Privacy Policy

The Short Version

• The iOS app's core protection (SMS filtering + call blocking) runs 100% on your phone. Your messages never leave your device.
• We do not sell, rent, share, or use your data for advertising. Ever.
• Optional features (Share Sheet checks, family alerts, web email scanning) require you to actively opt in, and we explain exactly what data leaves your device for each one.
• You can delete everything at any time in Settings → Privacy & Your Data.
• Questions: privacy@seniorfraudalert.com

0. Senior Fraud Watch iOS App

The iOS app is engineered so that core protection works without sending any of your messages, contacts, or call data off your device. This section describes exactly what the iOS app does and does not do with your data. The data declarations Apple shows on the App Store listing reflect the practices described here.

What runs entirely on your device

• SMS spam filtering. When iOS receives a text message from a sender not in your contacts, iOS passes the sender and message body to our Message Filter extension, which runs entirely in Apple's sandboxed extension process on your phone. Our extension makes no network requests. The classification result (Junk / Promotion / Transaction / None) is returned to iOS, which moves the message accordingly. No SMS content is transmitted off the device.
• Call blocking. A list of known fraud phone numbers is loaded into iOS via the Call Directory extension. iOS itself blocks the calls. We never see who is calling you.
• Blocked message history. The sender and the first 200 characters of blocked messages are stored in an encrypted app container on your device for your own review. This data never leaves the device.
• On-device scam classifier. A local rule-based model (1,000+ patterns) runs in milliseconds inside the Message Filter extension. No internet connection is required for it to work.

What is sent off the device (only with your active opt-in)

• Share Sheet checks. When you long-press a text or link and choose "Check with Senior Fraud Watch," that specific content is transmitted to our /api/share-check endpoint for analysis. We process it in real time and do not store the original content after the verdict is returned.
• Trusted Contact alerts. If you have added a family member as a Trusted Contact and you tap "Ask my trusted contact," we send a short redacted summary (category and verdict only — never the raw message) to that contact's device via Apple Push Notification service.
• Account email + subscription status. If you create an account or subscribe, your email and subscription state are stored in Supabase to authenticate you across devices and enable paid features.
• Push notification tokens. If you enable Trusted Contact alerts, your APNs device token is stored so we can deliver push messages.

What the iOS app never does

• We do not collect, analyze, or transmit your SMS content for the core SMS filter.
• We do not access your contact list.
• We do not read your call history.
• We do not use third-party analytics, advertising SDKs, or tracking pixels in the iOS app.
• We do not sell or share any of your data.

You can verify these claims for yourself: iOS Settings → Privacy & Security → App Privacy Report. After a week of use, you will see that the Senior Fraud Watch app makes no network contacts other than to our own servers (and only when you trigger an optional feature).

A note on legal applicability: Senior Fraud Watch is a small business and does not currently meet the applicability thresholds of the California Consumer Privacy Act / CPRA (annual revenue over $26.6M, or buying/selling/sharing the personal data of 100,000+ California consumers) or the Colorado Privacy Act (processing personal data of 100,000+ Colorado consumers). We are, however, subject to the FTC Act, which prohibits deceptive or unfair practices regardless of company size. We extend the privacy rights described in this policy voluntarily to all users, regardless of where they live.

1. What We Collect and Why

The table below maps the personal data we collect to the statutory categories defined in California Civil Code §1798.140(v), and states the purpose and retention period for each.

Categories B (financial records beyond subscription status), C (protected classifications), E (biometric), G (geolocation), H (sensory), I (employment), J (education) are not collected.

2. Sources of Personal Information

• Directly from you: Email address provided at sign-in; email text you submit on the manual scan page
• Google OAuth: Email address, Gmail metadata (subject, sender, snippet) when you authorize Gmail integration
• Stripe: Subscription status (we do not receive full payment card data)

3. Third-Party Services We Use

We send personal data to the following service providers to operate the service. We are the data controller; these are processors acting on our behalf. We only send what is necessary.

We do not use third-party advertising networks, analytics services, or tracking pixels. We do not sell, rent, or share your personal data with any party for advertising or marketing purposes. We have not sold or shared personal data in the preceding 12 months.

