RAKSHABYTE / privacy policy
Updated 18 October 2026. This policy describes RakshaByte's current data flows, privacy choices, retention practices and account-deletion process.
RakshaByte is operated by ValueNum Technologies Pvt. Ltd. For privacy questions or to initiate an account and associated-data deletion request, email support@rakshabyte.com. This policy covers the RakshaByte Android app and website.
RakshaByte uses Amazon Cognito for phone-based account creation and sign-in. AWS processes the registered mobile number, SMS verification and authentication information. Account identifiers and authentication tokens are used to authorize access to the RakshaByte backend. Microsoft Azure App Service hosts the website; it is not the phone-authentication provider.
Caller telephone numbers are transmitted over HTTPS to the RakshaByte backend for reputation checking and may be forwarded to AbstractAPI. DynamoDB reputation records use an HMAC-hashed telephone number as the record key rather than the raw number. This is pseudonymous information, not guaranteed anonymity. The reviewed call-screening flow does not record or transmit call audio or conversations.
With AI Message Validation disabled, RakshaByte analyzes supported WhatsApp, WhatsApp Business and SMS/RCS notification text locally on your device. This feature does not transmit notification text or URLs to the backend while disabled. It analyzes text exposed in supported notifications, not chat history or content hidden from notifications.
AI Message Validation is optional and disabled by default. When enabled, RakshaByte performs local scam checks first and may securely send up to 2,000 characters of supported notification text, link domains, and local security findings to RakshaByte's authenticated backend for additional AI-based scam analysis using the OpenAI API.
Before transmission, RakshaByte attempts to mask obvious phone numbers, OTPs, passwords, and similar sensitive values. This masking is not guaranteed to remove all personal information; names or other personal text contained in a notification may remain.
RakshaByte uses OpenAI to analyze the submitted information for potential scam and fraud indicators and return information such as a risk assessment, warning signs, explanation, and recommended action. AI analysis supplements RakshaByte's local security checks and does not override a local warning with a lower-risk result.
OpenAI API inputs and outputs are not used to train OpenAI models by default. Under OpenAI's standard API data controls, API data may be retained for abuse monitoring for up to 30 days, unless longer retention is required by law or reasonably necessary to protect OpenAI's services or third parties from harm. RakshaByte does not intentionally send full chat histories to OpenAI; only the notification content and related security signals required for the requested analysis are processed.
RakshaByte does not intentionally store raw AI notification or message text on its servers. This does not prevent the transient processing needed to analyze a request or the applicable retention by OpenAI.
You can disable AI Message Validation in the Android dashboard at any time to stop subsequent uploads through this feature. Disabling it does not retract information already transmitted. Notification access can also be revoked in Android settings.
RakshaByte uses the OpenAI API for optional AI Message Validation. The reviewed integration uses the OpenAI Responses API with store: false. This setting does not itself constitute a Zero Data Retention agreement; applicable provider abuse-monitoring retention may still apply, as described above.
The full selected URL is sent to the RakshaByte AWS backend for security analysis when an authenticated cloud check is available. A URL may contain personal information or tokens in its path or query. The reviewed backend normalizes the URL list to domains before further analysis, but the full selected URL has already left the device.
The APK file itself is inspected locally and is not uploaded in this analysis flow. Its SHA-256 hash, package name, requested permissions, local risk score and detected risk signals may be sent to the backend for additional assessment.
App Monitor processes Android-visible third-party app and security information locally for risk assessment, including installation source, relevant requested and granted permissions, readable security-access state, install/update times and signing fingerprints. The reviewed implementation does not upload the installed-app inventory or inspect other apps’ private data. Android package visibility limits coverage.
AWS provides backend/API processing and DynamoDB reputation and report storage. Phone reports can contain a keyed telephone-number hash, authenticated reporter IDs, counts and timestamps. Short-lived reputation-cache records follow their applicable expiry values. Shared fraud, security and blocklist intelligence may be retained as needed for security, fraud prevention and reputation services. On account deletion, the requesting user's applicable reporter associations are removed, while independently contributed security evidence from other users may remain.
Google Play provides app distribution, updates, subscriptions and purchase-status handling. Applicable purchase and subscription information is used to determine access entitlement. Applicable account-linked purchase mappings are removed during account deletion. Exact storage and retention periods for any separately retained purchase or subscription records remain to be confirmed. Google Play's own records follow its applicable provider policies. The reviewed implementation does not identify Firebase or VirusTotal integrations.
The RakshaByte website is hosted on Microsoft Azure App Service. The account-deletion page allows a user to submit an account-deletion request by verifying the registered RakshaByte mobile number through SMS. The verified request is submitted for authorized administrator review.
Cloudflare Turnstile may process browser and challenge information to help prevent automated abuse. Hosting, identity and backend services may process network, authentication and security metadata.
Feature data is processed by the relevant providers: Amazon Cognito for phone authentication and SMS verification, Azure App Service for website hosting, AWS for backend and DynamoDB processing, AbstractAPI for applicable telephone-number lookups, OpenAI for optional AI analysis, Google Play for distribution and purchases, and Cloudflare Turnstile for enabled web forms. Reviewed integrations use HTTPS and authenticated API access. Provider credentials are held on the backend. These measures reduce risk but cannot guarantee absolute security. Retention practices are described below. Provider processing locations and backup lifecycles depend on the relevant service and its configuration.
