Privacy Policy

For the Android application AntiVirus — Virus Cleaner (com.coopresapps.free.antivirus) and this website. Last updated: 16 October 2026.

1. Who we are

App

AntiVirus — Virus Cleaner

Package name

com.coopresapps.free.antivirus

Developer

coopresapps

Google Play

View the store listing

App website

coopresapps.com/free-antivirus

coopresapps ("we", "us") is an independent software developer. We publish the Android application identified above on Google Play.

We are the data controller for the limited processing described in this policy. You can reach us at any time at coopresapps@gmail.com.

We are not a large company and we do not have a data protection officer. The address above reaches the person who actually builds and maintains the app.

Related documents: Terms of Service · App page · coopresapps.com

2. What this policy covers

This policy covers:

• the AntiVirus — Virus Cleaner Android application, including all features that require a network connection;
• this website, coopresapps.com, which is a static site — it sets no cookies, runs no analytics and embeds no third-party content;
• support email you send to coopresapps@gmail.com.

It does not cover Google Play itself, your device manufacturer's software, or any other app or service you use. Those have their own privacy policies.

3. Summary of data practices

4. Data we never collect

To be unambiguous, we never collect or transmit to ourselves:

• the contents of your files, or their names or paths;
• the results of a scan, or the findings it produced;
• the list of applications installed on your device;
• your contacts, calendar, messages, call log or photos;
• your precise or approximate location;
• audio or video from your microphone or camera;
• your name, postal address, or government identifiers — we have no way to obtain them, because the app has no account system and asks for none of these.

We also do not operate a backend that stores your scan history. There is no server-side copy of anything the scanner finds, because the scanner does not send it anywhere.

5. Data we do collect

The app includes Google Firebase services and Google AdMob. These collect the following automatically, as a normal consequence of running, and it is transmitted to Google's infrastructure — not to a server we run. We can view aggregated reports in Google's consoles, and we do not receive the raw records.

5.1 Usage and diagnostic events (Firebase Analytics)

Aggregated, event-level records of how the app is used, for example:

• that the app was opened or that the splash screen finished;
• that a scan was started, and whether it completed;
• that a particular screen was viewed, or a button was tapped;
• advertising events such as an ad being requested, shown, or skipped — including the reason it was skipped;
• whether an in-app purchase was completed (the fact of the purchase and the product identifier, not your payment details).

These events are associated with a randomly generated app-instance identifier and standard device information (device model, operating system version, language, country derived from IP address, app version). They are not associated with your name or email address, and we do not attempt to identify you from them.

Retention is set to the shortest period our analytics configuration offers (2 months for both event data and user data), so these events are deleted within 90 days. See section 13.

5.2 Crash and error reports (Firebase Crashlytics)

If the app crashes or throws an error, a diagnostic report is sent containing the stack trace, the state of the app at that moment, the device model, operating system version, app version, and the app-instance identifier. This is what lets us find and fix bugs reported by users we cannot ask directly.

5.3 Push notification token (Firebase Cloud Messaging)

If you allow notifications, the app receives a device token from Firebase Cloud Messaging and stores it, together with timestamps indicating when the app was last active and when a notification was last sent. This is used for exactly one purpose: to deliver app notifications such as a reminder that protection is expiring. The token identifies an app installation, not a person, and is deleted when you uninstall the app or disable notifications.

5.4 Advertising data (Google AdMob and mediation partners)

When an ad is served, Google and the partner that fills the ad may collect your advertising identifier (Advertising ID / AAID), IP address, device and operating system information, and information about how you interacted with the ad. See section 8 and section 10.

5.5 Remote configuration

The app fetches configuration values from Firebase Remote Config (for example, which ad format to enable). This is a request for settings; we do not receive data about you from it beyond the same technical information any network request carries.

6. Your files and scan results stay on your device

This is the part of the app that matters most, so it is worth stating precisely what happens during a scan.

When you start a scan, the app reads data about the apps installed on your device (their manifest, declared permissions, components, signing certificate and install source) and, if you run a file scan, reads the files you have asked it to check. All of the analysis — matching signatures, applying rules, grading severity — happens inside the app process on your phone.

The findings are written to the app's private storage on your device. They are not transmitted to us, and we have no way to retrieve them. If you uninstall the app, that data is removed by Android along with it.

7. Permissions and why we ask for them

A security app needs broader access than most, and Google Play requires apps that use certain sensitive permissions to justify them publicly. Here is each one.

7.1 QUERY_ALL_PACKAGES

Allows the app to enumerate installed applications. This is the core function of an app scanner: without it, the app could only see a small subset of packages. The inventory is built on-device and discarded when the scan finishes. It is not uploaded.

We use this permission solely for the app-scanning feature. We do not use it to build a profile of you, and we do not share the inventory with anyone.

7.2 MANAGE_EXTERNAL_STORAGE (All files access)

On Android 11 and above, this permission is required to read files outside the app's own storage — which is what a file scanner must do to check files you have downloaded or received. It is also used to delete files, but only files you have explicitly selected for removal, after a confirmation prompt.

