Privacy Policy for Guillotine

This Privacy Policy explains how Mor3 Inc. ("Guillotine," "we," "us," or "our") collects, uses, stores, and shares information when you use the Guillotine mobile application (the "App") and related services at guillotine.app (collectively, the "Service"). It applies to users of the App on Google Play and the Apple App Store.

If you do not agree with this policy, do not install or use the App.

1. Who we are

Guillotine is a monitoring and protection app published by Mor3 Inc., 8 The Green, Dover, DE 19901. The App watches for threats on your device and alerts you when suspicious activity is detected. Detection and analysis run on your device; anonymized threat indicators are sent to our servers so detection stays current for everyone.

Because the App reads security-relevant signals — including location, call activity, messages, and contacts — this policy describes exactly what is read, what leaves your device, and how long it is kept. Please read it before enabling monitoring.

For any privacy question or request, contact us at privacy@mor3.site.

If you are in the EU/EEA or the UK, our data protection contact is the same address above. Our EU representative under GDPR Article 27 is Malik Wahid, 8 The Green, Dover, DE 19901.

2. Information we collect

2.1 Information you provide directly

• Account information. When you sign in or create an account, we receive the email address, display name, and authentication tokens needed to access the Service. We do not store your password in plaintext; tokens are stored encrypted on your device using the Android Keystore / iOS Keychain.
• Monitoring configuration. The protection preferences and rules you configure inside the App — which activities to monitor, alert thresholds, and notification settings.
• Alert and report content. When the App detects a potential threat, it generates an alert record describing the detection (event type, timestamp, severity, and the device, location, call, or message indicators that triggered it). Alert records are encrypted and synchronized so they appear on every device you sign in on. You can review them in the App and, if you choose, send us a diagnostic report.
• Support communications. If you email us for support, we receive your message, your email address, and any information you choose to include.

2.2 Information collected automatically

• Device and app information. Device model, OS version, App version, locale, and crash diagnostics. This helps us detect threats, debug, and improve the App.
• Security telemetry. To detect threats, the App processes security-relevant signals on your device — such as app installation events, network connection metadata, permission changes, and configuration changes. Detection and analysis run locally on your device; only the anonymized indicators needed for threat intelligence are transmitted to our servers at api.guillotine.app.
• Location information. With your permission, the App reads precise device location to recognize when activity is happening from an unexpected place — for example a sign-in or sensitive action far from where you normally are. Location is evaluated on your device and is transmitted only when it forms part of an alert record. We do not build a movement history or a location profile of you, and we do not sell location data.
• Call and message activity. With your permission, the App reads your call log and incoming SMS messages to spot spoofing, phishing, and fraud patterns — for example a call presenting itself as coming from a number it does not belong to, or a message carrying a known-malicious link. Calls and messages are evaluated on your device. We transmit the indicators that triggered a detection (such as a number, sender, or link) rather than your call history or message archive, and we do not use calls or messages for advertising.
• Contacts. With your permission, the App reads your device contacts to tell whether an incoming call or message comes from someone you already know, which is what lets it flag unfamiliar or impersonated senders. Contacts are used for this matching only. We do not upload your contact list as a marketing or advertising resource, and we do not use it for advertising.
• Authentication state. Whether biometric unlock is enabled (we do not access your fingerprint or face data — biometric matching is performed by the operating system).
• Network information. IP address and basic request metadata are processed when your device communicates with our servers. We use this to route requests and protect against abuse; we do not build advertising profiles from it.

2.3 Information we do not collect

• We do not access your photos, microphone, or camera.
• We do not connect to your email account or read your mailbox.
• We do not collect the full content of your message archive — only the indicators behind a specific detection.
• We do not use advertising identifiers (Google AAID / Apple IDFA) and we do not serve third-party advertising.

3. How we use information

We use the information described above to:

• Operate the App's core functionality — monitoring for threats, generating alerts, and keeping you informed in real time.
• Recognize suspicious location activity, spoofed calls, and phishing or fraudulent messages.
• Match incoming calls and messages against your contacts so unfamiliar or impersonated senders can be flagged.
• Authenticate you and keep your account secure (biometric lock, session tokens).
• Synchronize your monitoring preferences and encrypted alert history across devices you sign in on.
• Improve threat detection accuracy and reduce false positives.
• Provide customer support when you contact us.
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Diagnose crashes and improve reliability and performance.
• Comply with legal obligations.

We do not use your security telemetry, alert content, location, call or message activity, or contacts to train machine-learning models, build advertising profiles, or sell to third parties.

