GeDefense Mobile Privacy Policy
Privacy model
GeDefense Mobile is designed as a local-first Android security product. It does not require a VGT account and does not include advertising, analytics, profiling or third-party crash-reporting SDKs.
Security findings, policy state, package inventory, signer and permission observations, traffic analytics, scanner results, XDR events and evidence state are processed and stored on the device unless the user explicitly exports a bounded diagnostic bundle through Android's document picker.
Local VPN processing
GeDefense uses Android VpnService to create an on-device security tunnel for firewall, threat-intelligence and XDR enforcement. It is not a remote consumer VPN service and does not forward traffic to a VisionGaiaTechnology VPN server.
For local enforcement GeDefense may process destination IP addresses, DNS domain names when visible, protocol and port metadata, flow counters and Android app or UID attribution. GeDefense does not perform TLS or QUIC interception and does not decrypt application payloads.
Observed destination IPs, DNS queries, package inventory and traffic history are not uploaded to VisionGaiaTechnology.
Installed applications and permissions
GeDefense may inspect installed-application metadata, version and signing information, declared and granted permissions and security-relevant package changes for local antivirus and XDR analysis. Initial background package reconciliation is not performed on a fresh installation until setup has been explicitly completed.
GeDefense does not upload the installed-app inventory to VisionGaiaTechnology.
File scanning
When the user grants Android all-files access, GeDefense may inspect shared-storage files for local malware analysis. The scanner is read-only. It does not execute, upload, rename, delete or quarantine scanned files. Android application-private sandboxes remain outside this access.
Usage access and optional location
Usage access is used locally to improve app and traffic attribution. Optional coarse location is used only where Android network or passive last-known information is available and is not implemented as continuous background location tracking.
Device administration / TITAN
Device Administrator and Device Owner capabilities are used only when the user or managed-device operator explicitly provisions TITAN capabilities. Destructive actions are not automatic. Managed uninstall, wipe-related settings and managed trust-anchor installation require separate explicit operator actions in the product.
Threat-intelligence and geographic datasets
GeDefense downloads public security and geolocation datasets from configured upstream providers. These HTTPS requests do not append observed destination IPs, DNS history, package names or scanner findings. As with any Internet connection, the upstream server and intervening network may observe ordinary connection metadata such as the requesting public IP address.
Runtime destinations are documented in the source repository's docs/security/NETWORK-EGRESS.md.
Diagnostics
Diagnostics export is explicit and uses Android's Storage Access Framework. The aggregate-only-v1 support bundle excludes package names and app labels, IP addresses, domains, file paths, signer/APK/install hashes, packet contents, Evidence payloads and XDR incident-detail text. It contains only bounded aggregate states, counters, durations and sanitized reason codes.
GeDefense does not automatically upload a diagnostic bundle.
Retention and deletion
Local security state remains on the device until it is replaced by bounded newer state, reset through a product control where available, or removed with the app. GeDefense does not maintain a VGT cloud account containing a copy of local traffic or scanner history.
Revoking the product VPN disclosure stops VPN protection and removes the authenticated local disclosure decision. Uninstalling GeDefense removes ordinary application-local state according to Android platform behavior; application backup is disabled.
External links
The optional Support VGT screen only opens its fixed external destination after an explicit user action. Once the user leaves GeDefense, the destination service's own privacy terms apply.
Security and privacy reports
Do not place sensitive device information, packet payloads, private keys or personal files in a public issue. Use the repository's private vulnerability-reporting channel when available.
Publication
This page is the web-renderable counterpart of the canonical PRIVACY.md shipped with the source. The repository copy remains the reviewable source text for each tagged release.