LEGAL

Privacy Policy

Last updated: September 2, 2026

Overview

This policy explains what data Noxcube collects, how we use it, and what choices you have, across our security products: the mobile SDK integrated into a partner's Android app ("Credential Guard" and device-risk detection), the browser extension, our web dashboards, and the backend that powers all of them.

Noxcube is a business-to-business security provider. A Client is the business that licenses Noxcube and integrates it into their own app, product, or fleet. You may be an individual account holder, or an employee/end user whose device is protected under a Client's deployment. Where it matters, we say which applies.

Information we collect

Account information

If you create a Noxcube account: your email address and a securely hashed password (we never store your password in plain text). Business Clients additionally have a company name, tier, and a billing email used for invoicing.

Device security signals

To detect a compromised or tampered device, the SDK checks for indicators such as: known root-management or hooking-framework apps being installed, root/su binaries, debug-build tags, whether a debugger or USB debugging is attached, developer mode, and emulator heuristics. These are device-level security flags, not personal information — we do not collect a device's IMEI, Android ID, or advertising ID.

Credential Guard: address-bar domain, at password-field focus only

Credential Guard uses Android's Accessibility service to watch for a focused password field in supported browsers (Chrome, Firefox, Samsung Internet). When one is focused, it reads the site address currently shown in that browser's address bar and checks it against known phishing and typosquat patterns before you sign in.

It never reads your password or anything you type, and it never reads content in any app other than the supported browsers listed above — only the address bar, and only at the moment a password field is focused.

Threat and scan data

When the SDK detects a threat (malware, a suspicious process, a phishing domain), it reports the threat type, severity, name, and relevant technical detail (such as a file path or process name) along with a timestamp, so it can be shown on the relevant dashboard and factored into risk scoring.

Samples submitted for AI-based analysis

Where a deeper assessment is requested, a sample is sent to Anthropic's Claude API for automated security analysis. We store the resulting verdict, confidence score, and summary — not an ongoing copy of the sample content itself beyond what's needed to produce that result.

Communications

Account-related emails (password reset, email verification, new-device/new-IP login alerts), threat alert emails you've opted into, and anything you send us directly (e.g. a support request).

Technical and log data

Standard server logs, the IP address associated with a login (used specifically to detect and alert on sign-ins from a new location), and crash/error diagnostics via Sentry, our error-monitoring provider.

What we never collect

• Your password, or anything you type into a password field
• Content from any app other than the supported browsers, and only their address bar
• Precise or background location, contacts, SMS, call logs, camera, or microphone
• Device hardware identifiers (IMEI, Android ID, advertising ID)

How we use information

• Detect and block phishing, typosquat, and known-malicious domains before you sign in
• Assess device risk (root/tamper indicators) so a Client can enforce their own security posture
• Analyze submitted samples for malware or other threat indicators
• Operate your account and send security-relevant notifications
• Generate aggregate operational reports for a Client's own dashboard — never exposing one Client's data to another
• Improve detection accuracy — any adaptive tuning suggestion is reviewed by a person before it changes behavior for anyone

Who we share data with

We do not sell your personal information, to anyone, for any purpose. We share data only with the service providers who help us operate:

• Anthropic — processes samples submitted for AI-based security analysis
• Sentry — receives crash and error diagnostics to help us fix bugs
• Our email delivery provider — sends transactional email on our behalf
• Payment processors — handle billing for business Clients; we do not store full payment card details ourselves

Data retention

We keep account and operational data for as long as your account is active. Security audit logs are retained permanently as a compliance record of what happened and when — this is the one exception to the deletion described below.

Deleting your account is irreversible: it immediately and permanently removes your account data. A point-in-time export snapshot is kept solely as a compliance record of what existed at the moment of deletion — it is not used for any other purpose and there is no way to restore an account from it.

Your rights and controls

• Export — request a copy of your account data at any time
• Delete — permanently delete your account and its data
• Turn off Credential Guard — disable it at any time from your device's Accessibility settings. Nothing forces it back on remotely, and doing so has no effect on any other part of your device
• Contact us with any privacy question or request — see below

Children's privacy

Noxcube's products are intended for business use and are not directed at children. We do not knowingly collect personal information from children.

International data transfers

Noxcube is based in Lagos, Nigeria, and data may be processed in other countries where we or our service providers operate. Where required, we rely on appropriate safeguards for cross-border transfer under the Nigeria Data Protection Act and other applicable data protection laws.

Changes to this policy

If we make a material change to this policy, we'll update the date at the top of this page and, where appropriate, notify account holders directly.

Contact us

Questions about this policy, or a request to access, export, or delete your data? Reach us via our contact page.