Effective Date: October 17, 2026 | Version: 1.0.0 (Play Store Production Release) | Jurisdiction: Republic of India & Global | Data Fiduciary: ShadowX Technologies (Operating as ShadowX Studios) | Domain: shadowxstudios.com
🇮🇳 INDIAN CITIZENS' PRIVACY PLEDGE: CyberShastraX is engineered specifically to protect Indian citizens against UPI financial fraud, Digital Arrest caller scams, and predatory loan APK spyware. We DO NOT collect, read, or upload your private SMS OTPs, bank credentials, or contacts to any cloud server or third-party broker.
This Privacy Policy governs the mobile security application CyberShastraX developed and operated by ShadowX Technologies (operating under ShadowX Studios).
CyberShastraX is designed with a focus on cyber threats prevalent in the Indian digital ecosystem. Our operations adhere to:
Under the Digital Personal Data Protection Act, 2023 of India, every user residing in India is a "Data Principal", and ShadowX Technologies serves as the "Data Fiduciary". You are entitled to the following statutory rights:
| Statutory Right (DPDP 2023) | Legal Description | How CyberShastraX Enforces It |
|---|---|---|
| Right to Access (Sec. 11) | Right to obtain a summary of personal data being processed and identities of processing entities. | You can request an instant export of any anonymized diagnostic metrics stored on device. |
| Right to Correction & Erasure (Sec. 12) | Right to correct inaccurate data and request complete erasure of personal data. | Local data can be wiped via in-app "Clear Cache". Cloud support logs can be deleted upon request. |
| Right to Withdraw Consent (Sec. 6) | Right to withdraw previously granted consent at any point without penalty. | All Android permissions (SMS, Location, Phone) can be revoked instantly via system settings. |
| Right to Grievance Redressal (Sec. 13) | Right to readily accessible grievance redressal mechanism provided by the Data Fiduciary. | Contact our designated Grievance Officer with guaranteed 24h acknowledgement and 15-day resolution. |
| Right to Nominate (Sec. 14) | Right to nominate another individual to exercise rights in event of death or incapacity. | Exercisable by submitting formal authorization to our Grievance Redressal desk. |
CyberShastraX features enterprise defensive security modules powered by high-performance on-device signature engines and hardware-backed cryptographic vaults:
RECEIVE_SMS broadcast to intercept Indian scam vectors such as fake UPI collect requests, TRAI SIM disconnection threats, electricity bill payment scams, and fake job/KBC lottery SMS.
READ_SMS to access historical message inboxes.
CallScreeningService. Phone numbers are evaluated locally without requiring sensitive READ_PHONE_STATE runtime permissions.
In compliance with Google Play Policies and DPDP Act 2023 Notice requirements, below is our detailed permission usage table:
| Android Permission | Execution Scope | Storage Location | Functional Purpose in CyberShastraX |
|---|---|---|---|
| MANAGE_EXTERNAL_STORAGE / READ_MEDIA_* | On-Device Only | Local RAM Sandbox | Core antivirus requirement to scan storage files, downloaded APKs, and attachments for trojans and spyware. |
| QUERY_ALL_PACKAGES | On-Device Only | Local RAM Sandbox | Scans installed APK hashes to detect side-loaded malware, predatory loan apps, and malicious background packages. |
| RECEIVE_SMS | On-Device Only | Volatile Memory | Evaluates incoming SMS text patterns in real time to block fake UPI collect links, TRAI SIM cutoff, and electricity bill scams. Does not read message inbox history. |
| CAMERA | User-Triggered | Temporary Display Buffer | Used strictly for Spy Camera Optical Reflection Detection (pinhole IR lens detection) and UPI QR Code safety scanning. Never records or captures background photos. |
| ACCESS_FINE_LOCATION & NEARBY_WIFI_DEVICES | User-Triggered | Volatile Memory | Required by Android OS for Wi-Fi airwave scanning to discover broadcasting hidden spy camera beacons and rogue access points. GPS coordinates are never tracked or saved. |
| ACCESS_WIFI_STATE & CHANGE_WIFI_STATE | On-Device Only | Volatile Memory | Audits Wi-Fi hotspot encryption protocols (WPA2/WPA3) and warns against open, unencrypted, or ARP-spoofed networks. |
| PACKAGE_USAGE_STATS & SYSTEM_ALERT_WINDOW | On-Device Only | Volatile Memory | Used exclusively by the Biometric App Lock feature to detect when locked applications open and present the secure PIN overlay. |
| USE_BIOMETRIC & USE_FINGERPRINT | User-Triggered | Hardware Secure Element (TEE) | Enables instant fingerprint authentication to unlock App Lock and access the local password vault. Biometrics never leave hardware TEE. |
| FOREGROUND_SERVICE & SPECIAL_USE | On-Device Only | System Service | Maintains continuous real-time antivirus file protection, App Lock foreground monitoring, and anti-theft motion alarms without OS termination. |
| POST_NOTIFICATIONS & FULL_SCREEN_INTENT | On-Device Only | Local OS | Displays real-time threat detection alerts, malware quarantine notices, and anti-theft high-decibel alarm sirens. |
| REQUEST_DELETE_PACKAGES | User-Triggered | Local OS | Invokes the system uninstaller when the user confirms malware uninstallation from Quarantine. |
CyberShastraX is committed to sustainable, ethical, privacy-preserving cybersecurity for all citizens:
Below is our formal declaration matching our Google Play Console Data Safety submission:
| Data Category | Collected? | Shared? | Security Standard | Retention Schedule |
|---|---|---|---|---|
| Installed App Hashes | Yes (Local Scan) | NO SHARE | AES-256 / TLS 1.3 | Discarded immediately after scan completes. |
| SMS Texts & Links | Yes (Local Filter) | NO SHARE | Local Memory Only | Never saved or transmitted to cloud. |
| GPS Location | Yes (SOS Only) | User Contacts Only | Encrypted Payload | Sent exclusively to designated contacts. |
| Crash Diagnostics | Yes (Anonymized) | Google Firebase | TLS 1.3 Encrypted | Retained up to 90 days for stability fixes. |
CyberShastraX integrates with select global cloud platforms to support crash reporting and advanced neural threat verification. All data sent is anonymized:
ShadowX Technologies (operating shadowxstudios.com) partners with Google AdSense to serve programmatic and contextual advertisements across our web portal. In strict accordance with Google AdSense Publisher Policies, we declare the following cookie and advertising practices:
In accordance with DPDP Act 2023 and Google Play guidelines, users have total autonomy to withdraw consent or uninstall CyberShastraX:
In compliance with Section 13 of the Digital Personal Data Protection Act, 2023 and Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, ShadowX Technologies has designated a formal Grievance Redressal Officer for Indian citizens:
Data Fiduciary Legal Entity: ShadowX Technologies (Operating as ShadowX Studios)
Grievance Office Designation: Data Protection & Grievance Redressal Desk
Official Domain: shadowxstudios.com
Official Support Email: support@shadowxstudios.com
DPDP Act Grievance Officer: grievance@shadowxstudios.com (cc: support@shadowxstudios.com)