Last updated 4 October 2026
SecureScan checks whether a web link is dangerous before you open it. It is published by MAHDI FOR PROGRAMMING AND INVESTMENT, a company registered in the Sultanate of Oman ("we", "us"). This page explains, in plain language, what the app and our server handle and why.
The short version. You can use SecureScan as a guest, with no account. An account is optional; it keeps your history across phones and is needed for Family. Many links are checked on your phone and never leave it. When a link needs a second opinion, its address goes to our server and to a reputation service, without anything that identifies you. We keep a record of the link and its verdict, never who checked it. We do not sell data, show ads, or include advertising or analytics trackers.
| Data | Why | Where it goes and how long |
|---|---|---|
| The link you check | To tell you whether it is dangerous | Checked on your phone first. If the phone cannot decide, the address is sent to our server, which looks it up with Google Web Risk and, if Google cannot answer, VirusTotal. Our server also asks the domain registry how old the domain is, and opens the link itself to see where it really leads and whether its certificate is valid. See "Links and verdicts we keep" below. |
| A file fingerprint (only if you use "Check a file") | To see whether the file is known malware | Only the SHA-256 fingerprint is sent, never the file. It is looked up with VirusTotal and not stored. |
| Your scan history | So you can look back at what you checked | As a guest: stored only on your phone, encrypted. Deleted when you clear it or uninstall
the app. Signed in: also stored on our server under your account, so it appears on your other phones. We keep your latest 1,000 checks. Clearing your history in the app clears it on the server too; deleting your account deletes all of it. |
| Your account (only if you create one) | To sign you in and keep your history and Family together | Your email address and the display name you choose. Sign-in codes are sent to that email by our email provider; we keep only a one-way hash of each code, for 10 minutes. If you add a passkey, we store its public key only: your Face ID, fingerprint and the private key never leave your phone. Kept until you delete your account in Settings, which removes it from our server immediately. |
| Face ID / fingerprint (only if you switch on the app lock) | To keep the app locked | Checked by your phone's operating system. We never receive biometric data. |
| Camera (only when you scan a QR code) | To read the code | Processed on your phone. No image is stored or uploaded. |
| Notifications (Android, SecureScan Pro, only if you switch it on) | To warn you about a dangerous link inside a notification from another app | Links in notifications are checked on your phone only. Nothing from your notifications is sent to us or saved in your history. |
| Your subscription | To unlock SecureScan Pro | Payment is handled entirely by Apple (App Store) or Google (Google Play). We never see your card or bank details. We may ask Apple or Google to confirm that a purchase is valid, using the purchase reference they give the app. |
When our server checks a link, it stores the address and the verdict so the next person who checks the same link gets an answer faster, and so confirmed dangerous links can be added to the list the app keeps on your phone. This record contains no information about who checked the link: no device identifier, no IP address, no account.
Our web server and application logs record the domain name at most, never the full address, so a link containing a password-reset token or an invoice number is never written to a log. Operational logs are deleted automatically after 14 days.
Family lets a parent or legal guardian supervise their own child's phone. The parent signs in with a SecureScan account; the child's phone needs no account, name, email or phone number. Before linking, the child's phone shows exactly what the parent will and will not be able to see, and the parent confirms they are the child's parent or guardian.
If you leave Help improve SecureScan switched on in Settings, the app sends a small count after each check: a random number the app made up for itself (not your device ID, not linked to anything else), which check produced the answer, the one-word result, how the link reached the app, whether the phone is an iPhone or Android, and how long the check took.
The address you checked is not in that list, and neither is its domain. Switching the setting off stops the sending and throws away the random number.
Link checkers and DNS resolvers receive only the link or website name. They never receive your name, email, device identifier, or anything else that identifies you.
SecureScan's scanner is not directed at children under 13. Family is used by a parent or guardian to supervise their own child's phone; the child's phone sends only the limited information described in the Family section above, and a parent can unlink at any time.
If you are in the EU, UK or another region with similar laws, you may ask what data we hold, and have it corrected or deleted. You can delete your account and everything stored under it yourself, in Settings → Account → Delete account, or without the app as described on Delete your account. To stop Family reporting, unlink the phones in the app; stored events expire within 30 days and locations within 24 hours, or email us to delete them sooner. For children in the EU, Family relies on the consent of the parent or guardian (GDPR Article 8). For anything else, email us.
Traffic between the app and our server is encrypted with HTTPS. Our database is not reachable from the internet. Secrets, sign-in codes and parental PINs are stored only as one-way hashes.
If we change how we handle data, we will update this page and the date at the top. Material changes will be announced in the app.
MAHDI FOR PROGRAMMING AND INVESTMENT, Sultanate of Oman.
Questions or requests about your data:
ahmdberro50@gmail.com