Privacy Policy

The Vilkax Privacy Policy is the canonical contract on what we collect, why, how long we keep it, and your rights under the EU GDPR, the CCPA, and the other local data-protection laws that apply.

Who we are (data controller)

The controller of your personal data is Vilkax UAB, registered in Lithuania with its registered office in Vilnius and an operating hub in Barcelona, Spain. (Our company registration number and full registered address are published here once incorporation is confirmed.) You can reach us through our contact form; to reach our data-protection contact, select the privacy topic. As an EU-established controller, our lead supervisory authority is the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI).

What we collect

• Account email - the only field required to use Vilkax. Stored case-insensitive, hash-indexed (SHA-256) for query, and AES-256-GCM encrypted at rest.
• Phone number - only if you choose to enrol one (smart 2FA fallback, SMS scam scanning on Pro+). Stored as a SHA-256 hash in our hot indexes; the raw number is held encrypted.
• Crypto wallet addresses - only the addresses you explicitly register. Public on-chain data we monitor against threat-intel feeds. Never your private keys.
• Postal address - only if you choose to provide one for shipping rewards or compliance KYC.
• Threat metadata - for messages you forward / share to Vilkax for scanning, we keep the verdict (kind, category, risk_score, severity) but discard the raw body after the scan completes.
• Device fingerprint - OS, browser, hashed UA, last-seen timestamp. Used by smart 2FA to detect anomalous sign-ins.
• Device, network & protection signals (opt-in, per-purpose) - to protect you, the apps can collect security signals and send them to us. Each is gated by its own consent toggle in the Privacy Center, is off until you turn it on, and is minimised / hashed before it leaves your device. We never collect a raw process list or your browsing history. What this covers:
  • Device security posture - whether the device is rooted / jailbroken, has developer mode or USB debugging on, is disk-encrypted, and its OS version. Used to warn you about a compromised device and to weight its signals. Consent key background_service.
  • Device identifier - a per-app, vendor-supplied id (on iOS, the IDFV) stored only as a salted SHA-256 hash, used to compute and remember a device's trust score. The raw id never lands at rest. Consent key background_service.
  • Network posture - the connection type, whether a VPN is active, and whether the Wi-Fi is open / unencrypted. The Wi-Fi network name (SSID) is hashed on the device first; the raw SSID never leaves the device. Consent key network_scan.
  • App-usage and interaction signals (Android, opt-in) - the foreground time of your top apps (package names only, never app content) to spot a remote-control app active during a scam session, plus in-app interaction events (searches, taps) for product analytics. Consent key app_usage.
  • Message / SMS threat verdicts - message text is classified for scams on the device; only the verdict (kind, category, risk score) is uploaded and the raw body is discarded after the scan. Consent keys sms / notifications.
  The purpose is protection only - never advertising or profiling. These signals are consent-gated server-side too: even if a tampered app sent a signal whose consent you hadn't granted, our intake (/api/risk/v2/signals, /api/intake/unified-signal, /api/signals/v1/*) checks your persisted consent and drops it. Signal rows are retained per region (EU 90 days / other regions 180 days) and are deleted when you delete your account (see Erasure below).
• Coarse location (country) - your country code, derived server-side from the request, used for geo-anomaly sign-in detection. No GPS, no precise location, no location permission is requested for this.
• Audit log - every state-changing action you take, with actor, target, IP, and timestamp. Hash-chained so tampering is detectable.
• Hearth journal entries (opt-in only) - when you write in Hearth, the text is AES-256-GCM encrypted at rest with a key we rotate. A redacted (no-names, no-numbers) copy lives alongside it solely so a future export gives you readable data. We never train models on your entries; the safety classifier is pattern-based and runs in code, not in an LLM.
• KIN location pings (opt-in only, per circle) - when you share live location to a trusted circle, we store latitude/longitude rounded to 6 decimals, GPS accuracy, speed, battery level, and an approximate city derived from the request. Pings live for a maximum of 24 hours, then are pruned automatically. Visibility is per-member-per-circle and respects your share settings (precise / approximate / paused) on every read.

What we do NOT collect

• The contents of your inbox, messaging apps, or files. The desktop agent reports event metadata only.
• Your private keys, seed phrases, or wallet recovery material. Ever.
• Precise geolocation outside of KIN circles you explicitly opt into. Account telemetry stores country code only.
• KIN location history beyond 24 hours. Pings older than that are deleted by a daily sweep.
• Cross-site browsing behavior. We don't run trackers and fonts are self-hosted. The only third party that loads automatically on the marketing site is Cloudflare Turnstile (the captcha, needed to submit forms). An optional Spotify player on the home and Sounds pages is a third party too, but it loads only after you consent to analytics or click to load it - never on page load by default.
• Behavioral data for advertising. Vilkax has no ads business.
• Public maps of users. KIN circles are isolated by design - no discovery, no global map, no shared visibility.

