ScamShot AI Privacy Policy

The information ScamShot processes depends on how you use the Services.

Account Information

When you create a ScamShot account, we may collect information such as:

• Email address
• Display name
• Authentication information
• Account identifier
• Profile preferences
• Account creation and update dates
• Subscription tier
• Notification preferences
• Data-retention preferences

Passwords are handled through our authentication provider and are not stored by ScamShot in readable form.

If you use a supported third-party sign-in provider, such as Apple or Google, we may receive information that provider makes available to us, such as an account identifier, email address, or name, depending on your settings with that provider.

ScamShot Submissions

When you ask ScamShot to analyze something, you may provide:

• Screenshots
• Photographs
• Text messages
• Email content
• Social-media or marketplace messages
• URLs and domain names
• Phone numbers
• QR codes
• Documents
• Letters
• Invoices
• Payment requests
• Other content you choose to submit

These submissions may contain personal information about you or other people.

For example, a screenshot could contain names, phone numbers, email addresses, account information, transaction amounts, addresses, or other information visible in the image.

You should avoid submitting sensitive information that is unnecessary for ScamShot to perform the requested analysis.

ScamShot may automatically identify information contained in a submission, including:

• URLs
• Domain names
• Phone numbers
• Email addresses
• Claimed organizations or businesses
• Payment amounts
• Cryptocurrency wallet addresses
• Requested actions
• Requests for passwords or credentials
• Requests for verification codes
• Requests for payment
• Gift-card requests
• Remote-access software references
• Other scam or fraud indicators

ScamShot may also generate information such as:

• Risk level
• Scam-likelihood score
• Confidence score
• Scam category
• Warning indicators
• Recommended actions
• Verification guidance
• AI-generated explanations

These assessments are automated estimates and should not be considered guarantees that something is legitimate, safe, fraudulent, or malicious.

ScamShot uses artificial intelligence to analyze user-submitted content.

When necessary to provide an analysis, submitted text, images, or related information may be transmitted to third-party AI service providers, including OpenAI, for processing.

We use these services to perform functions such as:

• Identifying potential scam indicators
• Interpreting screenshots and documents
• Identifying suspicious requests
• Categorizing potential scams
• Generating explanations
• Providing recommended next steps
• Responding to follow-up questions through Ask ScamShot

We design ScamShot so that AI requests are made through our secured server infrastructure rather than directly exposing AI service credentials in the mobile application.

ScamShot does not rely on AI output as an absolute determination of whether something is safe or fraudulent.

Depending on your settings and the features you use, ScamShot may store:

• Scan records
• Submitted images
• Extracted information
• AI-generated analysis
• Risk assessments
• Follow-up conversations
• Scan timestamps
• Scan categories

ScamShot may provide settings that allow you to control how long certain scan information is retained.

Available retention options may include:

• Keeping ScamShots until you delete them
• Automatically deleting eligible ScamShots after a specified period
• Deleting submitted images after analysis while retaining the resulting assessment

Retention options may evolve as the Services are updated.

ScamShot may use information derived from reported or analyzed scams to help identify recurring scam campaigns and emerging fraud patterns.

For example, ScamShot may derive indicators such as:

• Domain fingerprints
• URL characteristics
• Hashed identifiers
• Message-pattern fingerprints
• Scam categories
• Claimed organizations
• Payment methods
• Scam techniques

Where used for shared scam intelligence, we aim to separate these indicators from the private content associated with a user's individual ScamShot.

We do not make a user's private screenshots or complete private scan history publicly available as part of the ScamShot intelligence system.

Aggregated or de-identified scam information may be retained to help detect and prevent fraud even after the original user submission has been deleted, where the retained information is no longer reasonably linkable to the user.

ScamShot Family allows users to share selected scam analyses with trusted family members or other invited participants.

Private by Default

Your ScamShot history is not automatically visible to Family members.

A Family member may view a ScamShot only when:

• You explicitly share it with that person, or
• You otherwise authorize access through a Family feature.

Depending on the sharing options selected, shared information may include:

• The ScamShot analysis
• Risk level
• Warning indicators
• Recommended actions
• Your question or message
• The original screenshot or image, if you specifically permit image access

Family members may also communicate through discussion threads connected to a shared ScamShot.

ScamShot Family is not intended to provide hidden surveillance or automatic monitoring of another person's activity.

