Privacy Policy

The Vilkax Privacy Policy is the canonical contract on what we collect, why, how long we keep it, and your rights under the EU GDPR, the CCPA, and the other local data-protection laws that apply.

Who we are (data controller)

The controller of your personal data is Vilkaks UAB (registered company ID 308049358), a company registered in Lithuania with its registered office in Klaipėda and an operating hub in Barcelona, Spain. You can reach us through our contact form; to reach our data-protection contact, select the privacy topic. As an EU-established controller, our lead supervisory authority is the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI).

What we collect

• Account email - the only field required to use Vilkax. Stored case-insensitive, hash-indexed (SHA-256) for query, and AES-256-GCM encrypted at rest.
• Phone number - only if you choose to enrol one (smart 2FA fallback, SMS scam scanning on Pro+). Stored as a SHA-256 hash in our hot indexes; the raw number is held encrypted.
• Crypto wallet addresses - only the addresses you explicitly register. Public on-chain data we monitor against threat-intel feeds. Never your private keys.
• Postal address - only if you choose to provide one for shipping rewards or compliance KYC.
• Threat metadata - for messages you forward / share to Vilkax for scanning, we keep the verdict (kind, category, risk_score, severity) but discard the raw body after the scan completes.
• Device fingerprint - OS, browser, hashed UA, last-seen timestamp. Used by smart 2FA to detect anomalous sign-ins.
• Device, network & protection signals (opt-in, per-purpose) - to protect you, the apps can collect security signals and send them to us. Each is gated by its own consent toggle in the Privacy Center, is off until you turn it on, and is minimised / hashed before it leaves your device. We never collect a raw process list or your browsing history. What this covers:
  • Device security posture - whether the device is rooted / jailbroken, has developer mode or USB debugging on, is disk-encrypted, and its OS version. Used to warn you about a compromised device and to weight its signals. Consent key background_service.
  • Device identifier - a per-app, vendor-supplied id (on iOS, the IDFV) stored only as a SHA-256 hash, never the raw value, used to compute and remember a device's trust score. The raw id never lands at rest. Consent key background_service.
  • Network posture - the connection type, whether a VPN is active, and whether the Wi-Fi is open / unencrypted. The Wi-Fi network name (SSID) is hashed on the device first; the raw SSID never leaves the device. Consent key network_scan.
  • Network risk context (VPN, proxy or hosting network) - separate from the on-device network posture above. When you build your Personal Protection Profile, we summarise the reputation of the connection your own request arrives on into coarse flags: whether it is a VPN / proxy / Tor exit, whether it is a hosting network rather than a home connection, whether the address has recent abuse reports, a low / elevated / high band, and the country. It is used to model how easily someone else could blend in with your sessions. Using a VPN is never treated as wrongdoing - it carries the smallest weight of any factor in the model, and we sell a VPN ourselves. Your IP address is never stored: it is read in memory, reduced to those flags, and discarded. Gated by the same consent key network_scan, and if you have not granted it, no connection context is derived at all and your profile is built without it.
  • App-usage and interaction signals (Android, opt-in) - the foreground time of your top apps (package names only, never app content) to spot a remote-control app active during a scam session, plus in-app interaction events (searches, taps) for product analytics. Consent key app_usage.
  • Message / SMS threat verdicts - message text is classified for scams on the device; only the verdict (kind, category, risk score) is uploaded and the raw body is discarded after the scan. Consent keys sms / notifications.
