Privacy Policy

1. Introduction

Welcome to SecoBolt Authentication (Zerowal) ("we," "our," or "us"). We are committed to protecting your privacy and ensuring you have a secure experience when using the Bolt Security Service mobile application (the "App").

This Privacy Policy explains how our App operates, exactly what system permissions it requires, and how we strictly process authentication data to verify your identity on behalf of our partnered services and clients.

2. Strict Purpose of the Application

The App serves a single, highly specialized purpose: Enterprise-Grade Authenticity Verification. It acts as a secure, automated bridge to prove the physical possession of a mobile device and its associated phone number. The App is not a messaging client, social network, or data-collection tool.

3. Required Permissions & Justifications

To perform automated verification without requiring manual user intervention, the App requests specific Android OS permissions. We adhere to the principle of least privilege. The exact permissions and their strictly limited uses are defined below:

A. SMS Access (RECEIVE_SMS & SEND_SMS)

• Why it is needed: The core of our verification relies on a closed-loop SMS challenge. The App must intercept an incoming SMS containing a highly specific 6-digit cryptographic code and a 16-character Reference ID, and optionally dispatch a response to our secure Admin server.
• Privacy Protection: The App employs strict Regular Expressions (Regex). It ignores, bypasses, and immediately discards any SMS that does not strictly match the exact SecoBolt verification format. We do not read personal texts, banking OTPs, or contact communications.

B. Phone State (READ_PHONE_STATE)

• Why it is needed: Multi-SIM devices require the App to know which SIM slot (SIM 1 or SIM 2) is active and mapped to the verification request to prevent carrier routing failures.
• Privacy Protection: This permission is used exclusively to read the SubscriptionManager for network routing. We do not access call logs, monitor ongoing phone calls, or harvest contact lists.

C. Foreground Service & Notifications (POST_NOTIFICATIONS)

• Why it is needed: Android requires apps running background network tasks to display a persistent notification. This ensures full transparency to the user that the verification service is currently active and listening for the security code.

4. What Data is Processed (And What is Not)

During a verification transaction, the following transient data is securely transmitted to our backend via HTTPS/TLS 1.2+ encryption:

• The 6-digit verification code and 16-character Reference ID.
• The Originating Phone Number (strictly for matching the verified user).
• Basic Device Identifiers (Android OS Version, Device Model, and a hashed Android ID) to detect emulator spoofing and prevent fraud.

We DO NOT collect: Geolocation data (GPS), browsing history, camera/microphone data, local files, or address book contacts.

5. Data Retention and Deletion

We process verification data dynamically. Once the matching algorithms on our server (sms.php) complete the authentication handshake, the transaction is marked as "Verified" or "Failed." Temporary logs related to the handshake are purged systematically. The App retains absolutely no local cache of the verification history.

6. Third-Party Sharing

We do not sell, rent, or monetize any data. Verification statuses (e.g., "Success" or "Failed") are securely relayed only to the specific client or partnered service that initiated the authentication request on your behalf.

7. Security Architectures

We implement advanced technical measures to prevent unauthorized access, including:

• Dynamic Application Hashing: The App verifies its own cryptographic APK signature hash before allowing any server communication, completely neutralizing decompilation or spoofing attempts.
• Inter-Process Communication (IPC) Security: Internal background services verify the Calling UID to ensure no other malicious app on your device can trigger the verification service.
• Encrypted Payloads: All network requests are strictly dispatched via OkHttp using TLS encryption to our certified domain.

8. Your Rights

Because we do not store persistent personal profiles, standard requests for data export or deletion are intrinsically satisfied by our Zero Data Collection architecture. By uninstalling the App, you instantly revoke all access and cease all background verification capabilities.

9. Changes to This Policy

We may update this Privacy Policy to reflect changes in legal requirements or Android OS permission models. We will notify users of any material changes by updating the "Last Updated" date at the top of this document.

10. Contact Us

If you have questions, concerns, or require technical support regarding our security practices, please contact our Data Protection Officer at:

Email: privacy@zerowal.com
Website: zerowal.com