Privacy
what leaves the phone, what stays.
Content leaves the phone only after the person agrees, sensitive numbers are replaced on the phone and again on the server before any model or service sees text, uploads are deleted when the check ends, and results are deleted after 24 hours by default.
01Nothing is sent before consent
The first time a check needs the server, the app shows a consent screen that names the outside services your server uses. Nothing is sent until the person agrees; declining keeps the app in local-only mode. When a service, its vendor or its address changes, or the consent text changes in a new version, the app asks again. Details: Consent.
02Sensitive numbers are replaced
Before any text leaves the phone, the app replaces these, and the server runs the same rules again on everything it receives or makes itself (a transcript, the text of a screenshot, the body of an e-mail) before any model or outside service sees it:
| What | Becomes | How it is recognised |
|---|---|---|
| Payment card numbers | [card ending 1234] | 13 to 19 digits starting with 2 to 6 that pass the Luhn check, also with spaces, dots or dashes |
| IBANs | SK•• •••• 1234 | The registered length of the country and a valid mod-97 check |
| Czech and Slovak domestic account numbers | [account ending 1234] | prefix-number/bank with a listed bank code and valid mod-11 checks |
| CVV and CVC codes | [code] | 3 or 4 digits after CVV, CVC |
| One-time codes and PINs | [code] | 4 to 8 digits near a code word such as code, PIN, OTP, TAN, kód |
| Passwords | [password] | What follows "password", "heslo", "Passwort", "pwd" or "pass" with : or =, or "password is …" |
| Czech and Slovak birth numbers | [id] | 6 + 3 or 4 digits with a valid check, a plausible month and day |
Links are treated differently, so they can still be checked: the address is sent as it is, and only the values after ? or # are cleaned with the rules above. On the server, the path of a link is also cleaned of card numbers, IBANs and birth numbers, of a password in the address (user:password@), and of codes and passwords in the path when a code word or password label stands right before the link. Text that only looks like a link (no real web address ending) is treated as plain text and cleaned in full. Pictures, videos and recordings are sent as they are, and the consent screen says so.
The rules are tested on both sides against shared files of examples: contract/redaction-vectors.json for text and contract/redaction-link-vectors.json for links.
03What the server keeps, and for how long
| What | Kept |
|---|---|
| Uploaded images, recordings, videos and e-mails | Stored in a private folder under a random name only while the check runs, then deleted. See Uploads. |
| The check result (verdict and findings) and a SHA-256 fingerprint of an uploaded file | 24 hours by default, so the app can fetch the result; console, Privacy, 1 to 720 hours. Then deleted. |
| Provider answers about a link or file | A short cache (at most 24 hours for Web Risk, under a hash of the address), so the same link checked twice is not paid twice. |
| Installs | A random install id and its public key, plan and daily usage counters. No name, e-mail or phone number: the app has no accounts. |
| Trend counts | Only from installs that opted in, as counts per day and scam type. See Trends privacy. |
05Trends
The home screen can show which scam types people checked recently. Only installs that turned sharing on are counted, numbers are shown only when enough different installs took part, and every number is rounded down to a multiple of 5. Full rules: Trends privacy.
06On the phone
- App lock: an optional PIN, stretched with PBKDF2-HMAC-SHA256, and fingerprint or face unlock. Screens with checked content go blank behind the lock.
- Backups: the app's data folder is excluded from iCloud backups, and Android backups are off (
allowBackup="false"plus data extraction rules). - History keeps only the answer per axis of past checks, never the findings or the content, and can be cleared.
- Evidence locker: saved checks and kept originals, encrypted with AES-256-GCM under a key in the platform's secure storage, never uploaded. See Evidence locker.
- Sharing into the app: the share entries copy only the one item the person shared, within the size caps, into the app's own storage; nothing is read in the background, and copies of earlier shares are swept away.
- Camera and photos: the camera is used only to scan a QR code or take a photo to check; photos and videos are picked one at a time through the system picker.
- Apple privacy manifests: the app and its Share Extension each carry a
PrivacyInfo.xcprivacy. The app declares e-mails or text messages, photos or videos, audio, other user content, a device id and purchase history, all for app functionality, not linked to the person and not used for tracking.
07Requests without content
Before and without consent, the app still fetches its configuration (/v1/config: limits, the services list, Pro and ads settings), the home screen alerts and the trends. These requests are signed by the install and carry no checked content.
08Your privacy policy
You are the operator, so the privacy policy shown to your users is yours. Put its link in the console's Legal section. Name the services you switched on, the retention you set, that trends are opt-in, and the notice that link warnings can miss pages and can flag harmless ones (required by Google for Web Risk, see Web Risk).