CC Security Privacy Policy
This policy explains how CC Security software and official websites that explicitly refer to this policy handle information. It covers local security data on your device, feedback you voluntarily submit, and website data necessary for browsing and downloading. The current corresponding software version is 26H2-11-10001. We are the independent developer publishing this project under the CC Security name. The privacy contact email is kelematubako@gmail.com.
Core security analysis takes place locally on your device. Through the current Software, we do not automatically receive your files, process memory, security logs, or device telemetry. We do not sell personal information or share it for cross-context behavioral advertising. Emails and attachments you voluntarily send, and necessary network information processed by the website's delivery services, are separate information-processing contexts, explained below.
1 Scope
This policy applies to the current software version we provide and the official website's presentation and download pages that we publish and that explicitly link to this policy. Third-party websites, email services, operating systems, browsers, and runtime services have their own privacy arrangements. Use of a third-party component does not mean that all its services are under our control.
This policy is organized around applicable United States federal and California privacy requirements and does not exclude other mandatory rights you may have. The project's location in California or availability free of charge does not alone determine whether a privacy law applies. Actual applicability depends on business activities, information processing, and statutory conditions.
2 Information Processed on Your Device
To perform behavioral detection, event correlation, memory checks, ransomware protection, and quarantine remediation, the Software may locally read and record process names, process and thread identifiers, creation times, executable paths, command lines, file hashes, digital signatures, related registry and file operations, image loads, relevant memory regions, event times, detection reasons, and remediation results. Command lines, paths, and fault information may contain usernames, document names, account identifiers, tokens, or other sensitive content.
The Software also locally stores protection settings, exclusions, interface preferences, window positions, notification records, cumulative statistics, and targeted cleanup results. Quarantine operations save file payloads and their metadata locally. Decoy files deployed for file protection and their path lists are likewise stored on your device. Reading this data does not mean it is sent to the developer.
This processing serves to identify and block suspicious operations, correlate risk evidence, quarantine files, provide results and diagnostics, retain information needed for recovery, and save your settings. It is not used for advertising targeting, commercial profiling, assessing your credit, or making employment decisions. The current version has no user-account system and does not require you to submit identity information, payment information, or account credentials to us to enable local protection.
3 Local Storage and Cleanup
Service data is primarily stored in Windows at %ProgramData%\CC Security. Interface preferences and WebView2 user data are primarily stored at %LocalAppData%\CC Security. Some logs rotate by size, and some records are retained by count. Not all data automatically expires after a fixed number of days. Quarantined files are generally retained until you handle them through supported management features.
Quarantined payloads are stored encrypted, keys are protected by Windows data protection mechanisms, and access permissions are set on the service data directory. This does not mean all logs, file paths, and quarantine metadata are encrypted. Local software with sufficient privileges, administrators, or device managers may still access relevant information. We do not promise that local data can never be disclosed.
Uninstalling the current version retains encrypted quarantine data, keys, settings, and related evidence to avoid destroying recovery opportunities. Uninstallation does not delete all local data. For further cleanup, first follow the troubleshooting guide to back up data, check quarantined content, and complete any necessary restoration. Stop the relevant services before handling remnants. Do not casually delete data directories while services are running, or retain only encrypted quarantine data while losing keys and metadata.
We have no server-based administrative entry point to read, correct, or delete data remotely on your device. For information stored only on your device, we can provide instructions, but cannot promise to erase it remotely in direct response to an email.
4 Feedback You Voluntarily Send
If you email kelematubako@gmail.com, we receive the sender address, the name you provide, message body, time, and attachments. Begin with only the version, operating system build, time of the problem, error screenshots, or minimal sanitized log excerpts. We do not require passwords, recovery keys, government identification, complete memory dumps, or all your personal files.
We use feedback to respond to requests, investigate compatibility problems and false positives, validate and fix defects, handle privacy or security reports, and address necessary legal matters. Do not attach actual malicious samples, other people's information without authorization, or unnecessary sensitive data to an initial report. If further materials are genuinely required, we should separately explain what is needed and why. Voluntarily sending an email does not authorize continuous automatic uploads by the Software.
We use Gmail to receive email, and Google processes the communications under its service arrangements. When forwarding information upstream to resolve a problem, we prefer the minimum necessary de-identified or synthetic information. If identifiable original feedback must be provided upstream, we should explain this to you first and obtain consent where applicable, except for necessary disclosures permitted or required by law. Without your permission, we do not use identifiable feedback for public promotion or public case studies.
5 Browsing and Downloads on the Official Website
The current website plan is a presentation and download service without advertising, visitor analytics, or cross-site tracking. We do not intentionally embed advertising pixels, session replay, social tracking plugins, or device fingerprinting for profiling. Visitors do not need to register an account to read public information.
To deliver web pages and installers, hosting, content delivery, or download services may still process IP addresses, request times, request paths, technical information sent by the browser or operating system, errors, and necessary security logs. This differs from automatic uploading of security logs by CC software. We use data under our control only to deliver content, diagnose faults, prevent abuse, and maintain the service, rather than for advertising, cross-site profiling, or sale.
External download pages or links may be operated by another platform. When you follow them, that platform receives the information necessary to complete the visit and applies its own terms and privacy information. We do not misrepresent external pages as wholly controlled by CC or guarantee that visiting a third-party platform involves no independent data processing by that platform.
6 Cookies and Similar Technologies
The current official website does not use advertising or analytics tracking cookies. Cookies, localStorage, and similar browser storage must be explained according to their actual purposes. Merely changing the technology's name cannot justify describing tracking as involving no collection.
