Textigo is designed to detect suspicious SMS messages while keeping your data private. Most processing happens directly on your phone.
1. How Textigo Works
Textigo works in the background and checks incoming SMS messages as they arrive. If a message appears suspicious or potentially fraudulent, Textigo shows you a warning.
Textigo does not block, delete, reply to, or change your messages. The warning is only a recommendation. You decide what to do with each message.
2. What Textigo Processes
Textigo processes the text of incoming SMS messages directly on your phone.
It also briefly checks the format of the sender address to determine whether the message came from a regular mobile number or an alphanumeric business sender ID. The sender address is used only for this check. It is not saved or sent to our servers.
Textigo does not read your old messages or existing inbox. It can only process SMS messages that arrive while the app is installed and has permission to receive them.
3. What Stays on Your Phone
Incoming SMS messages and their detection results are stored locally on your phone in encrypted form.
Textigo keeps up to 100 recent messages and automatically deletes them after 7 days.
Your private key, language preference, and local message counts also remain on your device.
Textigo does not request access to your contacts, location, camera, microphone, call logs, or advertising identifiers.
4. Information Sent to Our Server
Textigo does not upload your messages for scam detection. Detection happens directly on your phone and does not require an internet connection.
When Textigo is first launched, it creates a P-256 cryptographic key pair and a pseudonymous nickname for your installation. The public key and nickname are registered with our server. Your private key remains on your phone unless you choose to export a backup.
We do not collect your name or phone number as part of this process.
5. Reporting a Message
Nothing about an SMS message is sent to us unless you choose to report it.
When you submit a report, Textigo sends:
- the full text of the message you selected;
- whether you marked it as clean or malicious; and
- the version of the detection model that analyzed it.
The report does not include the sender's name or number, your phone number, your name, your location, your device model, or other messages.
A reported message may itself contain personal or sensitive information, such as a name, account number, reference number, or transaction amount. Please review the message before submitting it.
Reporting is always voluntary. Textigo never reports messages automatically.
6. Why Reports Are Collected
Reports help us improve Textigo's scam detection model. Reports marked as malicious help identify scam patterns, while reports marked as clean help us identify false warnings.
Reports may also contribute to the Textigo leaderboard using only your pseudonymous nickname and report count.
7. Your Textigo Identity
Textigo does not require an account, email address, or password.
Instead, the app generates a cryptographic identity for your installation. A nickname, such as QuietCreek0417, is derived from its public key.
This identity is pseudonymous, not anonymous. It identifies an installation of Textigo rather than a named person.
If you export your account backup, keep it secure. Anyone who obtains the backup may be able to submit reports using your Textigo identity.
8. Permissions
Textigo uses the following Android permissions:
- RECEIVE_SMS to analyze incoming SMS messages;
- POST_NOTIFICATIONS to display scam warnings; and
- INTERNET to register your public key, submit reports you choose to send, and load the leaderboard.
Textigo does not use the READ_SMS permission and therefore cannot open or scan your existing SMS inbox.
9. Automated Detection
Textigo uses a machine-learning model that runs directly on your phone.
The model may occasionally miss a scam or warn you about a legitimate message. A Textigo warning should therefore be treated as guidance, not as a final determination.
Textigo does not automatically block, delete, alter, reply to, or report a message based on the model's decision.
10. Data Sharing
We do not sell, rent, trade, or share personal data for advertising, marketing, or profiling.
Textigo contains no third-party advertising, analytics, social-login, or tracking SDKs.
Information may be disclosed to our service provider where necessary to operate the reporting service, or when disclosure is required by Philippine law, a lawful court order, or a competent authority acting within its jurisdiction.
11. Data Retention
Messages stored locally are automatically deleted after 7 days, with a maximum of 100 recent messages kept at one time.
Local app data is deleted when you uninstall Textigo or clear the app's data.
Your public key and pseudonymous nickname are kept on our server while the installation remains active and may be deleted upon request.
Submitted reports are kept only for as long as they remain useful for improving the detection model and are reviewed for continued necessity at least once a year.
If a report has already contributed to a trained model, deleting the original report may not remove its statistical influence from a model that has already been trained.
12. Security
Textigo uses security measures designed to protect your information.
Messages stored on your phone are encrypted using AES-256-GCM with a key protected by the Android Keystore. Stored data is private to the application, and message content is not written to application logs.
Network communication uses HTTPS, and cleartext connections are refused by the application.
Reports are authenticated using cryptographic signatures and single-use challenges designed to prevent forged or replayed submissions.
Textigo is reviewed against the OWASP Mobile Application Security Verification Standard (MASVS), and the review is maintained as the application changes.
13. Your Privacy Rights
Under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), you may have rights to be informed, access your personal data, object to processing, request correction or deletion, obtain a portable copy of applicable data, seek damages where provided by law, and file a complaint with the National Privacy Commission.
You can stop Textigo from checking messages by revoking its SMS permission or uninstalling the app.
You can delete locally stored information by clearing the app's data or uninstalling it.
You can stop sending reports simply by not using the Report function. Reports are never sent automatically.
For requests involving information held on our server, contact the Data Protection Officer and include the nickname shown under Settings > Account. Because we do not collect your name, email address, or phone number for your Textigo identity, this nickname or your key pair is used to locate the relevant records.
14. Children
Textigo is not specifically directed at children. It is intended for mobile phone users, including people who may be more vulnerable to SMS scams.
Where required by law, processing involving a minor must have appropriate consent from a parent or guardian.
15. Changes to This Policy
We may update this Privacy Policy when Textigo or our data practices change.
Material changes will be published with an updated effective date and version number and, where appropriate, communicated through the application.
16. Contact and Complaints
DPO email: legal@protectiv.ph
If you have a privacy concern, please contact our Data Protection Officer first so we can review and address it.
You may also file a complaint directly with the National Privacy Commission (NPC).
Website: privacy.gov.ph
17. Legal Basis
Textigo processes information in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and applicable regulations.
Where consent is required, it is obtained through actions such as granting the SMS permission or voluntarily submitting a report.
Textigo applies reasonable organizational, physical, and technical safeguards to protect personal data. Where a report service or other processor is located outside the Philippines, appropriate data-protection obligations apply in accordance with Philippine law.
In the event of a personal data breach requiring notification under applicable law, we will notify the National Privacy Commission and affected data subjects within the period required by law.
Read the Terms of Service →