  • Wearable stress band (opt-in only) - if you connect a wearable through Health Connect or Apple Health, your heart rate and heart-rate variability are read on the device and reduced there to a coarse band (normal, watch, or anomalous) with a strength between 0 and 1. Only that band and strength are sent to us, and only when the band is not normal. Your heart rate and HRV values never leave your device - the signal format we send physically cannot carry them. It is used for one purpose: to corroborate a scam verdict we have already raised, because a stress spike during a flagged call is evidence you are being pressured. It can only raise confidence in an existing detection - it never classifies you, and never triggers an action on its own. Two separate switches gate it, both off by default: health_data to read at all, and stress_context to send anything derived from it.
  • Step count and sleep duration (opt-in only) - today's step total and last night's minutes asleep, sent as two numbers alongside a non-normal stress band. Unlike the band, these are not coarsened, so we name them plainly as data we collect. They exist so that an elevated heart rate after exercise, or a short night's sleep, is not mistaken for duress. Same two switches, both off by default.
  • Microphone (opt-in only) - two features use it, and neither sends audio to us. In Agenda you can speak instead of typing; that speech is turned into text by your phone’s own speech recogniser, which on most phones is a Google or Apple service, so those words leave your device to that provider under their terms. The panic word listens for “help” in your language on the device and reports only whether it heard it. Vilkax never receives, records, or stores audio, and no recording is kept on the device after recognition. The permission is requested at the point of use and can be revoked in system settings.
  • Browser extension (opt-in only) - link safety is off until you switch it on. With it on, the extension sends us the address of a link you open, the hostname of a page where a wallet-drainer pattern fired, and a payment destination you paste (an IBAN or a wallet address), so each can be checked against our threat corpus. The content of the pages you visit is never sent. Page text is read and scored entirely inside your browser; only the resulting verdict and the site’s hostname leave it. If you paste a message into the extension’s own window to have it checked, that message is sent, because checking it is what you asked for. With the opt-in off, nothing is transmitted and the on-device checks still protect you.
  The purpose is protection only - never advertising or profiling. These signals are consent-gated server-side too: even if a tampered app sent a signal whose consent you hadn't granted, our intake (/api/risk/v2/signals, /api/intake/unified-signal, /api/signals/v1/*) checks your persisted consent and drops it. Signal rows are retained per region (EU 90 days / other regions 180 days) and are deleted when you delete your account (see Erasure below).
• Coarse location (country) - your country code, derived server-side from the request, used for geo-anomaly sign-in detection. No GPS, no precise location, no location permission is requested for this.
• Audit log - every state-changing action you take, with actor, target, IP, and timestamp. Hash-chained so tampering is detectable.
• Hearth journal entries (opt-in only) - when you write in Hearth, the text is AES-256-GCM encrypted at rest with a key we rotate. A redacted (no-names, no-numbers) copy lives alongside it solely so a future export gives you readable data. We never train models on your entries; the safety classifier is pattern-based and runs in code, not in an LLM.
• KIN location pings (opt-in only, per circle) - when you share live location to a trusted circle, we store latitude/longitude rounded to 6 decimals, GPS accuracy, speed, battery level, and an approximate city derived from the request. Pings live for a maximum of 24 hours, then are pruned automatically. Visibility is per-member-per-circle and respects your share settings (precise / approximate / paused) on every read.

