Vipera Privacy Policy

Last updated: 21 June 2026

Vipera ("we", "us", "the app") is a private security tool that scans files on your device for known malware. This policy describes what information Vipera accesses, what it stores on your device, what it sends to the network, and what control you have over both.

1. Account & sign-up

Vipera does not require an account, an email address, a username, or any sign-up. There is no server-side user profile tied to a Vipera install. In-app purchases (Premium tier) are processed by Google Play Billing; Vipera does not see or store your payment card, billing address, or Google account details.

2. Permissions Vipera requests, and why

Every permission above is gated by a user-facing rationale dialog before it is requested on the first scan. You can deny any of them and the app will continue to function in a reduced-capacity mode (installed-apps only, no threat heads-up). You may revoke any granted permission at any time via Android Settings → Apps → Vipera → Permissions.

3. What Vipera stores on your device

Vipera writes the following data into app-private storage (/data/data/com.vipera.security/shared_prefs/). All entries are scoped to your install; uninstalling the app erases them.

• Scan history — last scan timestamp, files scanned count, threats found count, threat files (name, location, severity, classification). Local-only.
• Onboarding completion flag — is_onboarding_completed boolean.
• Protection toggles — protection_app_shield, protection_file_guard, auto_scan_enabled, auto_scan_interval_ms, first_scan_gate_completed, battery_ask_completed, all_files_access_enabled. Local-only.
• Subscription state cache — a non-personalized marker that the in-app Premium state machine reads; sourced from Google Play Billing receipts that Google verifies for you.

We do not store your name, email, phone number, contacts list, location history, photo library contents, or any identifier cross-linkable to you across apps.

4. What Vipera sends over the network

When you start a scan, Vipera performs three categories of outbound calls. None of them include file contents; what they include is described below.

4a. Multi-cloud hash lookups (every interesting file)

For each file flagged by the local signature database, YARA rules, or the heuristic analyzer, Vipera submits the file's MD5 + SHA-256 cryptographic hashes (and only those hashes) to the bundled threat-intelligence providers:

• VirusTotal
• AlienVault OTX
• AbuseIPDB
• ThreatFox
• Google Safe Browsing
• Koodous

API keys for these providers ship inside the Vipera APK as constants; the user does not enter or configure them. If you do not want these calls to fire, revoke all-files access in Android Settings and the in-app reduced-capacity mode will skip them entirely.

4b. OpenCode Zen post-scan verification

After a scan completes, Vipera sends each locally-flagged threat to the bundled OpenCode Zen verification endpoint for a second-opinion classification. Each request contains:

• The threat's absolute file path.
• A short list of strings extracted from a small (≤8 KB) header window of the file (only when needed for disambiguation).
• A numeric "feature vector" derived locally (entropy, printable ratio, suspicious-string count, surface-detected permissions).

The file's full contents are not uploaded. The OpenCode Zen API endpoint URL is shipped as a literal constant in the APK and its data-residency terms follow Zen's own posted policy.

4c. Aggregated analytics

Vipera does not include any analytics or crash-reporting SDK. We do not send:

• Crash logs to Firebase Crashlytics or any third party.
• Usage events to Amplitude, Mixpanel, Segment, etc.
• Advertising IDs to any ad network.

If a future build adds telemetry, we will update this policy before that build ships and surface the change in the next release notes.

5. Children's data

Vipera is not directed at children under the age of 13. We do not knowingly collect personal information from children. The Play Store listing should reflect an age rating that disqualifies the children's category for your target markets.

6. International transfers

The bundled cloud providers listed in §4a operate servers in the United States and the European Union. If you are located outside those regions, the hash metadata you trigger by scanning a file is transferred to one of those jurisdictions for the duration of the lookup. The OpenCode Zen verifier may operate in additional jurisdictions; check Zen's own policy for details.

7. Data retention

• All on-device data (see §3) is retained until you uninstall Vipera, clear the app's storage in Android Settings, or wipe your device. There is no Vipera-side retention timer that deletes data on its own.
• The cloud providers in §4a return one-shot lookups; we do not store your scanned hashes anywhere on our infrastructure after the response.
• The OpenCode Zen verification result per threat is returned to your device only and is not cached server-side beyond what Zen's own configuration dictates.

8. Your controls

You can at any time:

• Revoke any permission in Android Settings → Apps → Vipera → Permissions.
• Clear Vipera's local storage (erasing scan history and toggles) in Android Settings → Apps → Vipera → Storage → Clear storage.
• Uninstall Vipera to permanently delete every piece of data tied to this install.
• Disable auto-scan and File Guard under Vipera → Settings → Auto Scan / File Guard.
• Disable App Shield under Vipera → home screen → App Shield toggle.

Vipera has no remote admin console, so there is no server-side data to delete; clearing on-device storage is sufficient.

9. Open-source components

Vipera links against the following third-party libraries:

• AndroidX (Apache 2.0)
• Google Material Components (Apache 2.0)
• Kotlin / kotlinx-coroutines (Apache 2.0)
• Square Retrofit, OkHttp, Gson (Apache 2.0)
• TensorFlow Lite (Apache 2.0)
• Google Play Billing (com.android.billingclient) (Apache 2.0)

These libraries have their own licenses and privacy practices; consult their respective projects for details.

10. Changes to this policy

When we make material changes to this policy we'll:

1. Update the "Last updated" date at the top.
2. Surface a one-line summary of the change in the Vipera release notes.
3. Where the change affects what data leaves the device, surface a Vipera in-app banner the first time you launch the new version.

11. Contact us

If you have questions about this policy or want to request an explanation of any data flow, contact us at:

We aim to respond to privacy-related requests within 30 days.

Vipera is a product of vipera.security. This document is hosted publicly on Netlify at https://vipera-antivirus.netlify.app/privacy.html.