Privacy Policy for MultiBox - Toolkit
1. Who we are
MultiBox - Toolkit is published on Google Play by Kaushik Domadiya ("we", "us"). Contact: kaushik.domadiya9@gmail.com.
2. What the app keeps on your phone
| Feature | What happens to the data |
|---|---|
| View Deleted Messages (notification access) | Only after you turn it on and grant notification access, the app reads notifications posted by the chat app you choose (WhatsApp or WhatsApp Business), and ignores every other app's notifications. From them it saves the chat or group name, the sender's name, the message text and the time in the app's private database on your phone, so you can still read a message after it is deleted. Nothing is uploaded to us, to Firebase or to any ad partner. You can turn it off, and clear all saved chats, in the app. |
| Media listener and deleted media | If you turn it on and grant access to the chat app's media folder, the app copies new photos, videos and other media from that folder into its private storage on your phone, so a copy remains if the original is deleted. These copies are never uploaded. |
| Status Saver and Gallery | With the folder access you grant, the app shows the statuses your chat app has already downloaded. Statuses you save are copied to your phone's Pictures/MultiBox and Movies/MultiBox folders, where other gallery apps can see them. |
| Cleaner | Lists the chat app's media files by category and size, using the folder access you grant, and deletes only the files you select. |
| Fake Chat & Call | The fake contacts (name, photo, status) and messages you make are stored only on your phone. A scheduled fake call uses an alarm on your phone. |
| Walk & Chat (camera) | Shows a live, see-through view from the back camera over your chat app. The picture is only displayed; it is never recorded, saved or sent anywhere. |
| Shake to Open | Reads the motion sensor on your phone to notice a shake. Sensor readings are not stored or sent. |
| Direct Message | The number and message you type are handed to the chat app (through a wa.me / api.whatsapp.com link) and are not stored by MultiBox. |
| Scan Web | Opens the chat app's official web page inside the app. That page is provided by WhatsApp (Meta) under its own privacy policy; its login session and cookies are stored in the app on your phone until you choose "log out / clear session". |
| Ascii Faces, Text Repeater, Text to Emoji, favourites and settings | Stored on your phone only. |
None of the content above (messages, media, statuses, fake chats, numbers you message) is sent to us, to Firebase or to any ad partner, and it is excluded from Android cloud backup.
3. Ads (free version)
The free version shows ads served by Google AdMob. Ads appear inside the app only, never over the fake call screen. AdMob may let these partners compete to show an ad: AppLovin, Meta Audience Network, Liftoff (Vungle), InMobi, Pangle, Mintegral, Digital Turbine (DT Exchange), ironSource (Unity) and BidMachine. To show, measure and protect ads from fraud, they may collect:
- your device's advertising ID,
- IP address and approximate location derived from it,
- device and app information (phone model, Android version, language, app version),
- how you interact with ads (views and taps).
In the European Economic Area, the UK and Switzerland the app asks for your consent before personalised ads, using Google's consent message. You can change your choice at any time in Settings → Privacy options. Each partner's own privacy policy explains how it uses this data:
| Partner | Privacy policy |
|---|---|
| Google AdMob | How Google uses data from apps that use its services |
| AppLovin | legal.applovin.com/privacy |
| Meta Audience Network | facebook.com/privacy/policy |
| Liftoff (Vungle) | liftoff.ai/privacy-policy |
| InMobi | advertising.inmobi.com/privacy-policy |
| Pangle | pangleglobal.com/privacy |
| Mintegral | mintegral.com/en/privacy |
| Digital Turbine (DT Exchange) | digitalturbine.com/legal/privacy-policy |
| ironSource (Unity) | unity.com/legal/privacy-policy |
| BidMachine | bidmachine.com/privacy-policy |
MultiBox Premium removes ads.
4. Settings and other services
- Our settings service lets us change app settings, such as how often ads appear, without an app update. The app downloads its settings from our server, hosted on Cloudflare, when it starts and when you return to it after an hour or more away. Cloudflare privacy.
- Google Firebase Analytics tells us how the app is used, so we can fix problems and improve it: screens opened, the first-run pages, which tools you open, settings you change, whether the Premium screen and reward ads were used, notification taps, plus app version, phone model, Android version, language, country and an app-instance ID that Firebase creates. It never receives message text, names, numbers or media. In the EEA, the UK and Switzerland it follows the consent choice you make in the app; until then nothing is stored. Google Analytics keeps event-level data for the retention period we set (2 to 14 months). Firebase privacy.
