Last updated: 22 September 2026
CYBER3 ("the app") is a mobile and desktop security application — anti-scam protection, threat checks and mobile security. We are built around a simple principle: your data stays on your device. This policy explains exactly what limited information the app processes, and what leaves your device.
If — and only if — you choose to use the data-breach check or digital-footprint features, the app sends the email address you type to our servers over an encrypted (HTTPS) connection, to look up whether it appears in known data breaches. This is optional, used only for that feature, and is not shared with third parties for their own purposes. You can request deletion at any time (see "Your data & deletion" below).
Checks happen on your device first. When the app needs to confirm whether something is a known threat, it uses k-anonymity — it never sends the actual item you checked:
To warn you about scams in real time, the app can read incoming notifications and screen incoming calls. This analysis happens entirely on your device; notification and message content and phone numbers are not uploaded. If a link is found inside a message, only the 4-character hash prefix described above is checked. You enable these features manually in Settings and can revoke them at any time.
The phone/computer security scan reads device security settings and installed applications locally to compute a security score and find risks. Results stay on your device. Nothing from the scan is uploaded to us.
If you tap "Report", the app sends only the single indicator you chose to report (for example a suspicious domain, URL or number) plus an approximate country derived from your IP, so our analysts can improve protection for everyone. No personal information is attached.
All data in transit is encrypted (HTTPS/TLS).
No account. The iPhone app works without an account, name or login. The app creates a random identifier on your device; it is not linked to your identity, your Apple Account or your advertising identifier.
Subscriptions on iPhone are sold by Apple through the App Store. We never see your payment details. To activate your plan, the app sends our server the transaction signed by Apple; we store the product, its expiry date and the random app identifier. You manage or cancel the subscription in Settings › Apple Account › Subscriptions.
Web Protection (free) is a DNS filter that runs on your iPhone inside the app's network extension. Only the names of the sites your apps look up are checked, on the device, against a tracker list and our threat database. Your traffic does not pass through CYBER3 servers. Names that are not blocked are resolved by a public DNS resolver (Cloudflare 1.1.1.1, with Google 8.8.8.8 as fallback), which sees your IP address and the name looked up, like any DNS resolver. When a name matches our threat database locally, only the first 4 characters of its cryptographic hash are sent to our edge to confirm (k-anonymity), without any user identifier. The blocked-request counter and the "What I blocked" history (last 200 entries per category) are stored only on your device and can be cleared there.
CYBER3 VPN. When you turn on the VPN, your traffic is sent through an encrypted WireGuard tunnel to CYBER3 servers (Germany, Finland, USA, Singapore). To run the service we keep only: the random app identifier, the VPN server and the start time of your current session, and — on the free plan — the amount of data used today (for the 400 MB daily limit). We do not log the sites you visit, your DNS queries or the content of your traffic. We do not sell, use or disclose to third parties any data from your VPN or Web Protection traffic, for any purpose.
Server speed on the globe. While the server globe is on screen, the app briefly measures the speed of each VPN location against public test servers (Hetzner) and our edge. Those servers see your IP address, as any web server does. Nothing is stored.
Scam Shield Pro. Screenshots you choose are read on your iPhone (on-device text recognition); the image never leaves the device. The camera is used only to scan a QR code, on the device; frames are not stored or sent. To show where a shortened link leads, the app asks the link-shortening service (for example bit.ly) for the redirect target — that service sees your IP address, as if you had opened the short link; the destination page is never opened.
Data Removal (GDPR). Your name, email and, if you add them, phone and postal address are stored only on your iPhone. Erasure requests are sent from your own email app directly to each company; CYBER3 does not receive them. The company contact list comes from the open datarequests.org database (CC0).
Breach Report and breach monitoring. The email addresses you choose to monitor are sent to our edge only to look them up in known data breaches and are kept on your device for the periodic re-check. The exposure score and the action plan are calculated on your iPhone.
Call and message protection. The list of known scam numbers is stored on your iPhone and used by iOS (Call Blocking & Identification). SMS from unknown senders are classified on the device by the message-filter extension; the messages are not sent to us.
Anonymous usage statistics. The app sends our own, first-party, anonymous events (for example "screen opened"), without message content, contacts or browsing data, tied only to the random app identifier. We use no third-party analytics or advertising SDKs and we do not track you across apps or websites.
Premium subscriptions are sold through Apple In-App Purchase (for the iPhone app installed from the App Store), through Google Play Billing (for the app installed from the Google Play Store) or through our authorized reseller and Merchant of Record, Paddle (Paddle.com Market Ltd) for other distribution. The respective processor handles billing, taxes and card details under its own privacy policy. We never receive or store your full card details. We receive only the limited information needed to activate and support your subscription (such as purchase status). See Paddle's Privacy Policy and Google's Privacy Policy and Apple's Privacy Policy.
Because the app has no account, there is very little data to delete. If you used the breach/footprint check and want the associated email removed from our systems, email [email protected] and we will delete it. You can also disable any permission (notifications, calls, VPN) at any time from your device settings.
The app is intended for adults (18+) and is not directed to children. We do not knowingly collect data from children.
We may update this policy; the "last updated" date will change accordingly.
Questions about privacy or data deletion: [email protected]
ROL PORTAL SERVICES SRL · CUI RO36837313 · cyber3.app
CYBER3 — Anti-scam protection & mobile security.