# Güvenlik Asistanı / Security Assistant (Secure+)

> A multilingual anti-scam assistant. It reads a message or an address and says
> what is wrong with it, and it walks a person through the minutes in which a
> phone scam actually succeeds. Everything runs on the user's device: the app
> and the browser extension contain no network code at all.

## What it is

- **Kind:** consumer security tool. Flutter app (Android, iOS, Windows, web) + Chrome MV3 browser extension.
- **Audience:** ordinary users, explicitly including elderly users and the adult children who set the product up for them.
- **Languages:** tr, en, de, fr, es, it, pt, ru, zh, hi, ar (RTL), fa (RTL).
- **Price:** no payment integration exists yet; the plan screen is informational only.

## What it actually does

- **Address (URL) risk scoring** — 21 signals, 0–100 score, three levels (safe / suspicious / high risk). Includes look-alike domain detection: homoglyph substitution (paypa1 → paypal) and narrow edit-distance (garantl → garanti).
- **Message text risk scoring, with or without a link** — 12 behaviour patterns (safe-account story, secrecy demand, remote-access app, verification-code request, authority impersonation, account-blocked threat, urgency, prize, parcel excuse, guaranteed-profit, "my new number", money request), plus IBAN detection with ISO 13616 mod-97 validation, plus combination bonuses (an authority claim together with an IBAN means far more than either alone).
- **Call shield** — a guided flow for a suspicious call (hang up, find the number yourself, call a relative, share no code, there is no "safe account", urgency is a lie), a card the customer shows the bank clerk so the clerk asks the fraud questions, and a first-60-minutes list for after money has moved. Country-aware official numbers.
- **Trusted contact** — one relative's number, shown in large type at the moment of panic.
- **Family setup + phone card** — a three-step setup an adult child runs on a parent's phone, ending in a printable card kept next to the telephone that works while the app is closed.
- **Browser extension** — scores every page automatically, inspects page structure for payment-form abuse, counts redirect hops, and shows the verdict in the badge and popup.
- **Local reports, education guides, call-number check, search.**

## What it explicitly does not do

- It does not listen to or record phone calls. Android has forbidden third-party call recording since May 2022 and iOS never allowed it; the product does not attempt it.
- The web app cannot check pages automatically — the browser sandbox does not permit it, and the app says so on its own home screen instead of showing a false "you are protected" badge.
- Reports are stored locally only; there is no shared community server yet.
- A "no clear warning sign" result is an opinion, never a guarantee.

## Privacy

- No account, no registration, no server, no analytics, no advertising, no third-party SDK.
- Locally stored: settings, last 20 checks, the user's own reports, the trusted contact, and the current tab's verdict (session only).
- Everything is erasable in-app: Settings → Delete my data.
- Full policy: /privacy/

## Documents

- Privacy policy: /privacy/
- Engineering standard the project follows: GLOBAL_CORE_MANIFESTO v2.4 (clean architecture, offline-first, accessibility and UX acceptance criteria, machine discoverability).

## Contact

info@dropless.com.au