Privacy Policy

Last updated: October 6, 2026

SecRAD ("the app") is a security app that blocks phishing and malware sites. This policy explains what data the app processes — and what it does not.

In short

• The sites you visit and your traffic are never sent to SecRAD's servers; filtering happens on your device.
• No account; no name, e-mail, phone number or location is collected.
• Our servers distribute the signed threat list; the one exception is a live check of the destination domain of a QR code you scan (Pro).
• No ads, no data sales, no third-party tracking SDKs.

Data that stays on your device

Blocked-site records (domain, category, time), check counts, your allowlist and settings are stored on your device, deleted automatically after 60 days, and never sent to us. Deleting the app deletes them.

Data sent to our server

Threat list updates: to download the list, the app proves it is a genuine SecRAD copy via Apple's App Attest and receives a short-lived access token. The token does not identify you; for verification, the public key Apple generates for this copy of the app is stored on the server and is not linked to any other information. The full list is downloaded every few hours and a small add-on list of the newest threats about every 15 minutes. So that the lists stay current even if you never open the app, the VPN extension fetches them itself with a token the app hands it, which can download the threat lists and nothing else. The server keeps daily request totals (day, platform, request type); IP addresses are not stored.

False-positive reports: when you tap "Report a false positive", only the domain, category, platform and app version are sent.

Anonymous statistics (optional, off by default): if enabled in Settings, once a day the previous day's total blocked and checked counts are sent. No domains, device or user identifiers.

Pro subscription verification: when you buy Pro, the App Store's signed transaction is sent to our server and verified with Apple. The server does not store it; it only issues a short-lived token stating the subscription is valid.

About the VPN profile

SecRAD sets up a local VPN using Network Extension on iOS and VpnService on Android. It does not route your traffic to SecRAD or to any remote VPN server; filtering happens inside your device. In the free mode only DNS queries pass through the app; in Pro full-protection mode the destination domain of connections is also checked on-device and connections are relayed from the device directly to their original destination. Content is never read, decrypted or stored.

DNS queries that are not blocked are forwarded unchanged to public DNS resolvers (Cloudflare 1.1.1.1, Google Public DNS 8.8.8.8) so they can be answered; while protection is on, these replace your device's usual DNS server. SecRAD does not receive or store these queries and adds no identifiers to them; the resolvers' own privacy policies apply. In Settings → DNS server you can choose Cloudflare, Google, Quad9 or a DNS-over-HTTPS server of your own (for example your NextDNS profile) instead; allowed queries then go there, and if that server does not answer SecRAD falls back to Cloudflare/Google so you stay online.

Fallback route to our own server: if your device's DNS (for example a DNS profile that blocks newly registered domains) does not resolve intel.secrad.app, the app looks up only that one name's IP address over encrypted DNS at Cloudflare (1.1.1.1) or Google (8.8.8.8) and connects to our server directly with the same certificate checks. No other names are looked up this way. When such a block is noticed, Settings shows a hint; this is kept on your device only.

QR code scanning (Pro)

The QR scanner uses the camera only while you have it open; frames are decoded on the device and never stored or sent. Images you pick from Photos or share to SecRAD are also processed on the device only. If a code contains a link, your device follows its redirects without loading any page content (up to 5 steps, no cookies) to reveal the real destination; these requests go only to the link's own servers. If the on-device checks are inconclusive, only the final destination's domain name (e.g. example.com — never the path, parameters or full link) is sent to our server, which checks it live with a threat-reputation service (including domains that appeared in the last 24 hours) and returns the verdict. The domain is not stored, not logged and not linked to you; the answer for a given domain is cached for at most an hour. Addresses already on the threat list are never contacted. Codes judged dangerous are written only to the on-device history.

Safari extension (iOS)

When you turn it on in Safari settings, the extension compares the address of each page Safari opens with the signed lists on your device (the domain list and the address-level list) and shows a warning page instead of a dangerous one. The comparison happens entirely on the device: addresses are never sent to any server and never stored; only the domain, category and time of blocked pages are written to the on-device history. The extension does not read or change page content.

Browser extension (Chrome, Edge, Firefox)

The extension downloads the signed threat lists from intel.secrad.app and compares the address of each page about to open with them inside your browser. Addresses are never sent to any server and never stored. To download, the extension obtains an anonymous read key that is generated at random and cannot be linked to you; the server only sees that the list files were requested. Settings, your allowlist and the domain, category and time of blocked pages are kept only in your browser (60 days). If intel.secrad.app cannot be reached (for example because your DNS service blocks it), the extension uses the same server's second address on Cloudflare's workers.dev. The extension does not read page content and contains no analytics or advertising code.

Banking and government sites

Online banking and card payment (3-D Secure) pages are never inspected; requests pass through as-is. Government sites (e.g. *.gov, *.gov.tr) are blocked only when the on-device threat list has a verified high-risk entry for them (a safeguard against compromised public sites). Visits to these sites are never counted and not even written to the on-device history. The list can be extended with signed updates without an app update; look-alike fake addresses stay protected.

Third parties

No data is sold or shared for advertising, analytics or tracking. Providers used to operate the service: Cloudflare (server and list distribution), Apple (App Attest, App Store), Cloudflare 1.1.1.1 and Google Public DNS (by default answering DNS queries that are not blocked, and when needed looking up only our own server's address; Quad9 or your own DNS server if you choose one in Settings), Spamhaus (domain reputation for the Pro QR check only; our server asks, your IP address or identity is never passed on). The threat list is compiled from public and licensed security sources; the list sources never see your data.

Children

The app is rated 4+ and does not knowingly collect data from children.

Your rights and contact

Because no data attributable to you is kept on the server, access/deletion requests concern data on your device — deleting the app suffices. Questions: privacy@secrad.app.

Changes

When this policy changes the date is updated and material changes are announced in the app.