The app does not read or modify files in the background, and it does not browse your storage for any purpose other than the scan you started.

7.3 READ_EXTERNAL_STORAGE / WRITE_EXTERNAL_STORAGE

The equivalent access on Android 10 and below, where the all-files permission does not exist. Used for the same purpose and with the same limits.

7.4 INTERNET, ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE

Used to load ads, fetch rule and signature updates, and determine whether a network is available before attempting a request. ACCESS_WIFI_STATE is used only to check connectivity — the app does not scan your Wi-Fi networks or collect network names.

7.5 Notifications

If you grant notification permission, the app may send you reminders (for example, that an Advanced Protection period is ending). You can revoke this at any time in Android settings, and the app continues to work without it.

7.6 Permissions we deliberately do not request

The app does not request access to your contacts, calendar, SMS messages, call log, camera, microphone, body sensors, or location. It also does not request the ability to draw over other apps or to read your phone state.

8. Advertising and your choices

The free version of the app is supported by advertising. Ads are provided through Google AdMob, which may serve them directly or through the mediation partners listed in section 10.

8.1 Consent

Where the law requires it — for example in the European Economic Area, the United Kingdom and Switzerland — the app shows a consent prompt on first launch using Google's User Messaging Platform before requesting ads. The prompt lets you choose whether your data may be used for personalised advertising.

Your choice controls ad requests. If you decline personalised ads, the app still shows ads where it is permitted to, but they are not personalised using your advertising identifier. You can revisit your choice at any time from the app's settings screen, which reopens the same consent form.

Please note that analytics and crash reporting described in sections 5.1 and 5.2 are not gated by that advertising consent prompt. They are independent of advertising and are described separately so you can judge them on their own terms.

8.2 Advertising identifier

The advertising identifier (AAID) is a resettable identifier provided by Android. You can reset or delete it at any time in your device settings (Settings → Privacy → Ads on most devices), and you can opt out of personalised advertising system-wide there. If you are in the EEA or UK you will also be asked for consent in the app as described above.

8.3 Premium removes ads

If you buy Premium, the app stops requesting ads entirely and the advertising SDKs are no longer used for ad delivery. You may still receive the analytics and crash reports described above.

9. Purchases and payment

Premium is sold as a one-time, non-consumable in-app product through Google Play Billing. It is not a subscription: it does not renew, and there is nothing to cancel.

We never receive your payment details. Card numbers, billing addresses and the transaction itself are handled entirely by Google Play under Google's own privacy policy. What the app receives from Google is a purchase confirmation containing the product identifier, a purchase token, and a cryptographic signature, which the app verifies on-device before unlocking Premium. We store the product identifier and the purchase token on your device so that the entitlement survives restarts.

Because the purchase is tied to your Google account rather than to the device, it can be restored after reinstalling the app without paying again.

Refunds are handled by Google Play in accordance with Google's refund policy. If you believe a purchase of ours was charged in error, write to us and we will help you work it out with Google.

10. Third-party services

The app integrates the following services. Each is operated by a third party and processes data under its own privacy policy, which we encourage you to read.

10.1 Advertising mediation partners

AdMob may fill an ad through a mediation partner. When a partner fills an ad, it receives the same category of advertising data described in section 8 and processes it under its own policy. The partners integrated in the current version of the app are:

• AppLovin — privacy policy
• ironSource / Unity LevelPlay — privacy policy
• Mintegral — privacy policy
• Pangle (ByteDance) — privacy policy
• Unity Ads — privacy policy

The exact set can change as we update the app; the list above describes the version published at the date of this policy. Where a partner participates in the IAB Transparency & Consent Framework, the consent choices you make in the app's consent prompt are passed to it.

We do not control what these partners do with data in their own right. We choose partners that publish policies and offer the consent controls described above, and we remove partners that we find are not meeting those commitments.

11. Legal bases for processing

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases under the GDPR:

• Consent (Art. 6(1)(a)) — for personalised advertising and for the collection of the advertising identifier for that purpose. You may withdraw this at any time through the consent form in the app's settings.
• Legitimate interests (Art. 6(1)(f)) — for aggregate analytics, crash reporting and security of the app. We have assessed these interests and consider them proportionate: the data is not used to identify you, is not sold, and is limited to what is needed to keep the app working.
• Performance of a contract (Art. 6(1)(b)) — for processing necessary to provide Premium after you buy it.
• Legal obligation (Art. 6(1)(c)) — where we are required to retain or disclose information by law.

12. Your choices and controls

• Advertising consent — reopen the consent form from the app's settings screen, or use your device's Settings → Privacy → Ads controls to reset or delete your advertising identifier and opt out of personalisation.
• Notifications — turn them off in Android settings at any time.
• Permissions — every permission can be revoked in Android settings. Revoking file access disables file scanning; revoking package visibility disables app scanning. The rest of the app keeps working.
• Analytics and crash reporting — these cannot currently be switched off separately inside the app. Clearing the app's data, or uninstalling the app, stops future collection from that installation, and everything already sent is deleted automatically within 90 days (see section 13). If you would like an in-app switch, write to us and tell us — it is a reasonable request and we would rather hear it than guess.
• Local data — clearing the app's data or uninstalling it removes everything the app stored on your device, immediately.

