Last updated: 2026-10-03
App: FinShield — published on Google Play as “Second Look: Scam App Check”
Developer: Vigilo Labs
FinShield is an Android app developed by Vigilo Labs. On Google Play, and on your phone, it is called “Second Look: Scam App Check” — that is the same app this policy describes. “FinShield” is the name we use for it throughout this document. It scans the apps installed on your phone for signals associated with financial fraud — things like dangerous permission combinations, sideloaded APKs, and known malicious packages. All threat analysis happens on your device. FinShield has no user accounts.
When you open FinShield or tap Rescan, the app reads the list of apps installed on your device — including their names, package names, declared permissions, and install sources. This is required for the app to do its job.
Where it goes: Your device. The list itself is never sent to us or anyone else. The one exception is the VirusTotal check in Section 2, which can send a single app’s package name when the app’s hash is not enough.
How long it is stored: Scan results are saved locally on your device in a local database (Room). The snapshot is reused when you reopen the app within 30 minutes of the last scan; after that, a fresh scan runs instead. The stored data remains on disk until it is overwritten by the next scan or until you clear app data — it is not automatically deleted at the 30-minute mark.
FinShield can check whether a specific app has been flagged by antivirus engines. These checks use the VirusTotal service.
What is sent: the SHA-256 hash of the app’s APK file. The app’s package name (e.g.
com.example.app) is sent only when the hash cannot answer the question — either the hash could
not be computed from the APK, or VirusTotal has no record of that hash and a lookup by package name
is the only remaining way to recognise a repackaged version of known malware. When the hash is enough,
the package name is not sent at all.
When it is sent:
How it is sent: Requests go to a Vigilo Labs backend proxy hosted on Supabase, which forwards the hash or package name to VirusTotal’s API. The proxy exists to protect the VirusTotal API key and to maintain a shared server-side cache. The proxy receives only the hash and/or package name — it does not receive your device identifier, IP address, or any personal information beyond what your network connection inherently carries.
VirusTotal is a service operated by Google. Their privacy policy governs how they handle data received: virustotal.com/gui/privacy-policy.
VirusTotal results are cached both on our server (Supabase) and locally on your device (Room) so repeated checks for the same app do not make unnecessary network requests.
FinShield includes Firebase Crashlytics, a crash-reporting SDK operated by Google. If the app crashes, a crash report is automatically sent to Google Firebase. This report includes the stack trace, device model, Android version, and app version. It does not include your name, phone number, installed app list, or any other personal information.
You can find Google’s privacy policy at policies.google.com/privacy.
FinShield uses Firebase Remote Config, a Google service, to update the wording of its fraud-warning messages without requiring an app update. This lets us improve a confusing or ineffective warning quickly.
What is sent: to fetch new wording, the Firebase SDK sends a Firebase installation identifier — a random ID generated on your device for this app — along with your app version and language, to Google. This identifier is not linked to your name, phone number, or Google account, and it is reset if you clear the app’s data or uninstall the app.
What is not sent: Remote Config never sends your scan results, the list of apps on your phone, or any warning you were shown. The wording travels to your device; nothing about what triggered a warning travels back.
If you choose to set a guardian contact in Settings, that phone number is stored locally on your device in the app’s private encrypted storage. It is never transmitted to us or any server.
If you tap the “Alert guardian” action on a FinShield notification, FinShield opens your default SMS app with the alert message pre-filled. You review and tap Send yourself — FinShield never sends SMS silently and does not route messages through any server.
Clearing it: Go to Settings inside FinShield and remove the guardian number at any time.
If you tap “I trust this app” on an app’s card, that app’s package name is saved on your phone, together with its version and signing certificate, so FinShield notices if the app changes. Trusted apps stay in your list, marked Trusted, and warnings about them are made quieter rather than stopped. You can stop trusting an app on its card or in Settings → Apps you trust.
FinShield also keeps a short history on your phone: when it first noticed each app’s abilities, and on which days it warned about each app (up to the 30 most recent). It uses this to make repeated warnings about long-installed apps quieter.
Neither of these ever leaves your phone. Both are deleted when you clear the app’s data.
FinShield records how the app itself is used, so we can see which parts help people and which parts confuse them. This is our own measurement. It is not shared with any advertising network or analytics company.
What is sent: a small set of events describing your use of the app — when you open it, which setup step you reached, whether you granted Usage Access, whether you finished setup, when a scan finished and how many risks it found, when a scan failed, when an alert was raised, when you acted on a warning and which action you chose, whether a risk was later resolved, and when you turned monitoring on or off. When you’re asked to confirm turning monitoring off, we also record whether you kept it on, and whether a call was going on at that moment — a simple yes or no, with nothing about the call itself. Counts, durations and scores are grouped into ranges rather than sent exactly.
Each event also carries your phone’s make and model (for example, “realme RMX3998”), its Android version, the date of its last Android security update, and the FinShield version. These describe the kind of phone, not your particular phone, and we use them for one purpose: to see whether a problem affects one brand or Android version more than others. Android phones differ a great deal between manufacturers, and without this a fault that only happens on one brand is invisible to us.
Each event carries a random identifier created when FinShield is installed. It is not linked to your name, phone number, email address or Google account, it is not an advertising ID, and it is deleted with the app when you uninstall — a reinstall creates a new identifier that cannot be connected to the old one.
What is not sent: the names or package names of the apps on your phone, your messages, your contacts, your guardian’s phone number, or anything from inside your banking apps. No hardware serial number, IMEI, Android ID or advertising ID is sent, and neither is your Wi-Fi network name. Section 2 describes the only circumstance in which a package name leaves your device.