What we do NOT collect

• We do not store the contents of your inbox, messaging apps, or files. The desktop agent reports event metadata only. If you choose to connect a mailbox to Vilkax Mail, we read your messages to check them for fraud but keep none of them - see Vilkax Mail below for exactly what is and is not retained.
• Your private keys, seed phrases, or wallet recovery material. Ever.
• Precise geolocation outside of KIN circles you explicitly opt into. Account telemetry stores country code only.
• KIN location history beyond 24 hours. Pings older than that are deleted by a daily sweep.
• Cross-site browsing behavior. We don't run trackers and fonts are self-hosted. The only third party that loads automatically on the marketing site is Cloudflare Turnstile (the captcha, needed to submit forms). An optional Spotify player on the home and Sounds pages is a third party too, but it loads only after you consent to analytics or click to load it - never on page load by default.
• Behavioral data for advertising. Vilkax has no ads business.
• Public maps of users. KIN circles are isolated by design - no discovery, no global map, no shared visibility.

Vilkax Mail (connected mailboxes)

Vilkax Mail is optional. Nothing in this section applies unless you have explicitly connected a mailbox. It is an email client built for security: it shows you your mail, checks every message for fraud, and can help you draft a reply.

What we ask for, and when

• Reading your mail (gmail.readonly / Mail.Read) - requested when you connect a mailbox. Without it we cannot check anything.
• Sending a reply (gmail.send / Mail.Send) - a separate, later request, asked only if you want AI-assisted replies. If you never want that, you never grant it, and the reply feature simply does not appear. Declining it does not affect protection.

What you actually granted is what we record - not what we asked for. If you approve reading but decline sending, Vilkax has no send capability for that mailbox.

What we keep - and what we cannot keep

Your messages are fetched from your provider, checked inside a single request, shown to you, and then gone. They are never written to our database. This is not a policy we promise to follow: our database has no field capable of holding a subject line, a sender, a message body, or an attachment.

Exactly two things are stored:

• The connection itself - your own email address, and the access tokens, encrypted. A copy of our database yields unreadable ciphertext, not your inbox.
• The verdict - a one-way hash of the message ID plus a rating ("clean", "suspicious", "dangerous"), a score, and a category label from a fixed list. This cannot be turned back into any part of your message. Verdicts are deleted after 30 days.

Commitments

• We never train on your mail. No model of ours is trained, tuned, or tested on anything from a connected mailbox.
• Your mail is never sent to a third-party AI provider. Reply drafting runs only on models inside our own processing boundary. If those are unavailable the feature falls back to a plain template - it never quietly hands your message to an outside provider instead.
• No human at Vilkax reads your mail. There is no support tool, admin screen, or debugging view that can display a connected mailbox.
• We never send mail on our own. There is no auto-reply, no rule engine and no scheduled task that can send from your address. A reply goes out only when you have read it and pressed send, and it is sent exactly as you left it.
• We will not draft a reply to a message we believe is an attack. Where the sender fails verification outright, Vilkax refuses to help you reply and tells you why.

Disconnecting

Unlinking a mailbox revokes the access at Google or Microsoft first, while we can still do so, then erases our stored tokens and every verdict for that mailbox. Where a provider offers no revocation endpoint, we say so and link you to the page where you can finish the job yourself, rather than implying it is done. Deleting your Vilkax account removes all of it regardless.

You can also revoke Vilkax's access directly at any time, without us: Google account permissions or Microsoft privacy settings.

About the people who email you

Checking your mail necessarily means processing what other people wrote to you. We rely on our legitimate interest in protecting you from fraud, and we limit the intrusion in the only way that genuinely counts: nothing about your correspondent survives the check except an unreadable hash and a rating.

Your rights

• Access - Settings → "Export my data" gives you a single JSON bundle of every record we hold for you (sessions, devices, security events, Hearth entries in redacted form, subscription history). Self-service, instant.
• Rectification - fix wrong data via the app's Settings page or through our contact form.
• Erasure - Settings → "Schedule account deletion" deactivates your account immediately: it is frozen so no one can sign in, and all your active sessions are revoked on the spot. It is then scheduled for permanent deletion after a 30-day grace window, during which you can cancel and restore it. After the window, a scheduled purge removes your account record and the personal data linked to it - including the device, network and protection signal / telemetry rows we hold against your account. Some records are removed on different timelines where the law requires us to keep them longer (for example billing and security-audit records), and anonymous, aggregate data that carries no identifier and cannot be tied back to you may be retained. If you want confirmation that a specific erasure has completed, contact our privacy team.
• Restriction - you can ask us to pause processing rather than delete, while a dispute about accuracy or lawfulness is resolved. Ask through our contact form.
• Portability - the JSON export is machine-readable for moving to another provider.
• Explanation - every automated decision (threat score, AI tier, anomaly flag, KIN ETA) is logged with its inputs. You can request the row that drove any specific call.
• Revoke at any time - pause KIN sharing globally or per-circle, revoke individual sessions or devices, disable 2FA, leave a circle, all from the Settings or Security Center page.
• Complain to a regulator - if you believe we've mishandled your data you can lodge a complaint with a supervisory authority. Our lead authority is the Lithuanian State Data Protection Inspectorate (VDAI, vdai.lrv.lt); if you are in the EU/EEA you can also complain to the data-protection authority in your country of residence. We'd appreciate the chance to put it right first - contact our privacy team.

