Privacy Policy for NetGuard AI
Last Updated: July 2026

1. INTRODUCTION
NetGuard AI ("we," "our," or "us") operates the NetGuard AI mobile application (the "App"). We are fully committed to protecting your privacy boundaries. This Privacy Policy describes how we handle device data, permissions, and networking data within the App.

2. DATA TRANSPARENCY & ZERO-LOGS ASSURANCE
NetGuard AI is engineered as a privacy-first local area network utility. We operate under a strict ZERO-LOGGING constraint:
- We DO NOT collect, store, record, or upload your personal data.
- We DO NOT monitor, inspect, or log your internet traffic payload.
- All operations, scanning scripts, and automated checks run locally on your physical smartphone hardware.

3. SENSITIVE AND HIGH-RISK PERMISSIONS DATA RATIONALE

A. LOCATION PERMISSION (ACCESS_FINE_LOCATION & ACCESS_COARSE_LOCATION)
In alignment with modern Android operating system framework specifications, access to your local Wi-Fi infrastructure metadata (including the Service Set Identifier or SSID) is strictly gated behind local location access privileges. NetGuard AI requests this permission solely to read your active Wi-Fi subnet boundaries. We NEVER read, parse, track, or share your physical GPS coordinates or geographic layout positions.

B. NEARBY WI-FI DEVICES PERMISSION (NEARBY_WIFI_DEVICES)
This hardware-level token is utilized strictly during our Network Scanner routine loops to discover hosting devices, workstations, and local router nodes within your wireless spectrum without querying real-world physical location maps.

C. SYSTEM PUSH ALERTS (POST_NOTIFICATIONS)
Required exclusively by our Automated Background Guard (WorkManager engine) to instantly trigger high-priority drop banner alerts on your lock screen if an unverified IP hidden lens hardware node infiltrates your local subnet space.

4. CORE SERVICE DECLARATION: VPNSERVICE USAGE
NetGuard AI utilizes the native Android 'VpnService' core class to construct a local, secure loopback split-tunneling architecture. 
- PURPOSE: This framework is required solely to intercept local network DNS resolution query payloads (Port 53) and forward them directly to secure, encrypted public DNS resolvers (such as Cloudflare 1.1.1.1 and Google Public DNS 8.8.8.8).
- SECURITY BOUNDARY: We do not operate a remote VPN server infrastructure. No user internet data traffic is redirected outside your device via our application. Our local tunnel cannot decrypt, modify, or trade your network traffic payload.

5. THIRD-PARTY DATA HANDLING
The App does not sell, lease, or trade any metadata or hardware profiles to marketing companies, brokers, or external cloud databases. 

6. CONTACT US
If you have any questions or compliance inquiries regarding our architectural privacy rules, please contact us via our developer channel.