Privacy Policy

1. Who we are

Parakh (with its AI assistant, Officer MAGI) is a personal digital-safety app — part of the MagenSec platform — published by XenoCraft Labs Pvt. Ltd. (Hyderabad, India). This policy explains what data Parakh collects, why, who it’s shared with, and your choices. It is separate from the MagenSec enterprise products.

Contact: support@magensec.app

2. What we collect and why

a. On-device protection the first check stays on your device

Parakh first checks links, message text, selected pictures and QR codes on your device. Picture pixels are read on-device and are not uploaded. Optional local history stores only the URL and its safety score on your device (never page content or cookies) and you can clear it anytime. A separate cloud message check is optional and described below.

b. Cloud analysis on once you sign in · you can switch it off

Cloud checking is on by default once you sign in. For higher-risk or shortened links Parakh sends the link (or a one-way hash of it) to our servers for a second-opinion verdict, checked against reputable safe-browsing and threat-intelligence sources. A shortened link can be followed on our servers, so the scam site sees MagenSec rather than your device or IP. “Protected Preview” is different: it shows a risky page inside Parakh’s own isolated browser view on your phone and clears that session when you leave. These are lookups that return only a safety verdict — we don’t use them to profile you, and we don’t sell them.

Cloud message check is separate and requires your choice. When you ask MAGI to check a message and accept its consent sheet, the message text is sent to our server for automated analysis. Before sending, Parakh replaces detected web URLs in the text with [link]. Up to five destination hostnames and the sender label or number may also be sent. To see what the riskiest link in the message would ask of you, Parakh also sends that one link as written, including anything after ?, and our servers open it so the page never loads on your phone. The scan result is stored against a one-way hash of the address without its query. The request includes your device ID and sign-in session to authorise and rate-limit the check; the screenshot is not uploaded. For supported Indian languages, an automated translation may be used by Cloudflare Workers AI to help judge the message. The raw message and translation are not retained as text. If a message is judged to be a scam, a similarity vector may be kept for up to 180 days from first sighting; the campaign memory is stored without your device or account ID. Safe messages are not stored in that memory. A human sees message text only if you separately submit it in a report.

What a link check never sends. Apart from the message page read above, before a link leaves the phone it is reduced to its canonical form: the query string, the fragment and any username or password are stripped, and links whose path identifies a person or a session — password resets, sign-in and verification links, invitations, payment and checkout pages, and chat links such as wa.me/<number> — are refused, not sent. Stored addresses are encrypted and expire automatically.

Turning it off. Open Parakh → Settings → Cloud Intelligence and switch it off. On-device checking continues to work, and the app tells you on the home screen which of the two modes is running. If you switch it off, it stays off — an update will not turn it back on.

c. Account (optional — needed for MAGI's Cloud AI, Circles, Family Guardian and purchases)

If you sign in (with Google, or another sign-in provider we support), we receive your email address and basic profile (name, profile photo). We use it to run your account, your shared Circle, and billing. You can use free on-device protection without an account.

d. Device & diagnostic data

To deliver protection, licensing and aggregate statistics, the app periodically sends a minimal heartbeat: a device identifier (a random id, or a hash derived from your account — not your phone number or advertising ID), app version, device model, OS version, coarse region/country, and which protections are enabled (e.g. default browser, Secure DNS, cloud protection). We publish only aggregate, anonymised figures (e.g. “links checked”) on our public dashboard.

e. Family Guardian (opt-in)

If you use Family Guardian, we store the link between a guardian and the person they watch over (established with a pairing code) and send a scam alert when a watched device hits a serious threat. This is designed for adults looking after family; it is not covert monitoring.

f. Suspicious-link reports

When you report a link, we receive the URL and anything you paste in (e.g. the scam SMS text and an optional reason). Our team reviews it to improve protection for everyone. Reports are deleted 30 days after we reach a verdict.

g. Billing

What we collect depends on where you buy. Inside the app, Google Play takes the payment and is the seller of record — we are told that a purchase happened, not your name, address or card. On this website we invoice you ourselves, so we collect your name and, for a GST tax invoice, your billing state and (for a business) your GSTIN. Website payments are processed by PayU (India) or PayPal (international); Parakh does not receive or store your full card details.

h. Support access to a Circle

Our staff can open a Circle’s own console to help the person who runs it — to build a training course they asked us for, or to see the screen they are describing. We are treated as a co-admin, never an owner: we cannot transfer a Circle, delete it, or close an account. No membership is created, so we never appear on your Team page, in your invites, or in your seat count.

Every one of these visits is recorded — who looked, which Circle, what they did, and when — including visits where nothing was changed. Ask us at support@magensec.app and we will tell you whether anyone at MagenSec has opened your Circle, and why.

i. Business enquiries

If you ask about Work Circle, from the app or the form on our business page, we receive what you type: your name, company, email, an optional phone number and team size, and your message, plus the country your request came from. It goes straight to the MagenSec support inbox so a person can reply. Parakh does not keep a copy in its database, and we use it only to answer you. The website form uses Cloudflare Turnstile to tell people from bots; it checks your browser, not who you are.

3. How your data is shared

We do not sell your personal data and we don’t use it for advertising. We share data only with the service providers needed to run Parakh, under contract, grouped by what they do:

• Cloud hosting & storage — running our backend and storing your account and Circle data.
• Sign-in providers — only when you choose to sign in (e.g. Google; other providers where offered).
• Safe-browsing & threat-intelligence sources — for cloud link checks: we send only the link or a one-way hash to get back a safety verdict.
• Payment processors — PayU (India) and PayPal (international) handle your payment; we never receive or store your full card details.
• Email delivery — sending your receipts and account emails, and passing a business enquiry to our support inbox.
• Bot protection — Cloudflare Turnstile, only on the website enquiry form.

Access by our support team

A small number of authorised staff may access your account information — your profile, devices, Circles and licences — only when needed to provide support, resolve a problem, or keep the service secure. This access is limited to what’s necessary and is logged, and these support views are read-only. Staff do not read your on-device link history or the content of pages you preview — that stays on your device.

We may disclose data if required by law, or to protect users’ safety and our rights.

4. Retention

• On-device data (history, settings) stays on your device until you clear it or uninstall.
• Suspicious-link reports: deleted 30 days after review.
• Business enquiries: not stored by Parakh; they are held only in our support inbox.
• Cloud verdicts are cached with a limited time-to-live and then expire.
• Sessions expire automatically; account and billing records are kept as long as your account is active or as required for tax/legal reasons.

5. Your choices & rights

• Use core protection without an account.
• Turn cloud protection and Family Guardian on or off in Settings.
• Clear local history in the app at any time.
• Request access to, correction of, or deletion of your account data by emailing support@magensec.app. Deleting your account removes your account-scoped data (subject to legal/tax retention).

6. Children

Parakh is a general-audience safety app and is not directed at children under 13. Family Guardian is intended for adults looking after family members.

7. Changes

We’ll update this page when our practices change and revise the “Last updated” date above.

8. Data Safety summary

A plain-language map of the data types above, for reference and for the app-store Data Safety disclosure.

Data is encrypted in transit. We don’t sell data or use it for advertising.