Your rights

• Access - Settings → "Export my data" gives you a single JSON bundle of every record we hold for you (sessions, devices, security events, Hearth entries in redacted form, subscription history). Self-service, instant.
• Rectification - fix wrong data via the app's Settings page or through our contact form.
• Erasure - Settings → "Schedule account deletion" deactivates your account immediately: it is frozen so no one can sign in, and all your active sessions are revoked on the spot. It is then scheduled for permanent deletion after a 30-day grace window, during which you can cancel and restore it. After the window, a scheduled purge removes your account record and the personal data linked to it - including the device, network and protection signal / telemetry rows we hold against your account. Some records are removed on different timelines where the law requires us to keep them longer (for example billing and security-audit records), and anonymous, aggregate data that carries no identifier and cannot be tied back to you may be retained. If you want confirmation that a specific erasure has completed, contact our privacy team.
• Portability - the JSON export is machine-readable for moving to another provider.
• Explanation - every automated decision (threat score, AI tier, anomaly flag, KIN ETA) is logged with its inputs. You can request the row that drove any specific call.
• Revoke at any time - pause KIN sharing globally or per-circle, revoke individual sessions or devices, disable 2FA, leave a circle, all from the Settings or Security Center page.
• Complain to a regulator - if you believe we've mishandled your data you can lodge a complaint with a supervisory authority. Our lead authority is the Lithuanian State Data Protection Inspectorate (VDAI, vdai.lrv.lt); if you are in the EU/EEA you can also complain to the data-protection authority in your country of residence. We'd appreciate the chance to put it right first - contact our privacy team.

Children and families

Vilkax is built to protect families, and that starts with how we treat younger users. Under the GDPR (Art. 8), a child can consent to an online service themselves from a national threshold age that varies between 13 and 16 across EU member states. Vilkax is established in Lithuania, where that age is 14: you can create a Vilkax account yourself if you are 14 or older. Below the age that applies to you, we ask that a parent or guardian consents to your use of Vilkax - account creation includes an explicit confirmation of exactly that, and we keep a timestamped record of it.

• KIN and children - KIN shares live location only inside a family circle that each member explicitly joined and approved. There is no public map, no discovery, and no visibility outside the circle. Sharing is consented per circle, can be set to precise or approximate, can be paused, and can be revoked at any time from Settings → KIN - and pings are deleted after 24 hours (see "KIN location pings" above).
• No advertising, ever - we do not profile children (or anyone) for ads. Data from any account is used for protection only.
• Parents and guardians - if you believe a child below the applicable consent age is using Vilkax without your consent, or you want to exercise their rights (access, erasure, pausing KIN sharing), contact our privacy team and select the privacy topic. We will verify and act promptly.

Automated decisions and profiling (EU AI Act Art. 50 & GDPR Art. 22)

Vilkax uses AI and machine-learning models to generate risk scores, anomaly flags, and threat classifications for users and their accounts. These scores may affect which features are available to you (alert priority, protective tier gates, or escalation routing). No automated decision produces a legal effect or similarly significant impact without the right to human review. Our legal basis for this profiling is Art. 6(1)(b) GDPR (performance of a contract: the core protection service you signed up for) and Art. 6(1)(f) GDPR (legitimate interest in detecting and preventing fraud and account-level threats).

Your rights regarding automated decisions: you can request an explanation of any specific risk score or automated action affecting your account through our contact form. You can also request human review of any decision you consider to have produced an unjust outcome. Every automated decision is logged with its inputs (see the "Explanation" right above).

Where data lives

Account data is stored in a primary region. Edge caches hold only public, anonymous data (marketing pages, public state aggregates). Specific region details are documented in the Sub-processors section of our DPA, available on request.

Contact

Privacy questions: contact our privacy team.
To reach our data protection officer, contact us and select the privacy topic.
Security disclosures: /.well-known/security.txt

Last updated: 2026-07-02 · Version v6 (added the Children and families section - GDPR Art. 8 consent age, parental consent below it, KIN's circle-only consented location sharing, and the parent/guardian contact route; v5 re-based to the EU controller - Vilkax UAB, registered in Vilnius, Lithuania, with an operating hub in Barcelona, Spain - lead supervisory authority the Lithuanian VDAI, scoped to the EU GDPR; v4 disclosed the consent-gated Spotify embed; v3 disclosed device / network / app-usage protection signals, their consent gating, retention, and confirmed signal-data erasure on account deletion)