Children and families

Vilkax is built to protect families, and that starts with how we treat younger users. Under the GDPR (Art. 8), a child can consent to an online service themselves from a national threshold age that varies between 13 and 16 across EU member states. Vilkax is established in Lithuania, where that age is 14: you can create a Vilkax account yourself if you are 14 or older. Below the age that applies to you, we ask that a parent or guardian consents to your use of Vilkax - account creation includes an explicit confirmation of exactly that, and we keep a timestamped record of it.

• KIN and children - KIN shares live location only inside a family circle that each member explicitly joined and approved. There is no public map, no discovery, and no visibility outside the circle. Sharing is consented per circle, can be set to precise or approximate, can be paused, and can be revoked at any time from Settings → KIN - and pings are deleted after 24 hours (see "KIN location pings" above).
• No advertising, ever - we do not profile children (or anyone) for ads. Data from any account is used for protection only.
• Parents and guardians - if you believe a child below the applicable consent age is using Vilkax without your consent, or you want to exercise their rights (access, erasure, pausing KIN sharing), contact our privacy team and select the privacy topic. We will verify and act promptly.

Automated decisions and profiling (EU AI Act Art. 50 & GDPR Art. 22)

Vilkax uses AI and machine-learning models to generate risk scores, anomaly flags, and threat classifications for users and their accounts. These scores may affect which features are available to you (alert priority, protective tier gates, or escalation routing). No automated decision produces a legal effect or similarly significant impact without the right to human review. Our legal basis for this profiling is Art. 6(1)(b) GDPR (performance of a contract: the core protection service you signed up for) and Art. 6(1)(f) GDPR (legitimate interest in detecting and preventing fraud and account-level threats).

Your rights regarding automated decisions: you can request an explanation of any specific risk score or automated action affecting your account through our contact form. You can also request human review of any decision you consider to have produced an unjust outcome. Every automated decision is logged with its inputs (see the "Explanation" right above).

Sensitive data, and data about other people

Some of what Vilkax handles falls into categories the GDPR treats as needing extra protection. We would rather set that out plainly than leave it implied.

• Health data - Hearth. A journal entry can describe how you feel, including your mental health, and Hearth's safety classifier looks for patterns of harm so it can surface crisis-line numbers. That is health data under Art. 9. We process it only on your explicit consent, given separately when you turn Hearth on - never bundled into accepting these policies - and you can withdraw it at any time in the Privacy Center, which stops the processing. We never train models on your entries.
• Sensitive content inside things you ask us to scan. A scam message can itself contain sensitive material - sextortion and romance-fraud attempts routinely do, and a message may reveal health, religion, politics or trade-union membership. We do not select for it, do not derive insight from it, and do not keep the content after the verdict is produced. We process it because you asked us to check that specific message for fraud, and for no other purpose.
• Verdicts about other people. Saying a message or a sender is fraudulent is an allegation about a possible criminal offence (Art. 10). We produce those verdicts to protect you, we show them only to you, we never publish them or build a public reputation list from them, and we never state that a named person is a criminal - only that a pattern matches known fraud. If a verdict about you is wrong, you can contest it and ask for human review.
• People who message you. Checking your mail or your messages necessarily means processing what someone else wrote. We rely on our legitimate interest in protecting you from fraud, and we limit the intrusion in the way that counts: nothing about your correspondent survives the check except an unreadable hash and a rating.

Your right to object

Where we rely on legitimate interest - which is the basis for checking what other people send you, and for security and abuse prevention - you have the right to object to that processing at any time, on grounds relating to your particular situation. If you object, we stop unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or that we need the processing to establish, exercise or defend legal claims. To object, use our contact form and tell us what you object to; we will answer within one month.