Where genuinely necessary, the website may use storage to maintain security or save privacy choices. If you actively choose a theme or language, it may also save that functional preference in the current browser. These preferences do not contain advertising identifiers used to recognize you across sites. You can manage optional preferences through the website's privacy settings or clear the relevant storage in your browser. Clearing it may require you to set your theme or privacy choices again.
The initial privacy notice explains how information is handled. Dismissing it, browsing pages, or continuing to scroll does not constitute consent to optional tracking. When optional tracking is not enabled, the website will not present a merely formal "Accept all cookies" button that creates a nonexistent tracking choice. If analytics or other non-essential services are introduced later, we will first update the explanation and provide meaningful choices and withdrawal mechanisms under applicable law and the settings rules published at that time.
7 Browser Privacy Signals
We do not engage in cross-site behavioral tracking, regardless of whether the browser sends a Do Not Track (DNT) signal. DNT does not itself cause the current website to initiate additional tracking and is not a basis for consent to tracking.
Global Privacy Control (GPC) is an opt-out preference signal distinct from DNT. We currently do not sell personal information or share it for cross-context behavioral advertising, so no such processing requires you to take an additional opt-out step. For websites referring to this policy, where responding to GPC is legally required, we will treat it as a valid signal to opt out of the relevant sale or sharing, without overriding it through a popup or stored preferences. You can check the relevant status in privacy settings.
8 Information Recipients and Disclosures
Recipients that may access relevant information include hosting or distribution providers supporting website transmission, download delivery, and necessary security operations; Google as the email service provider; relevant upstream projects or technical collaborators to the extent necessary to address your reported problem; and competent authorities or parties to legal proceedings to whom we are legally required to disclose information. The information received should be limited to what is necessary for the relevant purpose.
We do not automatically send local files, memory, or security events to these recipients merely because you use local protection. This policy does not replace the processing rules of independently operated platforms or operating system services. For arrangements under our control and services processing information for us, purpose and access restrictions should follow the requirements that actually apply.
Windows, WebView2 Runtime, and third-party installation or update components may connect to the network, verify signatures, update, or perform diagnostics through their own mechanisms. Local processing of CC's core analysis does not mean every component on the Windows device never connects to the internet, or that we can make the same commitment on behalf of Microsoft or other platforms.
9 Retention and Security
Section 3 explains retention of local records. For feedback we receive and website logs under our control, retention depends on the time needed to resolve requests, reproduce and fix problems, prevent abuse, handle disputes, and meet legal obligations. Identifiable copies are not retained long-term for unrelated purposes. When no longer needed and there is no legal reason to retain them, they should be deleted or appropriately de-identified. Providers' backups and independent records are governed by their service rules. We do not promise immediate removal of every copy beyond our control.
We use access restrictions and necessary safeguards appropriate to the project's actual processing to avoid unnecessary dissemination. However, email transmission, website hosting, and local storage cannot guarantee absolute security. Do not send unnecessary secrets or actual attack payloads through ordinary feedback channels. If an information security incident subject to applicable law occurs, we will handle notifications and follow-up matters as legally required.
10 Your Requests and California Rights
You may contact us by email to ask about information we hold about you, request correction or deletion of materials you voluntarily submitted, or object to how information is handled. Where possible, use the original contact email and specify the scope of the request. Necessary identity verification should be proportionate to the risk and request. We do not require additional sensitive identification documents or all device logs for ordinary requests.
To the extent the CCPA and its CPRA amendments actually apply, California residents may have rights to know and access, correct, delete, opt out of sale or sharing, limit certain uses of sensitive personal information, and avoid discrimination for exercising these rights. We handle requests according to applicable deadlines, verification requirements, and statutory exceptions. We do not categorically deny applicable rights on the grounds that this is a "Personal project" or "Free". Nor does this policy describe a project whose statutory eligibility has not been confirmed as having obtained CCPA certification.
For sales, advertising-related sharing, or restricted sensitive uses that do not currently occur, there is no activity you must first consent to before turning it off. To control logs or quarantined files that have never left your device, use local features. For emails or other information already held by us, submit the relevant request by email. We will not instruct you to delete quarantine recovery keys that are still needed in order to respond to a deletion request.
11 Children and Different Regions
The Software and official website are not specifically directed to children under 13. We do not knowingly collect such children's personal information through the website or feedback channels. If we discover such a situation, we will delete information, stop collection, or take other necessary action under applicable children's privacy rules. Parents or guardians may raise concerns through the contact email. Device use and administration must still be authorized by the device owner or lawful administrator.
Website hosting and email services may process information in the United States or other regions where providers operate. This policy does not promise that all information is stored in a particular state or, outside the device, in a particular country. Non-excludable rights under the law of your region remain reserved. Any future change in the scope of processing should first be checked against applicable local requirements.
12 Policy Updates and Contact
We will update the date at the top of a revised policy and communicate important changes through software release notes or a prominent location on the official website. New uploads, analytics, advertising, or other materially different uses will not be treated as authorized merely because you previously used the local Software. Where applicable law requires, notice and a valid choice or consent must be provided in advance.
For privacy questions and requests, contact kelematubako@gmail.com. You may use the subject "CC Security Privacy Request". Retain only the minimum information relevant to the issue. Do not send passwords, keys, or other people's information without authorization.
Key Legal and Public References
California Department of Justice guidance on CalOPPA and privacy policieshttps://oag.ca.gov/privacy/facts/online-privacy/privacy-policy
California Privacy Protection Agency guidance on CCPA rights and applicabilityhttps://cppa.ca.gov/faq
California Department of Justice CCPA guidance and opt-out choiceshttps://oag.ca.gov/privacy/ccpa
Federal Trade Commission data security principleshttps://www.ftc.gov/business-guidance/resources/protecting-personal-information-guide-business
Federal Trade Commission children's privacy rulehttps://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa