose: Notification access, the Accessibility-based features, Tracker & Privacy Protection, Swadhin Bangla DNS, and uploading an app file with “Scan Now”. You can withdraw consent at any time by turning the feature off; this does not affect processing that took place before.
• Our legitimate interests — in detecting and preventing fraud, malware and other security threats, protecting our systems and users, keeping the free trial to one per person (including the keyed hashes described in Section 14.3), protecting people from scam calls through reports and the call-block list (Section 5.10) — including the phone numbers of the callers reported, which are the information of those callers, not of the person reporting — and understanding how the Website is used. We use only the minimum information needed, and you can object (Section 13).
• Legal obligation — to keep payment and invoice records and to respond to lawful requests from authorities.

9. When We Share Information

We do not sell, rent or trade your personal information, and we do not share it for advertising. We share information only as follows:

• Cloudflare, whose network carries the encrypted connections between the App and our servers, including encrypted DNS look-ups from iPhone and iPad when Swadhin Bangla DNS is turned on (Section 5.9).
• Backblaze, which stores backup copies of our databases so the Services can be restored after a failure. Backup copies are deleted automatically within 30 days (Section 12).
• Microsoft, our email provider (Exchange Online), which delivers the emails we send you about your account, license and payments, and the emails you send us.
• Google, for Sign in with Google (Section 4.1); and, in the Android app, Google Play Integrity, which confirms that the App is a genuine copy installed from Google Play and running on a genuine device — Google receives information about your device and the App for this check. We may use the result to decide whether a free trial can be started (Section 20).
• Public DNS resolvers (Cloudflare 1.1.1.1 and Google 8.8.8.8), which receive the domain-name look-ups that Tracker & Privacy Protection (Section 5.6) and Swadhin Bangla DNS (Section 5.9) forward.
• Have I Been Pwned “Pwned Passwords”, which receives only the first 5 characters of a password hash when you use the password leak check (Section 5.8).
• Threat-intelligence, reputation and malware-analysis providers, to check hashes and URLs you or the App submit — only the hash or URL is shared, never your files, any app file uploaded for scanning, or message content.
• Payment providers (such as mobile financial services and banks), which handle the payment when you use a payment link. They receive what you enter in their own app or page; we receive confirmation of the payment and its transaction reference.
• Anyone who downloads the public call-block list (Section 5.10): only the phone numbers on it — never who reported them.
• Government or regulatory authorities, where required by law.

Cloudflare, Backblaze and Microsoft process information only on our behalf, to provide their service to us, under data-processing terms that require them to keep it secure and confidential to a standard at least equal to this Policy. Google, the public DNS resolvers, Have I Been Pwned and payment providers receive only the limited information described above for that one task, and handle it under their own privacy policies.

App installation files uploaded for scanning (Section 5.7) are scanned only on our own servers and are never shared with third parties.

If you choose to supply your own third-party API key for an optional feature (for example, a personal VirusTotal API key), any data sent using that key is governed by that third party’s own privacy practices, not this Policy. We do not share your personal or sensitive data with third parties for their own advertising purposes.

10. International Data Transfers

Our servers are located in Bangladesh. If you use the Services from another country, your information is sent to Bangladesh. Cloudflare, Backblaze, Microsoft and Google may process information in other countries, including the United States and member states of the European Union. Where the EU or UK General Data Protection Regulation applies to such a transfer, we rely on the safeguards in those providers’ data-processing terms, such as the European Commission’s Standard Contractual Clauses. You can ask us for more information about these safeguards (Section 19).

11. Data Security

We use encryption, access controls, and incident-response procedures designed to protect the information we hold. In particular: connections between the App and our servers are encrypted (HTTPS), except the standard DNS look-ups of Tracker & Privacy Protection on Android (Section 5.6); on iPhone and iPad, sign-in tokens and license keys are stored in the device’s Keychain; identifiers kept after an account is deleted are stored only as keyed one-way hashes, and the key is kept separately from our database backups; and access to our servers is limited to authorised staff. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Retention and Deletion

We keep information only for as long as it is needed for the purpose it was collected for:

• Account information (name, email address, phone number) and your license: while your account exists. When your account is deleted, they are deleted or de-identified — immediately when you use Delete account in the App, and within 7 business days of a verified email request (Section 14).
• Payment and invoice records: for the period that Bangladesh tax and accounting law requires. After your account is deleted they are kept without your name, email address or phone number.
• Keyed hashes of your phone number, email address and device identifiers, kept when you delete an account that used a free trial or held a license (Section 14.3): for as long as we offer a free trial.
• Records of app-file uploads used for the daily limit: 30 days, then deleted automatically. Uploaded app files are not kept after the scan (Section 5.7).
• Malware and threat data, including scan results recorded against a file’s hash: for longer periods, since it has continuing value for protecting all users. It contains no personal identifiers.
• Links, numbers and message text you send for a check: used to give you the result, and kept only as long as needed for that and to protect the Services from misuse.
• Domain-name look-ups through our DNS server: not stored.
• Scam-caller reports (Section 5.10): 12 months from the report, then deleted. A number stays on the call-block list while it is blocked; a number we remove is kept only as a “not a scam” mark, so that it is not blocked automatically again.
• Swadhin Bangla DNS block counts (numbers only, under a random code — Section 5.9): per-day counts for 8 days; all counts for a code deleted after 90 days without use.
• Technical connection information and server logs: kept for a limited operational period and then deleted by routine log rotation.
• Database backups: deleted automatically within 30 days.
• Support emails: as long as needed to handle your request and any follow-up.
• Information kept only on your device (Section 14.4): until you delete it, clear the App’s storage or uninstall the App.