Changes to this policy

We update this policy when what we do changes, or when the law does. For a change that materially affects how we use your data or narrows your rights, we will tell you by email and in the app at least 30 days before it takes effect, and where the law requires your consent for the new use, we will ask for it rather than assume it. Smaller corrections take effect on publication. Every version is kept with the date it applied and a hash of its text, so you can obtain the exact version that governed you at any point.

If you are in the United States

We give US residents the same core rights we give everyone: to know what we hold, to get a copy, to correct it, and to have it deleted - all from Settings, or through our contact form. Two points specific to US law. We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in California and the other state privacy laws - we have no advertising business at all, so there is nothing to opt out of, and we honour Global Privacy Control regardless. And we do not use your data to discriminate against you in price or service for exercising any of these rights.

Who else sees your data

We do not sell your data and we have no ads business. We do share it with the service providers who help us run Vilkax - hosting, payments, transactional email, reputation lookups, and AI inference. Every one of them is named, with what it is used for and the region it operates in, on our sub-processor page, which we keep current and which is the same register our business customers get under their Data Processing Agreement. We give 30 days' notice before adding or replacing one.

We may also disclose data where the law requires it, to establish or defend legal claims, or to protect someone's vital interests - and to a successor if the business is acquired, in which case we will tell you.

Transfers outside the EEA. Some of those providers operate outside the European Economic Area - the sub-processor page marks which, and states the safeguard relied on for each (an adequacy decision, or the EU Standard Contractual Clauses). You can ask us for a copy of the safeguard for any specific provider through our contact form.

Where data lives

Account data is stored in a primary region. Edge caches hold only public, anonymous data (marketing pages, public state aggregates). Which provider holds what, and in which region, is published on our sub-processor page - the same register that forms part of our Data Processing Agreement.

Contact

Privacy questions: contact our privacy team.
To reach our data protection officer, contact us and select the privacy topic.
Security disclosures: /.well-known/security.txt

Last updated: 2026-08-29 · Version v9 (added "Network risk context (VPN, proxy or hosting network)" - that when you build a Personal Protection Profile we summarise the reputation of the connection your own request arrives on into coarse flags (VPN / proxy / Tor exit, hosting network, recent abuse reports, a low / elevated / high band, and the country), that it is used only to model how easily someone else could blend in with your sessions, that using a VPN is never treated as wrongdoing and carries the smallest weight of any factor, that your IP address is never stored, and that the same network_scan consent key gates it - without that consent no connection context is derived at all); v8 (added "Browser extension" - that link safety is off until switched on, that the content of pages you visit is never sent, and what is sent when it is on; added "Microphone" - the two features that use it, that speech dictation is transcribed by the phone’s own Google or Apple recogniser and so leaves the device to that provider, and that Vilkax never receives or stores audio; the wearable stress band and step/sleep disclosures were carrying duplicate translation keys and so rendered as unrelated text in every non-English language - they now carry their own keys and translate correctly); v7 (added "Sensitive data, and data about other people" - the Art. 9 explicit-consent basis for Hearth, how sensitive content inside scanned messages is handled, and the Art. 10 position on verdicts about other people; added "Who else sees your data" naming the recipient categories, linking the public sub-processor register and stating the transfer safeguards, replacing the earlier "available on request" wording; v6 (added the Children and families section - GDPR Art. 8 consent age, parental consent below it, KIN's circle-only consented location sharing, and the parent/guardian contact route; v5 re-based to the EU controller - Vilkaks UAB, registered in Klaipėda, Lithuania, with an operating hub in Barcelona, Spain - lead supervisory authority the Lithuanian VDAI, scoped to the EU GDPR; v4 disclosed the consent-gated Spotify embed; v3 disclosed device / network / app-usage protection signals, their consent gating, retention, and confirmed signal-data erasure on account deletion)