Privacy Policy

The short version

• Scan results stay on your computer. We never receive the contents of your phone — no messages, photos, contacts, call logs, or app lists — and not what a scan found.
• This website sets no cookies and uses no third-party analytics. No consent banner, because there is nothing to consent to.
• We do not store your IP address.
• Some features do contact outside services. They are listed below, with what offline mode does and does not switch off.

What this website collects

We count page views so we can tell which guides are worth writing. The counter runs on our own server — no Google Analytics, no third-party script, no cookie, no fingerprint. For each page view we store the date and time, the page path, the referring website's domain name, and a coarse browser, operating system and device type such as “Chrome / macOS / desktop”.

We deliberately do not store your IP address. It is held in memory only long enough to rate-limit abuse, and is never written to disk. Referring URLs are reduced to a bare domain before storage, so if you arrive from a search engine, the words you searched for never reach us. Query strings are stripped from page paths for the same reason.

These records cannot reasonably be traced back to an individual, and we do not attempt to do so.

What the app sends, and when

Haris Shield analyses your phone on your own computer. The analysis itself is local, and the phone's contents never leave the computer. The app does make these connections:

• Licence and scan count. The app sends your licence key and a computer ID — a short hash derived from the computer's name, user name and hardware — to our server to check your licence and balance. After each scan it reports that a scan ran: iOS or Android, the number of findings, a random scan ID and the time. Not what was found.
• Connecting a computer. When you connect a computer to your licence, its computer ID and name are sent so the confirmation email can show which computer is asking.
• Threat indicators and updates. The app downloads a signed bundle of spyware indicators from our server — nothing about you is sent with it — and checks for updates, sending your licence key so the update can be released to you.
• Component verification. During a full iPhone scan, the phone's serial number is sent to Apple to look up the model and warranty status.
• Certificate check on Android. During an Android scan, your computer briefly connects to some of the servers the phone is connected to, to inspect their certificates. Those servers see your computer's IP address.
• Connection geolocation. In the live network monitor, the app looks up where the IP addresses your phone talks to are located using ipinfo.io. Those IP addresses — belonging to the servers your phone talked to, not to you — leave your computer.
• Breach check. If you use the optional breach feature, the email address you enter is sent to Have I Been Pwned to check whether it appears in known data breaches.
• Error reports, if you allow them. Off by default. If you tick the box, the app sends a fixed set of technical fields when something fails — app version, operating system, which step failed and the error code — and never error messages, file paths, phone details, findings, your licence key or your email. They are stored on our own server.

Offline mode in the app's settings stops the indicator download, the IP geolocation lookups and the breach check. It does not stop the licence and balance check, update checks, component verification or the Android certificate check. For a scan with no connection at all, disconnect the computer from the internet: once the app has been online, it can scan for up to 14 days on its last signed balance proof. If you are in a sensitive situation, do that.

Every connection, with the exact host names, is listed on How it works, together with tools you can use to watch the app's traffic yourself.

If you buy a licence

Payments are handled by Lemon Squeezy, which acts as the merchant of record. They collect your name, email address, payment details and the country used for tax purposes. We never see your card number. Their privacy policy governs that data. Older licence keys that do not start with HRS- were issued by Lemon Squeezy, and the app activates and checks those with their licence service, sending the key and the computer ID.

We store your email address and licence key on our own server so the app can confirm your licence is valid, together with the computers connected to it (computer ID and name) and a record of each scan (iOS or Android, number of findings, time). That is the personal data we hold. Ask us to delete it and we will, though doing so ends the licence.

Repeated failed activations

To stop licence keys being brute-forced, the app reports an anonymous installation identifier when a device has failed activation too many times. It identifies an installation, not a person, and is not linked to your scans.

Your rights

If you are in the EU or UK, you have the right to access, correct, export or delete the personal data we hold about you, and to complain to your national data protection authority. In practice that is your email address, licence key, connected computers and scan records. Write to support@harisshield.com and we will act within 30 days.

Changes

If we change what we collect, we will change this page and update the date at the top. See also our Terms of Service and who we are.