If you invite someone to ScamShot Family, we may process information including:

• Their email address
• Invitation code
• Invitation status
• Family membership status
• Display name
• Relationship label, if provided
• Shared ScamShot activity

We limit family-visible account information to information needed to provide Family functionality.

ScamShot may offer paid subscriptions, including ScamShot Pro and ScamShot Family.

Mobile purchases are processed through:

• Apple App Store
• Google Play
• RevenueCat

We do not directly receive or store your complete payment-card information for App Store or Google Play purchases.

We may receive subscription-related information such as:

• Subscription status
• Product purchased
• Entitlement
• Purchase status
• Renewal status
• Expiration date
• Store platform
• Transaction or subscription identifiers

This information is used to determine which ScamShot features your account may access.

Deleting your ScamShot account does not necessarily cancel a subscription billed through Apple or Google. Users may need to separately manage or cancel subscriptions through the applicable app store.

If you allow notifications, ScamShot may send push notifications regarding:

• Family help requests
• Family replies
• ScamShot sharing activity
• Scam campaign alerts
• Account or security notices
• Service-related information

To provide push notifications, ScamShot may store:

• Push notification token
• Device platform
• Device identifier or installation identifier
• Notification preferences

We attempt to minimize sensitive information displayed in push notifications, particularly on device lock screens.

You may disable notifications through the ScamShot application or your device settings.

We may automatically collect limited technical information needed to operate, secure, diagnose, and improve the Services, including:

• Device platform
• Application version
• Operating-system version
• Error information
• Network status
• Feature usage
• Authentication/session status
• Subscription tier
• Scan input type
• General application performance information

We design analytics so that raw scam submissions, screenshots, message content, phone numbers, and similar sensitive scan information are not intentionally included in general product analytics.

We may use information collected through ScamShot to:

• Provide scam-risk analyses
• Identify suspicious patterns
• Generate AI explanations and recommendations
• Maintain scan history
• Provide Ask ScamShot functionality
• Provide ScamShot Family features
• Send requested notifications
• Verify subscription access
• Enforce usage limits
• Detect abuse and misuse
• Protect user accounts
• Diagnose technical problems
• Improve ScamShot functionality
• Develop scam detection techniques
• Identify emerging scam campaigns
• Maintain and secure our infrastructure
• Comply with applicable legal obligations

We do not sell personal information to advertisers.

We may disclose information to service providers that process information on our behalf when necessary to operate ScamShot.

These providers may include companies that provide:

• Cloud hosting and database services
• Authentication
• AI processing
• Subscription management
• Mobile application distribution
• Push notifications
• Infrastructure monitoring

Current or anticipated providers include:

Supabase

Used for database, authentication, file storage, server-side functions, and related backend infrastructure.

OpenAI

Used to perform AI-powered analysis and follow-up assistance.

RevenueCat

Used to manage subscription entitlement information and interactions with Apple and Google subscription systems.

Apple

Apple may process information relating to iOS distribution, authentication, purchases, subscriptions, and other Apple platform services.

Google

Google may process information relating to Android distribution, authentication, purchases, subscriptions, and other Google platform services.

These companies process information under their own terms and privacy policies where applicable.

We may disclose information where we reasonably believe disclosure is necessary to:

• Comply with applicable law
• Respond to lawful legal process
• Protect the rights or safety of users or others
• Investigate fraud or abuse
• Protect ScamShot infrastructure
• Enforce applicable agreements
• Prevent malicious or unlawful activity

Where legally permitted, we seek to limit disclosures to information reasonably necessary for the relevant purpose.

ScamShot does not sell users' private ScamShot submissions, screenshots, or personal information to advertisers.

We do not provide advertisers with access to private ScamShot conversations or submissions for targeted advertising.

We use technical and organizational measures designed to protect information processed by ScamShot.

These measures may include:

• Authentication
• Database access controls
• Row-Level Security
• Private storage
• Server-side authorization
• Access-limited file URLs
• Input validation
• Rate limiting
• Restricted service credentials
• Secure server-side AI requests

However, no method of electronic storage, transmission, or processing can be guaranteed to be completely secure.

You should avoid submitting information that is unnecessary for the analysis you request.

