Last updated: October 22, 2026
1. Who we are
Hifazat Guard (the "app") and the website at hifazatguard.pk (the "website") are products owned and operated by VirCo Solutions (Pvt) Ltd., a private limited company incorporated in Pakistan. In this policy, "Hifazat Guard", "we", "us" and "our" refer to the Hifazat Guard app and website operated by VirCo Solutions (Pvt) Ltd. This Privacy Policy explains how we collect, use, retain, share and protect information when you use the app or the website.
Privacy questions, requests and complaints: info@hifazatguard.pk.
2. What this policy covers
This policy covers the Hifazat Guard mobile app and the hifazatguard.pk website. It does not cover third-party services that operate under their own privacy policies, such as Google Play or the threat-intelligence providers named in section 9. This policy applies to both the English and Urdu versions of the app; if a translation differs, the English version prevails.
3. Privacy at a glance
- We do not sell personal data.
- The product does not use advertising.
- Many checks run entirely on your device.
- Password Breach Check never sends your full password — only a five-character hash fragment.
- Server-side checks receive only the item you ask us to check.
- You can delete your account at any time, in the app or on the website.
4. Information we collect
Information you provide
Account information. If you create an account, we collect your email address and a password. Your password is stored only in cryptographic hash form — we do not keep or see your actual password.
Check inputs. When you run a security check, we receive the item you submit for that check: the SMS or WhatsApp text you paste into Message Checker, the link or QR-code destination you ask us to check, the phone number you look up, or the email address you investigate.
Do not submit information that you do not have permission to check, and avoid submitting sensitive information unless it is necessary for the check you are performing.
Information collected automatically
We collect limited technical information needed to operate and secure the service, such as device and app version information and security logs. The app is not designed for advertising or profiling, so we do not collect advertising identifiers or build advertising profiles.
5. How each feature handles your data
Password Breach Check. Your password is hashed on your device. Only a five-character fragment of the hash is sent for comparison against known breach data. Your full password never leaves your device, and we never need it.
Message Checker. The message text you paste is sent over an encrypted connection and processed to return the assessment you requested and to protect the service.
Website, Link and QR checks. The URL or embedded destination you submit is checked by our service and, where applicable, the threat-intelligence providers listed in section 9.
Phone Number Scanner. The number you submit is checked against community threat reports.
Email Breach Check, Account Lookup and Social Profile Exposure. The email address you submit is used to perform the requested lookup and return the results.
SIM Hijacking Check. Call-forwarding rules are read and assessed on your device.
Secure DNS protection. The web filter runs as an on-device VPN. Your browsing traffic is not routed through a Hifazat server and is not logged server-side. The VPN indicator on your device reflects this local protection function.
6. Accounts and sessions
Basic checks can be used without an account. If you choose to sign in, we use the account and session information required to authenticate you and provide account-based features such as unlimited checks and family features. Sessions are designed to be device-bound and protected using secure transport.
7. Family features
Family features let paired devices share protection status and blocked-threat summaries — not the content of messages or browsing. Pairing is initiated by a parent or guardian. Family features are not a substitute for consent, supervision or device-level privacy controls, and should be configured together with your family, not in secret.
8. Community threat reports
When users report a scam, suspicious number, link or other threat, the threat information may be reviewed, verified and shared as anonymised threat intelligence so that other users benefit. Threat information is used for security purposes, not for advertising, and is retained in anonymised form after the reporter's identity is detached.
9. Third-party services and international transfers
- Threat-intelligence providers (including Google Safe Browsing and PhishTank): receive the URL or item being checked so it can be evaluated against known threats. They do not receive your account information.
- Google Play: if you purchase a paid plan where offered, payment is processed by Google under Google's own terms and privacy policy. We do not receive your full payment card details.
- Infrastructure providers: hosting and security providers that help us operate and protect the service.
Some of these providers may process information outside Pakistan. We share only the information necessary for the purpose described, and we do not sell your information to anyone.
10. What we do not do
- We do not sell user data.
- We do not use Hifazat to serve advertisements.
- We do not need your original password for Password Breach Check.
- Secure DNS is designed without Hifazat server-side traffic logging.
11. How we protect your information
We use security measures including TLS with certificate pinning where supported, hashed passwords, device-bound sessions, encrypted connections for server-side checks, and access controls intended to protect information in transit and reduce unauthorised access. No system is perfectly secure, and we cannot guarantee absolute security.
12. Retention and deletion
We retain information only as long as needed to provide the requested service, maintain security, support threat intelligence, meet legal obligations or resolve disputes. Because different checks have different technical requirements, retention periods vary by data type: check inputs are kept no longer than necessary for the check and service security, while account information is retained until you delete your account.
Deleting your account. You can delete your account at any time — in the app (Settings → Profile → Delete account) or on the web at hifazatguard.pk/account-deletion. Deletion is permanent: your profile, sign-in credentials, paired devices and their protection history are removed. If you are the family's only parent, the entire family — every member, child profile and their devices — is deleted with your account. Community threat reports you submitted are kept in anonymised form, with the reporter detached.
For any other deletion or privacy request, contact info@hifazatguard.pk.
13. Your rights and choices
You can choose whether to use optional checks, whether to create an account, and what information to submit. Subject to applicable law in Pakistan, you may request access to the personal information we hold about you, ask for it to be corrected or deleted, and object to or ask us to restrict certain processing. To make a request, email info@hifazatguard.pk; we will respond within a reasonable period and may need to verify your identity before acting.
14. Children
The app is a general digital-security service and is not directed at children under 13. Family and Kids Mode features are designed to be configured and supervised by a parent or guardian. If we learn that we have collected personal information from a child without the required parental involvement, we will delete it. If you believe a child's information is in our systems, contact us.
15. Changes to this policy
We may update this policy when the product, our data practices or legal requirements change. The current version is always published on this page with its effective date. Where we make significant changes, we will also notify you in the app.
16. Contact
Hifazat Guard, a product of VirCo Solutions (Pvt) Ltd. — privacy questions, requests and complaints: info@hifazatguard.pk.