Introduction ThreatLens ("the App") is a mobile security scanner. This policy explains what data the app accesses, what is sent to external services, and how your privacy is protected. Data Accessed On-Device (Never Sent to Our Servers) The App reads the following data solely on your device for security analysis: Installed applications — via the QUERY_ALL_PACKAGES permission, to scan apps for known vulnerabilities and permission risks. App usage statistics — via the PACKAGE_USAGE_STATS permission, to assess security posture of running apps. None of this data leaves your device or is stored by us. Data Sent to Third-Party Services 1. Password Breach Check (HaveIBeenPwned) When you use the Password Leak Scanner feature: Your password is hashed locally using SHA-1. Only the first 5 characters of that hash are sent to api.pwnedpasswords.com (k-anonymity model). Your full password and full hash are never transmitted. HaveIBee...