13. Data retention

• Scan results and settings — stored on your device only, for as long as the app is installed. Removed when you clear app data or uninstall.
• Analytics events — our Google Analytics property is configured to the shortest retention it offers, 2 months, for both event data and user data. These events are therefore deleted within 90 days.
• Crash reports — retained in Firebase Crashlytics for 90 days, after which they are deleted automatically.
• Push tokens — retained while the token is active. Tokens that are no longer valid are removed automatically.
• Support email — if you write to us, we keep the correspondence long enough to resolve your question. We delete it on request; see section 14.

14. Data deletion

The app has no accounts and no sign-in. There is therefore no account to delete and no central record of you that we could remove on your behalf.

Here is what happens to each kind of data:

• Data on your device (scan results, your settings, trusted list) — deleted immediately when you clear the app's data in Android settings, or uninstall the app. This is entirely under your control.
• Analytics events — deleted automatically within 90 days (our property retention is set to 2 months).
• Crash reports — deleted automatically after 90 days.
• Push token — invalidated and removed automatically once it is no longer in use, for example after you uninstall the app or disable notifications.

Because we hold no name, email address or account identifier that links this data to a person, there is nothing for you to identify and nothing for us to look up. That is also why deletion does not depend on a request from you.

If you have a question about deletion — for example, if you wrote to our support address and want that correspondence removed — contact us at coopresapps@gmail.com and we will delete it. This applies to support correspondence only, not to app data, which is already removed automatically.

15. Your privacy rights

Depending on where you live, you may have some or all of the following rights. We honour these requests for everyone who asks, regardless of jurisdiction:

• Access — ask what personal data we hold about you.
• Correction — ask us to correct inaccurate data.
• Deletion — you have a right to erasure. App data is deleted automatically within 90 days without any request (see section 14); if you want a specific piece of correspondence with us removed, ask and we will delete it.
• Restriction and objection — ask us to limit or stop certain processing, including processing based on legitimate interests.
• Portability — ask for a copy of the data you provided, in a machine-readable format.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting processing already carried out.
• Complain — lodge a complaint with your local supervisory authority. If you are in the EEA you can find yours through the EDPB member list.

To exercise any of these, email coopresapps@gmail.com. We will respond within 30 days. We will not charge you, and we will not treat you differently for asking.

15.1 California residents (CCPA/CPRA)

We do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the preceding twelve months. The categories of information we collect are described in section 5. You have the right to know, delete, and correct information, and to be free from discrimination for exercising those rights. Because we do not sell or share personal information, there is nothing to opt out of, but you may still contact us with any request.

16. International data transfers

We are an independent developer and operate no servers of our own. The third-party services the app uses — Google Firebase and Google AdMob, together with the mediation partners listed in section 10.1 — process data on a global infrastructure, which means information may be transferred to and stored in countries other than the one you live in, including the United States.

Where data protected by the GDPR is transferred outside the EEA or the UK, Google relies on the European Commission's Standard Contractual Clauses and the EU–US Data Privacy Framework for the relevant transfers. Details are in Google's privacy policy. Our mediation partners publish their own transfer safeguards in the policies linked in section 10.1.

17. How we protect data

The most effective protection here is architectural: the data that would be most damaging to lose — your files and your scan results — never leaves your device in the first place.

For the data that does leave the device, we rely on:

• Transport encryption. All communication with Google's services uses HTTPS/TLS.
• Restricted access. Access to the Firebase and AdMob consoles is limited to the developer account, protected by two-factor authentication.
• Data minimisation. We do not collect identifiers we do not need, and we do not build user profiles.
• On-device protection of purchase data. The purchase token stored by the app is encrypted with a key held in the Android Keystore, so it cannot simply be copied off the device and reused.

No system is perfectly secure. If we ever become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

18. Children

AntiVirus is a general-purpose security tool. It is not directed at children, and we do not knowingly collect personal information from children under 13 (or the equivalent minimum age in your country).

The app collects no name, email address or other directly identifying information, which means we have no way to know the age of any user. If you are a parent or guardian and believe your child has provided personal information to us, contact us and we will delete it.

19. Changes to this policy

We will update this policy when the app's data practices change — for example, if we add a new service, change analytics providers, or add a feature that collects something new.

The "Last updated" date at the top always reflects the current version. If a change is material, we will note it in the app's release notes on Google Play. Continuing to use the app after a change takes effect means you accept the updated policy; if you do not, you can stop using the app and uninstall it.

20. Contact us

For any question about this policy, or about how the app handles data:

Email: coopresapps@gmail.com
Website: coopresapps.com
App: AntiVirus — Virus Cleaner (com.coopresapps.free.antivirus) on Google Play

We are a small team, so please allow us a few days to reply. Privacy and data requests are prioritised.