- Firebase Crashlytics and Performance Monitoring tell us when the app crashes, freezes or runs slowly: the crash or error details, the steps in the app just before it (screen names and app events, never your content), how long startup and ad loading take, plus app version, phone model, Android version and an install ID that Firebase creates. They are not used for advertising. Crash reports are kept for 90 days.
- Firebase Cloud Messaging delivers notifications such as tips and updates. It uses a token tied to this app install and the topics the app joins (all users, your country, your language, the app version). The country comes from your SIM card or mobile network, or your phone's region setting. On Android 13 and later the app asks your permission first.
- Google Play handles app updates and Premium purchases. We receive only whether you own Premium, never your payment details. Google Privacy Policy.
What our settings service logs
We log every settings request so we can see which app versions are in use, find problems with a release, and spot abuse or fraud (for example a flood of requests from one network). For each request we store:
| Data | Where it comes from |
|---|---|
| IP address | Seen by the server, as with any internet request |
| Approximate location: country, region, city, postcode, rough coordinates and timezone | Worked out by Cloudflare from the IP address. The settings request never includes your phone's location or any message content |
| Internet provider and network number (for example "Reliance Jio, AS55836") | Worked out by Cloudflare from the IP address |
| App version, phone maker and model, Android version, phone language | Sent by the app |
| An install ID | A random code the app creates the first time it runs. It is not your advertising ID or any other identifier, and it starts over if you clear the app's data or reinstall |
| Which settings version the app had, and whether it asked at start-up or on return | Sent by the app |
| Time of the request and technical connection details (protocol, response time, the Cloudflare data centre used, user agent) | Seen by the server |
We keep these records for 90 days, after which they are deleted automatically. Only our team can see them, by signing in to our private dashboard. We do not sell them, share them with advertisers, or combine them with the ad data in section 3. We process them on the basis of our legitimate interest in running, securing and improving the app.
5. Permissions and special access
| Permission | Why |
|---|---|
| Notification access | Only for View Deleted Messages, after an in-app explanation and only if you turn it on (section 2). |
| Accessibility service ("MultiBox Helper") | Only for Walk & Chat and Shake to Open, after an in-app explanation and only if you turn it on. It is used to know which app is in the foreground, so the camera layer appears over your chat app and a shake can open your chosen app or the flashlight. It does not read your screen content or collect personal information. |
| Camera | For Walk & Chat's live view and the Shake to Open flashlight. Nothing is recorded. |
| Folder access (chosen by you in Android's folder picker) | For Status Saver, Cleaner and the media listener, limited to the folder you pick. |
| Notifications (Android 13+) | For deleted-message alerts, fake calls and tips. Optional. |
| Full-screen notifications, vibration and wake lock | So a fake call you scheduled can ring like a real one. |
| Internet | To load ads, app settings and updates, Scan Web, and Google Play purchases. |
| Advertising ID | Used by the ad services in section 3. |
6. Sharing
We do not sell your personal information. Data leaves your phone only as described above: ads through AdMob and its partners, usage statistics, crash reports and notifications through Google Firebase, settings requests to our server on Cloudflare, purchases through Google Play, and what you yourself send through the chat app or Scan Web. When you tap Share, the item goes only to the app you choose.
7. Your choices
- Turn off View Deleted Messages, the media listener, or MultiBox Helper at any time in the app or in Android Settings; clear saved chats in the app.
- Change ad consent in Settings → Privacy options (shown where consent is required). Remove ads with MultiBox Premium.
- Turn notifications off in your phone's Settings → Apps → MultiBox - Toolkit → Notifications.
- Reset or delete your advertising ID in your phone's settings, usually Settings → Privacy → Ads.
- Delete everything the app stored by clearing the app's data or uninstalling it (saved statuses in Pictures/Movies stay until you delete them).
- Ask us for a copy of, or to delete, the settings-service records about you by email. They are deleted automatically after 90 days in any case.
8. Children
MultiBox is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided personal information, contact us and we will help.
9. Security and retention
Saved messages, media copies and fake chats stay in the app's private storage, protected by Android's app sandbox, until you delete them or uninstall the app. They are excluded from Android cloud backup. Our settings-service records are kept for 90 days, then deleted automatically. All data the app sends over the internet is encrypted in transit (HTTPS).
10. Your rights
Depending on where you live (for example under GDPR or CCPA) you may have rights to access, correct, delete or object to the use of your personal data. Write to kaushik.domadiya9@gmail.com and we will respond.
11. Changes
If this policy changes, the new version will be posted on this page with a new effective date.
12. Contact
Kaushik Domadiya
Email: kaushik.domadiya9@gmail.com