KALKAN — Privacy Policy
Effective date: 11 August 2026 Controller: BUSATER YAZILIM A.Ş. — CULHA D:1 No:114-1, Etlik Mahallesi, Etlik Caddesi, Keçiören, 06010 Ankara, Türkiye Contact: BUSATER YAZILIM A.Ş. — CULHA D:1 No:114-1, Etlik Mahallesi, Etlik Caddesi, Keçiören, 06010 Ankara, Türkiye Email: bsdigitalapp@gmail.com
The short version
> Message content is processed on your device and is not transmitted to KALKAN.
KALKAN reads your messages only on your phone, to decide whether each one is spam. The text, the sender, any attachments, and anything you check with our tools stay on the device.
KALKAN is not an offline-only app. It downloads a signed threat-intelligence database, and it verifies purchases with our billing service. Neither of those requests carries your message data. The details are below.
1. What we process, and where
| Data | Where it is processed | Leaves your device? |
| SMS content | On device | No |
| MMS content and attachments | On device | No |
| Sender / recipient numbers | On device | No |
| A link you check with Link Check | On device | No |
| A number you check with Number Check | On device | No |
| One-time codes (OTP) | On device | No |
| Quarantined messages | On device (filesDir) | No |
| Your allow/block lists | On device | No |
| Activity counters | On device | No |
| Contacts | Not accessed at all | — |
We do not operate a server that receives message content. There is no endpoint you could send it to even if you wanted to.
2. Network requests KALKAN makes
2.1 Threat intelligence download
KALKAN periodically downloads a signed database of spam rules, a local model and known fraud numbers. This is a plain GET. It carries no query parameters, no request body, no cookies, no device identifier and no account identifier. We cannot tell who downloaded what.
2.2 Purchase verification
If you buy KALKAN Pro, the app sends one field — the purchase token issued by Google Play — to our verification service, which asks Google whether that purchase is valid. The service rejects any request containing additional fields. Your token is never written to logs in full.
2.3 Apple and Google
Purchases run through Apple's StoreKit or Google Play Billing. That traffic is between you and Apple/Google; we do not control it and cannot see its contents. It does not contain message data.
3. Android default SMS app
On Android, KALKAN asks to become your default SMS app. This is required by the operating system: only the default app can see an incoming message *before* it reaches your inbox, which is what makes real quarantine possible.
While KALKAN holds this role it can read, write and send SMS/MMS on your device. If you remove the role, KALKAN immediately stops reading, writing and sending — this is enforced in code on every privileged call.
4. Notifications
Incoming-message notifications are generated on your device. Quarantine notifications deliberately do not show the message body.
5. Data retention and deletion
Everything is stored on your device. Uninstalling the app removes it. You can clear quarantine and your lists from inside the app at any time. Backup and device-transfer are disabled for KALKAN's data.
6. What we do not do
- No advertising SDK
- No analytics or behavioural tracking SDK
- No crash-reporting SDK
- No attribution SDK
- No WebView
- No sale or sharing of personal data
7. Children
KALKAN is not directed at children under 13.
8. Your rights
Because we do not collect personal data on our servers, there is no account to access, correct or delete. For questions: bsdigitalapp@gmail.com
9. Changes
Material changes will be announced in the app and at https://samettrm.github.io/kalkan/privacy/.