Privacy Policy for SafeState
Last updated: 13 November 2026
SafeState (Android package: com.azg.safestate) is developed and provided by Aisha Hamid Mohamed, the developer identified in its Google Play listing. This policy covers the SafeState Android app and its account, online threat-checking, and Remote Lock services.
Privacy contact: azggroup.co@gmail.com. Use this address for privacy questions and requests to access, correct, or delete your account and associated data.
Information we access and why
- Accounts: signing up or logging in sends your email, password, and device identifier (Android ID or a generated installation identifier) to the SafeState account server. The server stores your email, a salted password hash, a hash of the device identifier, and account/trial timestamps to authenticate you, link the account to a device, and manage trial access. Account email and access status are also stored on your device.
- App protection: installed app names and package identifiers, selected protected apps, PIN credentials, failed unlock counts, settings, security events, risk scores, and lockdown/recovery state are processed or stored locally to provide app locks, warnings, and protection controls.
- Accessibility: when enabled, SafeState accesses foreground-app/window events and relevant on-screen text or web addresses to identify protected apps, check risky links locally, and support protection shortcuts. This accessibility processing takes place on your device; this feature does not upload window content or detected addresses to SafeState servers. Separate online link inspection is described below.
- Remote Lock: when enabled, your chosen remote device name/key, device identifier and name, credential-verification values, remote commands, command results, and timestamps are exchanged with the configured Remote Lock server. Lost-phone messages, contact details, and return addresses submitted through the recovery website are transmitted to your phone and may be visible to anyone holding it. These records enable verified recovery actions and status reporting.
- Location: with permission, a verified Remote Lock location request obtains an available current or last-known location and sends latitude, longitude, accuracy, location time, and device/verification information to the configured server. This can occur while the app is not open when Remote Lock monitoring and the required background permission are enabled. The recovery website displays the reported location to a person who supplies the required recovery credentials.
- Online security checks: online link inspection sends the URL being checked to the SafeState threat-checking server. URLs can contain personal information in their paths or queries. When configured on the server, Google Safe Browsing also receives the URL to check for threats. Malware checks send SHA-256 file fingerprints to the SafeState server; the hash-check feature does not upload file contents.
- Other device tools: when used and allowed by Android, file scanning/recovery tools access selected or accessible files and metadata, Wi-Fi tools inspect available network information, and local vault tools store entries you choose to save. These features use this information to provide the requested tools.
- Subscriptions: Google Play processes purchases. SafeState receives purchase/product identifiers, purchase tokens, and subscription status and stores access information locally to enable paid features. SafeState does not receive your full payment-card details.
Permissions and device controls
Accessibility and installed-app visibility support app protection and local security checks. Usage access supports device/app activity checks. Notifications and foreground services support visible alerts and monitoring; boot access restores enabled protection. Location permissions support the location features above. Review and revoke permissions in Android settings.
The Wi-Fi Restriction/firewall feature uses Android's VPN interface locally to block traffic from apps you select. It is not a remote VPN tunnel and does not send intercepted traffic to a SafeState VPN server.
Device administrator access enables screen locking. On supported managed devices, a separately confirmed remote factory-reset action can erase the device.
Sharing and service providers
SafeState uses its hosted server on Render for accounts, Remote Lock, and online threat checks, and Google Play for billing. Google Safe Browsing may process checked URLs as described above. Hosting and network providers process connection information such as IP addresses and request metadata to deliver services. The SafeState website is hosted through OpenAI Sites and its hosting infrastructure; visits also involve ordinary website connection information.
We do not sell your personal data or use it for advertising. We may disclose information where necessary to comply with applicable legal obligations or protect users and the service. If you configure a different Remote Lock or threat-check endpoint, its operator receives the information sent to it; review that operator's privacy practices. Opening a location in Google Maps sends the selected coordinates to Google Maps.
Storage, security, and retention
Core app-lock and risk history stays on your device. Credentials and certain settings use Android-backed encrypted storage; server account passwords are stored as salted hashes. Default hosted endpoints use HTTPS. No storage or transmission method guarantees absolute security. Keep account and recovery credentials private.
Local app data remains until removed through the relevant app control, Android's Clear storage function, or uninstalling. Exported files remain where you saved them. Server account records remain until deletion is requested and processed. Remote recovery records, including the latest reported location and command results, can remain after monitoring is disabled. Disabling monitoring or uninstalling does not delete server records. The current service does not automatically expire all these records after a fixed period.
Your choices and deletion requests
You can turn off Remote Lock monitoring, stop the firewall, change protected apps, and revoke optional permissions. Features requiring a revoked permission will stop working or become limited.
To request deletion of your SafeState account and associated server data, email azggroup.co@gmail.com with the subject "SafeState account/data deletion". Identify your account email and, if applicable, your Remote Device Name so the relevant records can be located. Do not send your password, PIN, Remote Lock Code, or Backup ID. We may ask for proportionate ownership verification before deleting records. You can also request deletion of Remote Lock data without deleting your account. We will explain any information that must be retained for a legal obligation and the applicable retention period when handling your request.
Clearing app data or uninstalling does not cancel a Google Play subscription. Manage or cancel it through Google Play. Google and other providers retain their own records under their respective privacy policies.
Policy updates and contact
We will publish changes to this policy with an updated date. For privacy questions, access/correction requests, or deletion requests, contact Aisha Hamid Mohamed at azggroup.co@gmail.com and identify SafeState (com.azg.safestate).