We retain personal information for as long as reasonably necessary to:

• Provide the Services
• Maintain your account
• Provide requested scan history
• Fulfill your selected retention settings
• Maintain security
• Prevent fraud or abuse
• Meet applicable legal obligations

Where supported, ScamShot may automatically delete eligible scans based on your selected retention preference.

Certain de-identified, aggregated, or hashed threat intelligence may be retained for longer periods where it cannot reasonably be associated with you and is useful for identifying scams or protecting users.

Backup systems may retain deleted information for a limited period before routine deletion.

Where available, you may delete individual ScamShots through the application.

Deleting a ScamShot is intended to remove associated private information from active ScamShot systems, including associated uploaded images where applicable.

Some anonymized or de-identified scam intelligence derived from the submission may remain if it cannot reasonably be linked back to you.

You may request deletion of your ScamShot account through the application.

Account deletion may result in deletion or anonymization of information associated with your account, including:

• Profile information
• ScamShot history
• Stored images
• Follow-up messages
• Family relationships
• Family invitations
• Push notification tokens
• Usage information
• Other account-associated data

Certain information may be retained where required by law, necessary to prevent fraud or abuse, or where it has been irreversibly de-identified.

If you need assistance deleting your account, contact:

support@scamshot.app

Deleting your ScamShot account may not automatically cancel an Apple App Store or Google Play subscription.

Depending on your location and applicable law, you may have rights concerning your personal information, including the right to:

• Request access
• Request correction
• Request deletion
• Request a copy of certain information
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent
• Appeal certain privacy decisions

To submit a privacy request, contact:

privacy@scamshot.app

We may need to verify your identity before fulfilling certain requests.

California residents may have additional rights under applicable California privacy laws.

Depending on whether applicable thresholds and requirements apply to ScamShot, these rights may include:

• The right to know what personal information is collected
• The right to request deletion
• The right to request correction
• The right to receive information about disclosures of personal information
• The right to opt out of certain sales or sharing of personal information
• The right not to receive discriminatory treatment for exercising privacy rights

ScamShot does not sell personal information to advertisers.

Requests may be submitted to:

privacy@scamshot.app

ScamShot is not designed for children under the age of 13.

We do not knowingly collect personal information directly from children under 13.

If you believe a child under 13 has provided personal information through ScamShot, contact us at:

privacy@scamshot.app

and we will review the matter and take appropriate action.

If ScamShot later offers functionality specifically intended for minors, this Privacy Policy may be updated accordingly.

ScamShot submissions may sometimes contain sensitive information.

Examples may include:

• Financial information
• Authentication information
• Health-related content appearing in a message or document
• Government identifiers
• Addresses
• Account numbers
• Other private communications

Please submit only information reasonably necessary for ScamShot to analyze the suspected scam.

Where possible, redact unnecessary sensitive information before submitting screenshots or documents.

ScamShot may identify or display URLs contained in submitted content.

A URL appearing in ScamShot should not be interpreted as an endorsement or verification of that website.

ScamShot attempts to present suspicious destinations safely and does not automatically open QR-code destinations as part of the analysis process.

Third-party websites have their own privacy policies and practices.

ScamShot uses automated systems to generate scam-risk assessments.

These systems may generate:

• Risk classifications
• Risk scores
• Scam categories
• Warnings
• Recommended actions

ScamShot assessments are informational tools intended to assist human decision-making.

They are not guarantees, legally binding determinations, credit decisions, insurance decisions, employment decisions, or professional financial or legal advice.

Service providers used by ScamShot may process information in the United States and other countries.

As a result, your information may be processed in jurisdictions with different privacy laws than those where you live.

Where required, we use appropriate safeguards for international processing.

We may update this Privacy Policy as ScamShot changes.

When we make material changes, we may provide notice through:

• The application
• Our website
• Email
• Another appropriate method

The updated policy will display a revised Last Updated date.

Your continued use of ScamShot after an updated Privacy Policy becomes effective is subject to applicable law.

Privacy Questions and Requests

privacy@scamshot.app

Use this address for:

• Privacy questions
• Data-access requests
• Data-deletion requests
• Privacy-rights requests
• Concerns about personal information

Customer Support

support@scamshot.app

Use this address for:

• Technical support
• Account assistance
• Subscription assistance
• ScamShot functionality questions

General Contact

contact@scamshot.app

Use this address for:

• General inquiries
• Business inquiries
• Partnership requests
• Other communications