Privacy
Rampart collects nothing and sends nothing.
- No network calls. The library never contacts any server, including ours (we have none).
- No identifiers. Rampart does not read or create device IDs, advertising IDs or install IDs.
- No inventories. Evidence is reported as fixed codes (for example
ROOT_SU_BINARY), not as lists of the user's installed apps, files or locations. Where a check has to look at installed packages, it queries only a short, declared list of known risky packages. - You own the data flow. If you send threat events to your backend, that is your processing, under your privacy policy and your lawful basis (for example under Saudi PDPL or GDPR). Declare it in your App Store privacy details and Google Play Data safety form.
Because nothing leaves the device by default, adding Rampart does not by itself add a new data-collection entry to your store privacy declarations. Re-check this when you add your own reporting.