4. What We Do Not Do

• We do not sell or share your personal data with any third party for commercial or advertising purposes
• We do not use your data for cross-context behavioral advertising or targeted advertising of any kind
• We do not read, store, or analyze full email body content (our Gmail access is limited to metadata only)
• We do not send emails from your Gmail account or modify your inbox in any way
• We do not use your data to train AI models (OpenAI's API does not use submitted data for training by default)
• We do not engage in profiling that produces legal or similarly significant effects on you
• We do not use tracking cookies, advertising cookies, or third-party analytics cookies

5. Your Privacy Rights

We extend the following rights to all users, regardless of where they live. We respond to all requests within 45 days. If we need more time for a complex request, we will notify you within the initial 45-day period and may take up to 45 additional days to respond (90 days total).

How to submit a request: Email privacy@seniorfraudalert.com with the subject line Privacy Request: [Right You Are Exercising]. Include the email address associated with your account so we can verify your identity.

You may designate an authorized agent to submit requests on your behalf. We will require written authorization from you or proof of power of attorney.

6. Appeal Process

If we deny or cannot fully fulfill your privacy request, you may appeal our decision. To do so, email privacy@seniorfraudalert.com with the subject line Privacy Request Appeal and include the original request details and the reason you are appealing.

We will respond to your appeal within 45 days. If the appeal requires additional time due to complexity, we will notify you within 45 days and may take up to 60 additional days to complete our review (105 days total from the date of appeal).

Our response will include a written explanation of our decision. If your appeal is denied, we will provide information about how to escalate your concern to the appropriate government authority:

• Colorado residents: Colorado Attorney General — coag.gov/resources/complaints
• California residents: California Privacy Protection Agency — cppa.ca.gov
• EU/UK residents: Your local data protection supervisory authority

7. Data Retention

• Email scan results (classification, risk score, scam type): 30 days, then automatically and permanently deleted
• Manually submitted email text: Processed in real time and not stored; transmitted to OpenAI's API and then discarded
• Gmail OAuth access token: Encrypted at rest in Supabase; retained until you disconnect Gmail or delete your account
• Account information (email address, subscription status): Retained for the lifetime of your account
• After account deletion: All data deleted within 30 days. OAuth tokens are revoked immediately upon account deletion request

To disconnect Gmail at any time without deleting your account, visit myaccount.google.com/permissions and revoke Senior Fraud Watch's access.

8. Security

We implement technical and organizational measures designed to protect your personal information:

• All data transmitted over HTTPS/TLS encryption
• Gmail OAuth tokens stored encrypted at rest in Supabase (SOC 2 Type II certified infrastructure)
• OAuth tokens refreshed automatically and never exposed client-side
• Gmail access is limited to the gmail.metadata scope: the most restricted available: to minimize data exposure

No method of transmission over the internet is completely secure. We take commercially reasonable steps to protect your information, but we cannot guarantee its absolute security. In the event of a data breach affecting your personal information, we will notify you as required by applicable law.

9. Cookies

We use only essential session cookies required to keep you logged in. We do not use tracking cookies, advertising cookies, or third-party analytics tools.

10. Children's Privacy

Senior Fraud Watch is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

11. EU / UK Residents (GDPR / UK GDPR)

• Lawful basis: Contract performance: processing is necessary to provide the service you subscribed to
• Rights to access, rectification, erasure, restriction, portability, and objection are available via the contact below
• Data transfers outside the EU/EEA use processors (OpenAI, Supabase, Stripe) that maintain Standard Contractual Clauses or equivalent safeguards
• Right to lodge a complaint with your local supervisory authority (e.g., your national data protection authority)

12. Changes to This Policy

If we make material changes to this policy, we will notify you by email at least 14 days before the changes take effect. Non-material changes (such as clarifications) will be reflected by updating the "Last updated" date above.

13. Contact

Senior Fraud Watch
General support: support@seniorfraudalert.com
Privacy requests & appeals: privacy@seniorfraudalert.com

Subject line format for requests: Privacy Request: [Right You Are Exercising]
Subject line for appeals: Privacy Request Appeal