Upon a valid deletion request, we will delete or de-identify your information, except where retention is required by law.

13. Your Rights and Choices

Wherever you live, you may ask us to:

• tell you what personal information we hold about you and give you a copy, in a commonly used electronic format;
• correct information that is wrong or incomplete;
• delete your account and personal information (Section 14);
• stop or limit a particular use of your information, or object to uses based on our legitimate interests; and
• withdraw a consent you gave, by turning the optional feature off; and
• remove your phone number from our call-block list if it should not be there (Section 5.10).

You can disable individual features — including Accessibility Services, Notification access, the SMS filter, the Safari content blocker, Swadhin Bangla DNS and automatic call blocking — from the App or your device settings, or uninstall the App entirely. To make a request, email support@fredbd.com from the email address registered with your account (subject: “Privacy Request”), or use Delete account in the App (Profile). We may need to confirm your identity before acting on a request. We answer within one month (within 45 days for California residents — see Section 21). We will not treat you differently for exercising any of these rights. Sections 20 to 22 add details for the European Economic Area, the United Kingdom, Switzerland, California and India.

14. How to Delete Your Account and Data

You may request deletion of your account and the personal data associated with it at any time, whether or not you continue to use the App.

14.1 How to request deletion

In the App: open Profile and tap Delete account (in the Android app from version 6.2.9.4, and in the iPhone and iPad app). After you confirm, your account is deleted straight away; no email is needed. You can also ask by email, for example if you no longer have the App:

14.2 What gets deleted

• Your name, email address, phone number and area
• Your license and subscription: open subscriptions are cancelled and the license stops working on every device. A license you bought cannot be restored after the account is deleted.
• Device identifiers linked to your account
• Payment links sent to you that were not yet paid

Copies of this information in our backups are deleted automatically within 30 days.

14.3 What we may retain

After your account is deleted, we keep only:

• Records of payments and invoices that tax and accounting law requires us to keep. These are kept without your name, email address or phone number.
• If you used a free trial or held a license: a one-way, keyed hash of your phone number, your email address and your device identifier, so that deleting and re-creating an account cannot be used to claim the free trial again. These hashes cannot be turned back into the original phone number, email address or identifier, and are used for nothing else. You can still create a new account and buy a license.
• Scam-caller reports you made (Section 5.10): kept for up to 12 months from each report, linked only to a random account ID — without your name, email address or phone number — so that the call-block list stays correct.
• Anonymized threat-intelligence data (such as malware hash detections) that contains no personal identifiers, for security, fraud-prevention, and legal-compliance purposes, consistent with Section 12 (Retention and Deletion) above.

14.4 Data that stays only on your device

Private Vault contents and other locally stored App data never leave your device and are not held on our servers. You can remove this data immediately, without contacting us, by clearing the App’s storage in your device’s Settings or by uninstalling the App. On iPhone and iPad, iOS keeps items stored in the Keychain — the App’s installation identifier and license key — on the device even after the App is deleted; they are used again only if you reinstall the App, and erasing the device removes them.

14.5 Processing time

We process verified deletion requests within 7 business days and will confirm by email once your account and associated data have been deleted. Deletion from inside the App happens immediately.

15. Children’s Privacy

Our Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13 without appropriate parental or guardian authorization. If you are under the age at which you can agree to this processing yourself where you live (in the European Economic Area this is between 13 and 16, depending on the country), please ask a parent or guardian before creating an account. If you believe a child has provided us with personal information, please contact us so we can take appropriate action, including deleting it.

16. Third-Party Services and Links

The App and Website may reference or link to third-party services we do not control. This Policy does not cover the privacy practices of those third parties; we encourage you to review their own privacy policies.

17. Changes to This Policy

We may update this Policy from time to time. Each update is shown by a new “Last Updated” date and a short description of the change at the top of this page. Where required by law, we will provide additional notice, for example by email.