RakshaByte stores controlled security-event metadata locally, such as source, category, detection time, threat level, risk score and, where applicable, an APK attachment-type indicator. RakshaByte's updated Message Shield does not persist notification bodies, attachment filenames or AI-provider-written message explanations in threat history.
Existing Message Shield history created by earlier versions is scrubbed when processed by the updated application. Other applicable call, link and app-security history may remain according to the application's local-history controls. Local threat history is limited to 100 entries.
You can delete history entries without deleting original messages, provider-held data or your cloud account. The 24-hour window used to combine recent risk signals is not a deletion period. You can disable optional AI analysis, pause Call Shield or Web Shield, and revoke Android permissions or special access. Turning a feature off does not erase previously transmitted information.
| Data | Retention |
|---|---|
| Account and profile | Until account deletion. |
| Raw AI notification or message text on RakshaByte servers | Not intentionally stored. |
| Message Shield notification text in Android history | Not stored by updated Message Shield; older Message Shield entries are scrubbed when processed by the updated application. |
| OpenAI API data | OpenAI's applicable retention and data controls, as described in AI Message Validation. |
| CloudWatch application logs | 30 days maximum configured retention. |
| OTP Lambda logs | 14 days. |
| OTP anti-abuse counters | Approximately 2 days. |
| Reputation cache | Approximately 1 day, according to the current expiresAt value. |
| Completed deletion requests | 30 days after completion. |
| Deletion audit events | 30 days after the event. |
| Active, pending or processing deletion requests | Until resolved; not automatically expired while awaiting resolution. |
| Fraud and security intelligence | As needed for its security purpose; the requesting user's reporter association is removed on account deletion. |
| Backups and snapshots | According to the actual AWS, Azure and Android platform lifecycles. |
RakshaByte application log groups are configured for retention of up to 30 days. OTP sender logs have a shorter configured retention of up to 14 days. Short-lived reputation-cache records use their applicable expiry values, normally about one day; shorter fallback cache periods may apply. Expired cache entries are not used for reputation lookups.
Completed website account-deletion requests and associated completion audit events are configured for approximately 30-day retention after completion. Pending or processing deletion requests are not automatically expired while awaiting resolution. Other deletion audit events use a 30-day expiry after the event.
Database and logging expiry mechanisms operate asynchronously. Expiration periods describe the configured retention policy and do not guarantee physical removal at an exact second. Security and fraud-prevention information may follow a different lifecycle where continued retention is reasonably necessary for security, fraud prevention and reputation services. The requesting user's applicable reporter associations are removed during account deletion.
External-provider retention and historical backup lifecycles are described separately below.
Historical backup copies are governed by the retention schedules of the backup systems that hold them and may remain after information is removed from active systems. Retention varies by backup type and provider. AWS, Azure and Android backup or snapshot copies follow their actual platform lifecycles. RakshaByte does not promise that all historical backups are deleted within 30 days.
RakshaByte users can request permanent deletion of their account and applicable associated personal data from the RakshaByte Android app or through the public account-deletion page at RakshaByte Delete Account.
The website deletion process does not require an existing website sign-in. Users verify ownership of their RakshaByte account through SMS verification of their registered mobile number before a deletion request can be submitted. A verified request is then made available to an authorized RakshaByte administrator for review and processing.
A verified website request does not immediately delete or lock the account. When an authorized administrator begins processing the request, account access is disabled and the RakshaByte deletion service starts the account and associated-data deletion process.
The deletion process is designed to remove linked sign-in identities, the RakshaByte account record, applicable phone and purchase mappings, and the requesting user's membership or association with spam-report records. Reports submitted independently by other users may remain as part of RakshaByte's security and reputation data.
Deletion may be processed asynchronously and may retry if an identity, cloud or other service is temporarily unavailable. Certain operational logs, security and abuse-prevention records, backups, transaction or subscription records, and information already processed by external service providers may remain for their applicable retention periods where necessary for security, fraud prevention, legal, regulatory, accounting or operational purposes.
Local RakshaByte data remaining on the Android device can be removed through the application's account-deletion cleanup process or by clearing the application's storage. Files selected from outside RakshaByte's application storage are not deleted by account deletion.
Google Play subscriptions are managed separately. Deleting a RakshaByte account does not automatically cancel an active Google Play subscription. Users should cancel an active subscription through Google Play where applicable.
Active, pending or processing deletion requests are kept until resolved. Completed website deletion requests are sanitized to remove applicable user identifiers and are configured to expire approximately 30 days after completion. Deletion audit events expire 30 days after the event. Expired records are removed through the applicable service's cleanup process.
Information transmitted off your device is collected by the receiving services even when processed briefly. This policy may be updated as RakshaByte's features, service providers, data-processing practices, retention practices, or legal requirements change. The Google Play Data Safety declaration must match the deployed app and these actual cloud flows.