Sentinel privacy policy

Summary

Eagle Sentinel is a call blocker for Android. Every decision happens on your phone, with no internet. The app only uses the internet for what you turn on: the Eagle account, the backup of your rules, the subscription and Family, all optional. Without them, nothing leaves the phone. The address book never leaves it, and the call history only does if you allow it, in Family. No ads, no trackers and no selling of data.

Calls

As the caller ID and spam app you chose, Sentinel receives from Android the caller's number and the carrier's verification result (for example, STIR/SHAKEN). The app checks them against your rules and lists and decides whether the call rings, is silenced or is blocked. Sentinel does not answer calls, record audio or read SMS.

Eagle account (optional)

If you sign in with your Eagle account, the app sends your e-mail and password to the Eagle API (eagletools.uk), over HTTPS, only to sign in, and receives the account's name, e-mail and plan. The session is kept on the phone, encrypted with an Android Keystore key, and renewed in the background once a day when there is internet. The password is not kept on the phone.

Account data follows the Eagle Tools privacy policy. Signing out in the app also ends the session on the server.

Cloud backup

With an Eagle account, the app keeps a copy of your rules, lists and modes on the Sentinel server after every change, so you can restore them on a new phone. The copy includes the numbers and number starts you put in your lists and, for contacts you added to a list, that contact's name and numbers. The call history and the rest of the address book are not part of that copy.

The copy travels over HTTPS and is stored encrypted (AES-256, with a key of its own for each account). The last 10 versions are kept. You can delete every copy at any time under Lists → Backup, in the app. After signing out nothing else is sent. Deleting the Eagle account deletes every copy with it.

Subscription (Plus)

Plus is bought through Google Play. The payment, your card and billing details stay with Google; we never receive them.

To unlock Plus, the app sends the Sentinel server the purchase code Google Play gives the app and a random identifier of this installation (not your phone number nor an advertising identifier). The server checks with Google that the subscription is active and keeps: the plan, its state, the renewal or end date, whether it is a test purchase, the identifiers of the installations that presented the purchase (at most 10, to stop it being shared) and, if you signed in with an Eagle account, the account it was linked to. The purchase also carries a code derived from your Eagle account (not the account itself), so Plus follows you to another phone. Google tells us about renewals, cancellations and refunds; those notices are kept for 90 days.

The app keeps a signed proof of the plan, good for 30 days without internet. With no purchase and no Eagle account, nothing is sent. Deleting the Eagle account deletes the link between it and your purchases. To cancel the subscription, use Google Play (in the app: Account → Sentinel Plus → Manage on Google Play).

Family

With the Family plan, one person (the administrator) looks after the call rules of up to 5 phones, for example their parents'. Only phones that join through a single-use invite take part: a QR or code valid for 10 minutes for a protected phone, or 7 days for another member with an Eagle account. The QR is read by Google Play services, without the app asking for the camera.

For each family, the Sentinel server keeps: the administrator's name, the family's rules (which may include numbers and number starts, like any rule) and, for each phone, the name you gave it (for example, "Mom"), the phone numbers entered (optional, used in every phone's Family list so those people always ring), when it joined, whether protection is on, the rules version applied, when the phone was last seen, the notice code described below, and whether it follows only the administrator's rules (protected) or its own too (free). With full management, also the rules the administrator wrote for that phone alone and, in free mode, the rules the phone reported, for the administrator to start from. A protected phone joins without an Eagle account: it gets a credential kept on the phone, encrypted with the Android Keystore; the server keeps only a hash of it. The exit PIN, if any, stays on the phone.

The family's rules always apply on a protected phone. Beyond them, the administrator may ask, when creating the invite, for the permissions below. Before joining, the protected phone sees the list already switched on as the administrator asked and switches off what it does not want. Each permission is separate and can be switched off later, at any time, under Family on the phone itself.

Edit all the rules: the administrator changes that phone's modes, lists and rules remotely.
See the call history: the administrator sees the calls Sentinel filtered on that phone in the last 30 days: the number, the time, what was done (rang, silenced or blocked) and why. It is Sentinel's own history, not Android's call log, and names from the address book never leave the phone. Only calls from the moment the permission was given are sent, never earlier ones. The server keeps each call for 30 days. Switching the permission off deletes the server's copy at once. While the history is shared, the phone shows a notification that stays and a notice on its History and Family screens.
Scam stopped: the number and time of a call blocked as a scam, so they can act on it.
Weekly summary: how many calls were blocked and silenced that week, with no numbers.