18. Applicable Law

This Policy is intended to comply with Bangladesh’s Personal Data Protection Ordinance, 2025, and Cyber Security Act, 2026, and, where they apply to our processing, India’s Digital Personal Data Protection Act, 2023, the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection, and California privacy law (the California Consumer Privacy Act as amended by the California Privacy Rights Act, and the California Online Privacy Protection Act). It is governed by the laws of Bangladesh, without taking away any rights you have under the mandatory law of the place where you live.

19. Contact Us

20. Additional Information for the European Economic Area, the United Kingdom and Switzerland

If the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies to our processing of your information:

• Controller: Fred Intelligence Limited (Section 2).
• Purposes and legal bases: Section 8. Recipients: Section 9. International transfers: Section 10. Retention: Section 12.
• Your rights: you have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on our legitimate interests. Where we rely on consent, you can withdraw it at any time without affecting processing before the withdrawal.
• Complaints: you have the right to lodge a complaint with the data protection supervisory authority in the country where you live or work, or where you believe your rights were infringed. We would appreciate the chance to address your concern first (Section 19).
• Is the information required? Your email address and phone number are needed to create an account, and an account is needed to use the App (Section 4.2); without them we cannot provide the Services, except the emergency helpline numbers. Everything else, including every optional protection and reporting scam callers, is your choice.
• Automated decisions: scam and malware results are produced automatically and are warnings for you to act on, the free-trial check automatically declines a second trial for the same phone number, email address or device, and may decline a trial requested from an Android copy of the App that Google Play does not recognise as genuine, and a phone number reported by three different accounts is blocked automatically and reviewed by us afterwards (Section 5.10). We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
• How to exercise your rights: Section 13. We respond within one month; if a request is complex we may extend this by up to two further months and will tell you why.

21. Additional Information for California and Other US States

This section is for residents of California (California Consumer Privacy Act as amended by the California Privacy Rights Act, “CCPA”, and the California Online Privacy Protection Act, “CalOPPA”) and of other US states with similar laws. We offer the rights below to all users, whether or not a law requires it.

21.1 Categories of personal information we collected in the last 12 months

• Identifiers — name, email address, phone number, account and license IDs, device or installation identifiers, IP address. Source: you, your device and, for sign-in, Google.
• Customer records — name, email address, phone number, and payment references (Section 4).
• Commercial information — license, trial and purchase records.
• Internet or other electronic network activity — links and domain names checked by the App, and, on Android, information about installed apps (Section 5.4). Domain-name look-ups through our DNS server are not stored; only block counts under a random code (Section 5.9). Phone numbers you report as scam callers, with the time (Section 5.10).
• Sensitive personal information — the contents of a text message, only when you choose to check that message (Sections 5.8 and 5.9). We use it only to give you the result you asked for.

We do not collect precise geolocation, biometric information, or information about your health. We use these categories for the purposes in Section 6, disclose them for business purposes only to the recipients in Section 9, and keep them for the periods in Section 12. We do not create profiles of you or draw inferences about you.

21.2 No sale or sharing

We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the last 12 months. We do not knowingly sell or share the personal information of consumers under 16. Because we use sensitive personal information only to provide the Services you request, the right to limit its use does not apply. We do not share personal information with third parties for their own direct marketing purposes (California Civil Code § 1798.83).

21.3 Your California rights and how to use them

You have the right to know what personal information we collect, use and disclose and to receive a copy of it; to request deletion; to request correction; to opt out of the sale or sharing of personal information (we do neither); to limit the use of sensitive personal information (not applicable, see 21.2); and not to be discriminated against for using these rights. To make a request, email support@fredbd.com (subject: “Privacy Request”) or use Delete account in the App (Profile). We will confirm receipt within 10 business days and respond within 45 days; if we need longer (up to 45 more days), we will tell you within the first 45 days. We verify a request by matching it to the email address on your account. You may use an authorized agent; we may ask the agent for your signed permission and ask you to confirm your identity with us.

21.4 Do Not Track and online tracking

The App does not track you over time or across other companies’ websites or apps, and it does not let any third party collect information about your online activities across different websites or apps. Because there is no such tracking to turn off, the Services do not respond differently to “Do Not Track” browser signals or similar mechanisms such as Global Privacy Control.

22. Additional Information for India

If you use the Services in India, the Digital Personal Data Protection Act, 2023 and the rules made under it may apply to our processing of your personal data. In addition to Section 13:

• Your rights: you can ask for a summary of the personal data we process about you and how we process it; ask us to correct, complete, update or erase it; withdraw a consent you gave, as easily as you gave it; and nominate another person to exercise these rights for you if you die or become unable to do so.
• Grievances: send any complaint about how we handle your personal data to support@fredbd.com (subject: “Privacy Grievance”). We reply within 30 days.
• Data Protection Board of India: if you are not satisfied with our reply, you can complain to the Data Protection Board of India.
• Where your data is processed: in Bangladesh, and by the providers named in Section 9 (see Section 10).

Learn more about the app: Swadhin Bangla AI Security – Android security app by Fred Intelligence Limited · Get it on Google Play