Privacy Policy

What I collect

Just from using the iOS app: nothing leaves the phone. iOS hands unknown-sender texts to a sandboxed extension, the extension returns a verdict, and the message stays on your device. Known scam phone numbers are loaded into iOS itself; nobody sees who calls you.

If you tap the Share Sheet check: that one text or link is sent to the server, analyzed, returned with a verdict, and discarded.

If you create an account: your email address, a Supabase user ID, and (if you subscribe) your subscription status from Stripe. Your card number is never seen.

If you connect Gmail on the web dashboard: read-only access to the subject, sender address, and short snippet of new incoming emails. Not full bodies. Not attachments. Not contacts. Not your existing inbox, only emails that arrive after you connect.

What I never do

• Read your contacts or call history.
• See messages from people already in your contacts.
• Sell, rent, or share your data with anyone for marketing.
• Use third-party analytics, ad networks, or tracking pixels.
• Train any AI model on your content (and neither does Anthropic, the provider behind Share Sheet checks).

Who else sees anything

A few outside services act as processors, each seeing the smallest possible piece.

• Supabase stores email, user ID, and subscription status. SOC 2 Type II certified.
• Stripe handles payments. It sees the billing email and card; the card number is never seen by us.
• Anthropic (Claude) analyzes Share Sheet content and Gmail snippets you opt into. It does not train on your data.
• Google (Gmail API) is involved only if you connect Gmail. It provides read-only metadata access that you have granted, nothing more.
• Vercel hosts the website and API. No analytics have been added.

Your rights

• See, correct, export, or delete everything held on you.
• Disconnect Gmail anytime in the dashboard.
• Delete on-device data via Settings, then Privacy & Your Data inside the iOS app.
• Requests are answered within 45 days.

Email seniorfraudalertsupport@gmail.com for any privacy request.

Children, cookies, security

Not for kids under 13. Nothing is knowingly collected from anyone under 13.

One session cookie keeps you signed in. There are no tracking or advertising cookies.

All traffic uses HTTPS, and the database is encrypted at rest. If anything affecting your account ever happens, you will be told.

Changes

Material changes get an email 14 days before they take effect. Small fixes update the “last updated” date.