What SecureOne sees, sends and keeps

Last updated October 2026 · applies to SecureOne for Android 1.0.28

The short version

Most checks run on your phone. Online checks send the smallest thing that answers the question — a link, a file's fingerprint, the start of a password hash — never the message, file or password itself.
The text of your messages and notifications is never stored and never uploaded.
Your contacts, call history and files never leave your phone.
There are no ads and no advertising or analytics code in the app. The one outside report is a crash report, and it can be switched off.
Signing out erases the scan results stored on your phone.

What stays on your phone

SecureOne reads the following on your device to scan it. None of it is uploaded unless listed in the next section.

Installed apps — names, permissions, install source, signing certificate and app code, for the app, tracker and adware checks. Trackers are matched on your phone against a signature list downloaded to it.
Device settings — screen lock, root signs, developer options, device administrators, security patch level.
Wi-Fi — the network name and its security type, when location access is granted (Android requires it to read the name).
Incoming SMS and notifications — searched in memory for links, for one-time codes while OTP guard is on, and, in a game's own notifications, for a claim that you won money; the text is then discarded. A code is never stored or sent anywhere.
Recent calls — the last 50 entries, judged and discarded; nothing about who called is saved. Only in the direct-APK version, which is no longer distributed — the Google Play version cannot read the call log at all, and Google Play is now the only way to install SecureOne. This row still applies to a direct APK installed earlier.
Calls checked while they rang — only while “Check callers as they ring” is on: the caller's number, when it rang and how many reports it had, so you can see it later under Check a number. Never a name, how long the call lasted, or whether you answered. The last 50 calls or 30 days, whichever is shorter; Check a number › Clear list, signing out, or Clear scan data deletes it. It is never uploaded or backed up.
Files you choose to scan, and new downloads — read to compute a fingerprint and to compare their real type with their name.
Deep Security Scan — your apps, what access they hold, the files of apps from outside Google Play, and network settings, read on your phone. Lists of stalkerware and malware addresses are downloaded to your phone and matched there. The report, and what the next scan compares it with, are stored encrypted; Delete on that screen, signing out, or Clear scan data removes them. A PDF you save is not encrypted, and goes where you choose.
Network check — only when you start it, for 10 minutes, through Android's VPN connection. The names of the websites this phone looks up are matched on your phone against those malware lists, and each lookup goes on to the resolver your phone was already using. Only the count, a name on a list, and a name looked up on a steady clock are kept; every other name is dropped. It sees names only, never pages or what you do on them, and nothing about it is sent to SecureOne.
Background data — with Usage access, how much each app you installed sent in the last 7 days and how long it was open. Read on your phone and never sent.

Results, alerts and your score history are stored in the app's private storage on your phone. Signing out, or Settings › Clear scan data, deletes them.

What is sent, and to whom

What	When	Sent to
Your email address, and a name if you give one	Signing in	SecureOne's server; Google (Gmail), which delivers the one-time code by email
A backup email address, if you add one	Only when you add it in the app, and when you ask for a sign-in code to go to your backups	SecureOne's server; Google (Gmail), which delivers the code to that address
A link	You scan it; it arrives by SMS; or it appears in a notification while you are signed in with “Check every link online” switched on	SecureOne's server, which asks Google Safe Browsing, VirusTotal and URLhaus (abuse.ch). Redirects are followed by the server, not your phone.
A website's domain name	You check a link	SecureOne's server, which inspects the site's certificate and asks Google Safe Browsing
App and file fingerprints (SHA-256) and app package names	A device scan, a file you scan, or a Deep Security Scan while you are signed in (for that scan, apps from outside Google Play only)	SecureOne's server, which asks VirusTotal and MalwareBazaar (abuse.ch)
A Google Play Integrity token, which says whether this phone and app pass Google's checks	A device scan or a Deep Security Scan, but not a Quick check	Google; and, while you are signed in, SecureOne's server, which asks Google to read it
Your email address	You run a breach check, and weekly for the email saved for breach alerts	XposedOrNot, directly from your phone. XposedOrNot also sees your phone's IP address.
The first 5 characters of a password's SHA-1 hash	You check a password	SecureOne's server, which asks Have I Been Pwned's Pwned Passwords range service. The comparison happens on your phone.
A phone number	Only a number Call protection has already flagged on your phone	SecureOne's server, to look up fraud reports from other users
A number you type into Check a number	Only when you ask for that number to be checked	SecureOne's server, to look up how many people have reported it. The lookup only reads the report count; the number you checked is not saved.
The number of an incoming caller	While your phone is ringing, and only while Settings › “Check callers as they ring” is switched on	SecureOne's server, to look up how many people have reported that number. Nothing else about the call is sent, no call is recorded, and the call is never blocked. The number, the time and the report count stay on your phone for 30 days (see above).
A message you write in Help & support, with the app version and phone model	You send a message in Settings › Help & support › Chat with us	SecureOne's server, where the SecureOne team reads and answers it. Card numbers and one-time codes are removed before it is saved. Messages are deleted 90 days after the last message in the conversation. The team gets an email saying you wrote, through Google (Gmail).
A fraud report: the number or link, a category and any description you type	You report fraud	SecureOne's server. Other users see only how many reports a number or link has.
A “disagree with verdict” report: the item, a fixed reason and the verdict	You send one	SecureOne's server
A fake-winnings report: the app's package name and name, a fixed reason, and whether it came from Google Play	You tap “Report fake winnings” on an app's page while signed in	SecureOne's server, with your account ID, where the SecureOne team reviews it. A report lists no app by itself. Your list of installed apps is never sent.
That the SIM in this phone changed, with the new carrier and, when the carrier publishes it, the new number	The SIM is replaced while anti-theft is on and you are signed in	SecureOne's server, which shows it on Find my phone and emails you. The phone's location is not sent - that happens only when you send a Locate command.
A push-notification token, a random device ID, the phone's model name, the app version, and when the phone signed in and last renewed its sign-in	You are signed in	SecureOne's server and Firebase Cloud Messaging, to deliver alerts and to show which phones are signed in to your account
A crash report: the error, where in the app’s code it happened, the app version, phone model and Android version	The app crashes, unless Settings › Send crash reports is off	Google Firebase Crashlytics. SecureOne attaches no account, email or anything it was checking.
Your name, email, mobile number, the plan and its price	You buy a plan on this website	SecureOne's server, and Razorpay, which processes the payment
The plan you bought in the app, and Google Play's proof of the purchase	You buy a plan in the app, through Google Play	SecureOne's server, which checks the purchase with Google and switches the plan on. Google Play takes the payment.
Card, UPI or bank details	You pay for a plan	Razorpay or Google Play only. SecureOne never receives them.
Your phone's location and battery, and whether a command worked	Only when you send Locate, Track live, Ring, Stop or Lock from “Find my phone” on this website, signed in with your email. Track live sends a location every 2 minutes (every 15 with battery saver on) until you press Stop, for at most 6 hours	SecureOne's server. Kept for 24 hours and shown only to your account.
One photo from the front camera, or one 15-second audio clip	When you press Front photo or 15-sec audio on “Find my phone”, signed in with your email, to recover a lost or stolen phone. And one photo, never audio, if you turned on Photo after wrong unlocks (off unless you switch it on; Plus and up): when someone gets the screen lock wrong 3 or 5 times in a row, at most 3 photos in one run of failures, with where the phone was if you allowed location all the time. You are emailed that it happened; the photo is not in the email. Never on a schedule. Android shows its camera indicator while it runs	SecureOne's server. Kept for 24 hours and shown only to your account. Nothing is kept on the phone.
Your location, battery, network and SIM status	Only in reply to an anti-theft command you send, or when the SIM changes	By SMS to the trusted numbers you set up. Not to SecureOne's server.

What SecureOne's server keeps

Your account — email address, optional name, and when you signed up and last signed in.
Plans and payments — your plan and its start and end dates; for each payment, the Razorpay order and payment IDs, the amount and the date, with the name and mobile number given at checkout; for a plan bought through Google Play, Google's order ID, the plan and its dates. Payment records are kept for as long as tax and accounting law requires. If you buy a plan as a gift: its code until it is used, and which account used it.
Sign-in codes — stored only as a salted hash, used once, and expire.
Recovery codes — the codes you generate under “If you lose this phone” are stored only as salted hashes. The server cannot show you a code again, which is why the app shows each set once. A code is deleted as it is used, and generating a new set deletes the old one.
Backup email addresses — up to three, with whether each one has been confirmed. They are used only to deliver a sign-in code, and you can remove one at any time.
Sessions — which device a sign-in belongs to, and whether it has been signed out.
Check results — verdicts for links, domains and fingerprints are cached for between minutes and 30 days, so the same item is not looked up again and again.
Reports — fraud, “disagree” and fake-winnings reports you send, with your account ID.

The database is Google Cloud Firestore in the asia-south1 (Mumbai) region. The server itself runs on Render.

Permissions, and why

SMS (receive, read, send) — to check links in incoming SMS, and to receive and answer anti-theft commands. Not in the Google Play version, which checks the same links through notifications instead.
Call log — for Call protection. Only the last 50 calls are read, and none are stored. Not in the Google Play version.
Camera — for the QR code scanner, where each frame is read on the phone and discarded; for one front-camera photo when you send Front photo from Find my phone; and, if you turned it on, for one photo after repeated wrong screen unlocks. Those are the only pictures SecureOne ever sends.
Microphone — only for one 15-second clip when you send 15-sec audio from Find my phone. Never otherwise.
Display over other apps — optional, for Find my phone's photo and audio. Android lets an app use the camera or microphone only while it is on screen, so SecureOne opens a blank screen for a moment to take the photo or clip. It never draws over another app.
Call screening — optional, and off until you switch it on. It lets SecureOne check a caller while the phone is ringing and warn you if other people have reported the number. Only one app on a phone can hold this, so switching it on takes it from whichever app has it now. SecureOne never blocks a call.
Location — to read the Wi-Fi network name, and to answer a LOCATE command. If you allow it “All the time”, LOCATE also works while the phone is locked; location is still read only to answer a command from your trusted number.
Usage access — optional, for Background data: how much each app sent and how long it was open. It also shows which apps you use, so SecureOne asks before you turn it on. It stays on your phone.
VPN connection — only during a network check you start, for 10 minutes. Android asks you first and shows a key icon while it runs. SecureOne takes in website name lookups and nothing else, and it can be stopped at any time.
Notification access — to find links in notifications, to warn when a one-time code arrives during a call (OTP guard), and to warn when a game claims you won money. Off until you switch it on.
Device administrator — for the anti-theft LOCK command and, if you turned on Photo after wrong unlocks, to be told that a screen unlock failed and how many have failed in a row. SecureOne never sees what was typed, and cannot wipe the phone or change its lock.

Every permission is optional. A feature that lacks its permission says so, and the rest of the app keeps working.

Your choices

Use on-device scans without an account.
Switch off “Check every link online” in the Privacy Center, so only suspicious-looking links are looked up.
Clear scan data, or sign out, to erase results on your phone.
Switch off crash reports in Settings; reports not yet sent are deleted.
Remove a backup email address, or generate a new set of recovery codes, under Settings › If you lose this phone. A new set cancels every earlier code.
Deny or revoke any permission in Android settings.

Contact

SecureOne is run by Aman Ashok Gupta, trading as AGC One, Nashik, Maharashtra, India. For privacy questions or to delete your account, write to support@agcone.in from the email your account uses; the steps, and what is deleted and kept, are on Delete your account. See also the Contact page.