4. Legal bases for processing (EU/EEA/UK users)

Where the GDPR or UK GDPR applies, we rely on the following lawful bases:

• Consent — for access to precise location, call logs and SMS, and contacts, and for any optional analytics or marketing communications. You give this consent when you enable the relevant permission, and you can withdraw it at any time by turning the permission off in your device settings or inside the App.
• Contract — to provide the Service you have signed up for.
• Legitimate interests — to secure the Service, prevent abuse, fix bugs, and communicate with you about the App. You can object to this processing at any time (see Section 8).
• Legal obligation — where we must retain or disclose information to comply with applicable law.

5. How information is shared

We share information only in the following circumstances:

• With service providers acting on our behalf. We use vendors for infrastructure hosting, push notification delivery, crash reporting, and similar back-office functions. These vendors are bound by contract to process data only as instructed and to protect it. A current list is available on request.
• For legal reasons. We may disclose information if required by law, court order, or to protect the rights, property, or safety of Guillotine, our users, or others. We will challenge requests we believe to be unlawful or overbroad.
• In a corporate transaction. If Guillotine is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you and give you choices where required by law.

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA).

6. Where data is stored and security

• The App stores your monitoring configuration, alert history, and settings locally on your device using encrypted storage (Android EncryptedSharedPreferences / Room with SQLCipher / iOS Keychain and Data Protection, as applicable).
• Alert records are encrypted in transit and at rest while they are synchronized between the devices you sign in on, and are not used for anything other than showing you your protection history.
• Server-side data is stored on infrastructure operated by AWS in us-east-1. Transit is protected with TLS 1.2+.
• Authentication tokens are encrypted at rest on your device.
• We follow industry-standard security practices, but no system is perfectly secure. If we become aware of a security incident affecting your data, we will notify you as required by law.

7. Data retention

• On your device. Alert history and cached monitoring data are retained until you sign out, uninstall the App, or clear App data. You can configure retention limits in App settings.
• Security telemetry and threat indicators. Anonymized indicators received by our servers are kept for up to 12 months, after which they are deleted or aggregated so they no longer identify you or your device.
• Alert records. Encrypted alert records are retained for up to 12 months from the date of the alert, then deleted. You can delete individual alerts, or your full alert history, at any time from the App.
• Account metadata. Retained for as long as your account is active. After you delete your account, we delete or anonymize associated telemetry, alerts, and account data within 90 days, except where we are required to retain it for legal, accounting, or security reasons.
• Backups. Residual copies in encrypted backups are purged on our standard backup-rotation schedule.

Precise location, call and message activity, and contacts are read and processed on your device. They are not stored as separate server-side copies; what may be stored is the indicator that triggered an alert, held for the periods above.

8. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate.
• Delete your information ("right to erasure").
• Export your information in a portable format.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email privacy@mor3.site from the email address associated with your account. We will respond within the timeframe required by applicable law (generally 30 days). We may need to verify your identity before acting on a request.

California residents: You also have rights under the CCPA/CPRA, including the right to know, delete, correct, and to limit the use of sensitive personal information. Precise location, call logs, messages, and contacts are treated as sensitive personal information; we do not sell or share personal information as defined by the CCPA/CPRA.

You can turn off monitoring at any time. Revoking a device permission stops the protection features that depend on it, and you can delete your account from within the App at Settings → Account → Delete account, or by emailing us.

9. Children

Guillotine is not directed to children under 13 (or under 16 in the EU/EEA, where local law sets a higher age). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

10. International data transfers

If you use the App from outside the United States, your information will be transferred to and processed in the United States. Where required (e.g., transfers out of the EU/EEA or UK), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, the UK Addendum.

11. Permissions used by the App

The App requests the following device permissions:

• Internet — to deliver threat alerts and communicate with our servers.
• Notifications — to alert you when a threat is detected.
• Location — optional; lets the App recognize activity from unexpected places.
• Call log — lets the App compare incoming calls against spoofing and fraud patterns.
• SMS — lets the App scan incoming messages for phishing and malicious links.
• Contacts — lets the App tell whether a call or message comes from someone you know.
• Run at startup / Receive boot completed — to keep continuous monitoring active after a device restart.
• Biometric — optional; lets you unlock the App with fingerprint or face. Biometric matching is performed by the operating system; we never see your biometric data.

You can revoke optional permissions at any time in your device settings. Doing so turns off the monitoring features that depend on them.

12. Third-party services

The App communicates with the following third-party services on your behalf:

• AWS — to operate our backend at api.guillotine.app.
• Apple / Google push notification services — to deliver threat alerts to your device.

We do not embed third-party advertising SDKs or social-login tracking pixels.

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you in the App and/or by email before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

14. Contact us

Mor3 Inc.
8 The Green, Dover, DE 19901
Email: privacy@mor3.site

If you are in the EU/EEA/UK and we have not resolved your concern, you have the right to contact your local data protection authority.