Alerts are kept on the server for 30 days and then deleted by themselves. The server checks the permission again before accepting each alert or call of the history. The administrator never sees the address book or the messages of the phones they protect. A member who joins with an Eagle account only to share the plan gives none of these permissions.

So that a change arrives in under a minute, the app uses Google's Firebase Cloud Messaging, only on phones that are in a family. The server keeps the notice code Firebase gives that phone and sends through it only a signal ("there is an update"), with no content; the phone then fetches what changed straight from the Sentinel server. Outside a family, Firebase is not started.

The protected phone can leave whenever it wants, under Family → Leave the family (with the PIN, if any), and goes back to its own rules at once; the administrator can also remove it. A phone that leaves takes its data, alerts and history on the server with it. If the app is uninstalled without leaving first, the phone stops getting the rules at once, and its data on the server stays until the administrator removes it or ends the family. When the administrator ends the family, or deletes their Eagle account, the whole family is deleted: phones, invites, alerts and histories. A member who deletes their account only leaves the family.

Permissions

Contacts: to tell whether the caller is in your contacts. The lookup happens on the phone, one call at a time. Your contacts are never copied or sent.
Phone and phone numbers: to know which SIM the call came in on and what your own number is, for per-SIM rules and "looks like mine".
Nearby Bluetooth devices: to know whether your car, headphones or watch is connected (Driving mode, and silenced calls shown as missed). Only the devices you pick are used.
Notifications: for the morning summary, the app's notices and, for a family's administrator, the alerts from the phones they protect.
Internet and network state: only for what is optional: the Eagle account, the backup, the subscription and Family, when there is a connection.
Run at startup: to reschedule modes and the summary after the phone restarts.

What stays on your phone

Your rules, lists, modes and preferences, and the decision history (number, time, SIM and the reason for each decision). The history keeps the last 90 days and deletes the rest by itself. All of it lives in the app's private storage, excluded from Android's automatic backup, and is deleted when you uninstall Sentinel.

When you share a rule or a mode, the app creates a link that carries the rule after the # sign. Browsers do not send that part of a link to servers, so it never reaches us. Whoever receives the link sees the rule, including any numbers or number starts in it.

A backup is a file you save wherever you choose (for example, Downloads or your Drive). Sentinel does not send that file to anyone.

Referrals

With an account, you can create a referral link. Whoever opens the link sees only your first name. The app of whoever installs through the link reads the code once, through Google Play itself, and sends it to the Sentinel server when the account is created. The server keeps who referred whom and whether the referred person's subscription was paid or refunded (as Google Play reports it), only to release the reward. Deleting the account deletes your code and your referrals.

Google Play

The app is distributed through Google Play, which handles install, purchase and crash data under Google's privacy policy. From those reports we only receive aggregate statistics, with no phone numbers. On phones in a family, Google's Firebase Cloud Messaging delivers the update signal described under Family; Sentinel does not use Google Analytics or any other Firebase service.

Two Google libraries inside the app send Google technical data about how they work: the Google Play billing library and the QR code scanner of Google Play services (ML Kit). This is data such as the device model, the Android and app versions, installation identifiers, response times and error codes, which Google uses to maintain and improve those services. It never includes phone numbers, contacts, call history or your rules.

Children

Sentinel is not directed at children and collects no one's data.

Changes

New features only ship after this policy is updated to describe exactly what leaves the phone, and always by your choice. The date at the top shows the latest update.

Your rights

Under the LGPD (Brazilian Law 13.709/2018) and the GDPR, you can access, correct and delete your data. Since it stays on your phone, you do this in the app itself: edit or delete rules and lists, and uninstall Sentinel to delete everything, history included. To leave a family, use Family → Leave the family on the phone. The Eagle account, with the copies in the cloud and the family you administer, can be deleted in the app (account icon → Delete account) or under My account on the site.

Contact

Privacy questions: [email protected]. Data protection officer (DPO): [email protected].