Privacy Policy

Overview

ScamBrake ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our scam detection service.

This service includes controls intended to support rights under:

• GDPR (General Data Protection Regulation) - EU/UK
• CCPA (California Consumer Privacy Act)
• CPRA (California Privacy Rights Act)
• VCDPA (Virginia Consumer Data Protection Act)
• CPA (Colorado Privacy Act)
• CTDPA (Connecticut Data Privacy Act)
• UCPA (Utah Consumer Privacy Act)

What Data We Collect

1. Account Information

• Email address (required for account creation)
• Display name (optional)
• Authentication tokens
• Subscription tier (free, premium, enterprise)
• Account creation and last sign-in timestamps

2. Scam Detection Data

• Local detection results stay on your device by default
• Optional cloud history: risk level, category, confidence, reason codes, time, channel, and provider
• Optional AI: the exact masked text shown in the confirmation dialog, plus derived signals and a normalized sender domain
• We do not store message bodies, subjects, or sender identities in alert history

3. Device Information

• Device IDs (for sync across devices)
• Device type (extension, mobile, web)
• Browser type and version
• Operating system
• IP address (for security and rate limiting)

4. Caregiver System Data

• Caregiver email addresses
• Permission levels (view, manage)
• Invitation status and timestamps
• Relationship links between users

5. Communication Data

• Email delivery status (sent, delivered, opened)
• Support correspondence
• Feedback and survey responses

6. Analytics & Usage Data

• API request logs
• Error logs and debugging information
• Performance metrics
• Feature usage statistics

How We Use Your Data

We use collected data exclusively for the following purposes:

Service Provision

• Detect potential scams locally and display warnings on your device
• Provide an AI second opinion only when you enable it and confirm a request
• Provide metadata-only alert history when you enable cloud history
• Share opted-in warning metadata with accepted caregivers only when separately enabled

Communication

• Send transactional emails (alerts, confirmations)
• Notify caregivers of high-risk scams
• Respond to support requests
• Send important service updates

Improvement & Security

• Improve scam detection algorithms
• Debug and fix technical issues
• Monitor for abuse and fraud
• Ensure system security and stability

Legal Compliance

• Comply with legal obligations
• Respond to lawful requests
• Protect our legal rights
• Prevent fraud and illegal activity

Data Sharing & Third Parties

We share your data only in the following limited circumstances:

Service Providers

We use the following third-party services to operate ScamBrake:

• Supabase: Database and authentication (EU/US data centers)
• OpenAI: AI-powered scam classification
• Resend: Transactional email delivery
• Railway: Infrastructure and hosting
• Sentry: Error tracking and monitoring
• PostHog: Optional anonymous product analytics after explicit consent

Optional features are disabled by default. The relevant provider receives data only when that feature is enabled and used.

Caregiver Sharing (Opt-In Only)

If you invite a caregiver, we share your scam alerts with them. This is entirely optional and you control who has access.

Legal Requirements

We may disclose your information if required by law, court order, or government request, or to protect our legal rights.

Business Transfers

If ScamBrake is acquired or merged, your data may be transferred to the new owner. You will be notified of any such change.

Your Privacy Rights

You have extensive rights regarding your personal data:

GDPR Rights (EU/UK/EEA Users)

• Right to Portability: Export your data in machine-readable format
• Right to Object: Object to processing of your data
• Right to Restrict: Limit how we process your data
• Right to Withdraw Consent: Withdraw consent at any time
• Right to Lodge Complaint: File complaint with your data protection authority

CCPA/CPRA Rights (California Users)

• Right to Know: Know what personal information is collected
• Right to Delete: Request deletion of personal information
• Right to Opt-Out:Opt-out of sale of personal information (N/A - we don't sell data)
• Right to Correct: Correct inaccurate personal information
• Right to Limit: Limit use of sensitive personal information
• Right to Non-Discrimination: Not be discriminated against for exercising rights

Other US State Rights (VA, CO, CT, UT)

• Right to access, delete, correct, and port your data
• Right to opt-out of targeted advertising and profiling
• Right to appeal if we deny your request

Security Measures

We implement industry-standard security measures to protect your data:

• Encryption: All data encrypted in transit (TLS/HTTPS) and at rest
• PII Masking: Personal information automatically masked before AI analysis
• Access Controls: Strict access controls and authentication
• Data minimization: Strict request allowlists and database constraints prevent message content from entering cloud history

Data Retention

We retain your data only as long as necessary:

• User Accounts: Until you request deletion
• Alert and scan metadata: Until you delete individual records or your account
• Consent audit records: Retained only as needed for compliance and anonymized when your account is deleted

A confirmed deletion request removes operational account data immediately. Any minimum consent record retained for compliance is anonymized.

Cookies & Tracking

We use the following types of cookies:

Essential Cookies (Required)

• Authentication and session management
• Security and fraud prevention
• Load balancing

Analytics Cookies (Optional)

• Usage statistics and performance monitoring
• Error tracking

Analytics is off by default. You can explicitly enable or disable it in Privacy Settings.

Third-Party Cookies

We do not use advertising cookies. PostHog product analytics is optional and requires explicit consent.

Do Not Track & GPC

We respect Do Not Track (DNT) signals and Global Privacy Control (GPC) headers. If enabled, we will automatically opt you out of non-essential tracking.

International Data Transfers

Our hosting and optional service providers may process data in regions outside your country. Review the providers listed above and contact us for current transfer details before enabling optional cloud features.

Children's Privacy

ScamBrake is not intended for users under 13 years old (or 16 in the EU). We do not knowingly collect data from children. If you believe we have collected data from a child, please contact us immediately at privacy@scambrake.com.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via:

• Email notification to your registered email
• Notice on our website and app
• Updated "Last updated" date at the top of this policy

Continued use of ScamBrake after changes constitutes acceptance of the updated policy.

Contact Us

Questions about this privacy policy or want to exercise your rights?