About your internet (IP) address: FinShield never puts your IP address inside an event, and it is never stored next to your activity. But like every app that talks to a server, the connection itself carries it.
Our own code uses it for one purpose — making sure a single connection cannot flood the service — and drops it from our records within minutes. Separately, the companies that host and protect our server keep an automatic connection log, the way web servers ordinarily do. That log holds your IP address, the rough area it suggests you are in, and basic technical details about your phone’s connection. It is kept for one day and then deleted. We do not look at the location details in it, and nothing in it is joined to your activity.
Where it goes: a Vigilo Labs server hosted by Supabase, reached through Cloudflare, which protects the server from attack. Both handle the connection on our behalf. We do not share your information with anyone else, and we do not sell it.
How long it is stored: 90 days. After that the records are deleted permanently. We do not keep a summary, a copy, or any other version of them.
Can it be turned off: No. This measurement is part of how the app works and there is no setting to disable it. Uninstalling the app stops it and deletes the identifier described above.
Scammers sometimes take a real app, change it, and pass the copy around outside the Play Store. A fake “FinShield” would be a particularly cruel version of that — an app people install because they are worried about fraud. So FinShield asks Google whether the copy running on your phone is the one Google distributed.
What is sent: FinShield asks Google Play services on your phone for a signed statement about this app. Your phone creates that statement — we cannot read it or change it. FinShield sends it to a Vigilo Labs server (Supabase), which asks Google to open it and confirm it is genuine.
How often: once when you open FinShield. Switching to another app and coming back does not repeat it, and it does not happen while FinShield is closed or quietly doing background work.
What the statement contains: Google decides this, not us. It contains three things: whether this copy of FinShield is the one Google distributed, whether your phone appears to be a genuine Android device, and whether the app came through Google Play. It also carries FinShield’s own name and the time it was made, so we can check the statement belongs to this request. It does not contain your name, your Google account, your phone number, your location, or anything about the other apps on your phone.
What we actually use: one of those three — whether this copy of FinShield is the one Google distributed. Our server reads that single answer and throws the rest away. The other two are there because Google includes them in every statement; there is no way to ask for less.
What we do with the answer: at the moment, nothing you would notice. It is recorded inside the app while the app is running, so we can confirm the check works. It does not change your safety score and it does not raise a warning. If that ever changes, this policy will say so.
Where it goes: to a Vigilo Labs server (Supabase), and from there to Google’s Play Integrity service, which is the only party able to open the statement.
How long it is stored: it is not stored. The statement is opened, one answer is read, and it is discarded. No record of the request or its result is kept on our server, and nothing is written to your phone’s storage — the answer is forgotten when the app closes.
Can it be turned off: No. This check is part of how the app works and there is no setting to disable it. Nothing is kept from it, so there is nothing to delete; uninstalling the app stops it.
All data FinShield stores locally lives on your device only. You can delete all of it at any time by going to Android Settings → Apps → FinShield → Storage → Clear Data.
| Data | Location | Retention |
|---|---|---|
| Scan results | Room (local) | Reused within 30-minute window; remains on disk until next scan or app data clear |
| VirusTotal verdicts | Room (local) + Supabase (server cache) | Local: until app data is cleared. Server: until TTL expires (7–30 days depending on verdict) |
| Apps you trust (Section 6) | Room (local) | Until you stop trusting them or clear app data |
| Warning history (Section 6) | App storage (local) | Until you clear app data; per app, only the 30 most recent warning days |
| Guardian phone number | Encrypted local storage | Until you clear it in Settings or clear app data |
| Crash reports | Firebase Crashlytics (Google) | Per Google’s Firebase data retention policy |
| Firebase installation ID (alert wording updates) | Firebase (Google) | Until you clear app data or uninstall, which resets it |
| App usage events (Section 7) | Vigilo Labs server (Supabase) | 90 days, then permanently deleted — no aggregate or summary is kept |
| Play Integrity statement (Section 8) | Not stored anywhere | Discarded as soon as one answer is read; no record kept on our server or your phone |
| Server connection log (Section 7) | Supabase / Cloudflare, as part of running the server | 1 day, then deleted |
FinShield contacts the following external services:
| Service | Purpose | Operator |
|---|---|---|
| Vigilo Labs proxy (Supabase) | Forwards APK hash / package name to VirusTotal; maintains shared result cache; receives the app usage events in Section 7 | Vigilo Labs / Supabase Inc. |
| Cloudflare | Sits in front of our server to protect it from attack and abuse; sees the connection itself, including your IP address and the rough area it suggests (see Section 7) | Cloudflare, Inc. |
| VirusTotal | Malware intelligence — returns verdict for a given APK hash or package name | Google LLC |
| Firebase Crashlytics | Automatic crash reporting | Google LLC |
| Firebase Remote Config | Updates fraud-warning wording without an app update (see Section 4) | Google LLC |
| Google Play Integrity | Confirms whether this copy of FinShield is the one Google distributed (see Section 8) | Google LLC |
FinShield contains no advertising network and no third-party analytics SDK. The app usage analytics described in Section 7 are collected by Vigilo Labs directly, on our own server, and are not passed to any advertising or analytics company.
FinShield is not directed at children under 13. We do not knowingly collect personal information from children.
If the app’s data handling changes in a material way, this policy will be updated and the “Last updated” date at the top will change. For beta users, changes will be communicated directly.
Questions about this privacy policy or FinShield’s data handling:
Email: open.claw.bot.1984@gmail.com
Developer: Vigilo Labs
FinShield performs all threat analysis on your device. It does not have access to your banking credentials, UPI PINs, or transaction history.