Privacy Policy
1. Who we are
Scam Sentinel is a consumer fraud-detection and education app operated by Sentinel Vault Consulting (a sole proprietorship), a Sentinel Vault brand, in California, USA. This policy explains what we collect, why, who we share it with, and your choices. For any privacy question or data request, contact support@sentinelvault.net.
2. Our principles
- On-device first. Where a check can run on your device, it does, and nothing leaves your phone (for example, the offline phone-call wizard).
- What you send, we use to protect you and others. When you send something to us for a check, we keep the content and the result in our own secure, access-controlled systems and use them to make Scam Sentinel more accurate and to protect other users from the same scam. We do not sell it, and we never use it to advertise to you.
- No selling. We do not sell personal data.
- The shared database holds patterns, not people. The crowdsourced scam database other users benefit from stores only de-identified patterns and indicators, never a copy of your messages. The device code we use to prevent abuse is not your name.
- Transparency. We tell you, in plain language, what each feature does with your data before you enable it.
3. What we collect, by feature
On-device phone-call wizard (free)
Runs entirely on your device against a bundled rules file. No call data, answers, or results leave your device. No collection.
Call protection: Live Caller ID Lookup
At call time your iPhone performs a privacy-preserving lookup against our service. By design, our server cannot see which number was looked up or that you received a call. We learn nothing about your calls.
Call protection: known-scam list
We periodically send your device an updated list of known-scam phone numbers. The matching happens on your device; we are not told which calls you receive.
Text message filtering (unknown senders only)
When enabled, your iPhone routes text messages from people not in your contacts to our filter. To classify a message we may send its content and sender to our server, and we use it to return a Junk or Not-Junk verdict, to extract scam signals (such as a scam link or sender ID), and to improve our detection over time. We keep filtered content in our secure systems for that purpose, and we never process messages from your contacts or iMessage.
Email analysis (you start it)
We only see an email if you send it to us, by sharing it to the app or forwarding it to your Scam Sentinel address. We analyze the full message to return a verdict and extract scam indicators, and we keep the message in our secure systems to improve detection and protect other users. We never access your mailbox or read email in the background.
Threat reporting
If you report a number, sender, or message as a scam, we store the reported indicator and minimal context to protect other users. Reports may be rate-limited and reviewed to prevent abuse.
Guardian and Family Circle
If you add a guardian, or are added as one, we store the pairing and a notification token to deliver alerts. When a scam text or email is detected, or a call you report, we notify your guardian of the event (time, channel, scam category). Guardians do not see message contents by default. Both people can view and revoke the pairing at any time.
Account and subscription
Purchases are handled by Apple through the App Store; we do not receive your card details. We store your subscription status to unlock premium features, and we may store an app-generated account identifier and your Guardian contact information.
AI scam check
When you choose to check a suspicious text or email by pasting or scanning it, the content is sent to our backend and our AI provider to produce a plain-language verdict, the tactics it found, and matching current scam reporting. We extract scam indicators (numbers, links, sender IDs) and a de-identified pattern, and we retain what you submitted in our secure systems to keep improving how Scam Sentinel spots scams. For the shared threat database that other users benefit from, we keep only the de-identified pattern and indicators, never a copy of your message. If you are signed in, a short preview and the verdict are also saved to your personal Check history (below), which is yours to delete.
Check history
When you are signed in, we keep a history of the checks you run so you can look back on what you checked and when. Each entry stores the date and time, the type of check (text, email, link, call, or a guided wizard), the verdict, our plain-language result, and a short preview of what you checked. It is tied to your account so it appears across your devices. This is your own private record, separate from the anonymized threat database above. You can delete any entry, or clear your entire history, at any time — deleting removes it from our servers. Free accounts see their last 30 days; Premium keeps the full history.
Device integrity and abuse prevention
To keep the AI check and the crowdsourced scam database honest, each AI check carries a pseudonymous device code derived from Apple device attestation and a value stored on your device. It is not your name, email, or phone number, and it is not sold. We use it only to fairly count your free daily checks, to detect and stop abuse of the database, and to require independent corroboration before a reported scam pattern is trusted. We keep the de-identified pattern database separate from an access-controlled integrity log used only for abuse prevention. In cases of serious abuse or illegal activity, we may preserve and disclose integrity-log data to Apple or law enforcement.
News and education content
The News tab and the cited reporting shown after a check are fetched by our backend, not by your phone. Reading the News tab or seeing a cited alert sends nothing about you to the content source.
Diagnostics
Our default posture is minimal, with no third-party advertising SDKs. If we add crash or usage analytics, we will name the provider and the data here and make it opt-out where required.
4. How we use data
To detect and warn about scams; to maintain and improve the threat database; to improve our detection accuracy using the content you submit for checks; to deliver Guardian alerts; to provide and bill premium features; and to keep the service secure and prevent abuse.
5. Who we share with
- Apple for App Store billing, notifications, iOS framework lookups, and device verification.
- Our AI provider for analysis of the text or email content you submit for a check, to produce a verdict. Our AI provider does not use your content to train its own models.
- Our fraud-news source for scam news and education, fetched by our backend; we send it no user data.
- Data providers for phone-number and link reputation used in threat scoring.
- Hosting and infrastructure for our backend.
- We may disclose integrity or abuse data to Apple or law enforcement in cases of abuse or illegal activity.
We require these providers to protect data and use it only to provide their service. A full, current provider list is maintained as features launch.
6. Retention and minimization
- Content you submit for a check (text filter, email, and AI checks): retained in our secure, access-controlled systems and used to improve detection accuracy and protect other users. We do not sell it or use it for advertising, and you can request deletion of your data at any time (see Your choices and rights).
- De-identified scam patterns: retained to power detection and caching, with no personal content.
- Pseudonymous device code and integrity log: retained for abuse prevention only, access-controlled, for a limited period.
- Extracted threat indicators (scam numbers, links, sender IDs): retained to protect users, with confidence decay over time.
- Account and subscription status: retained while your account is active.
- Guardian pairings and alert events: retained while the pairing exists.
7. Your choices and rights
- Turn off text filtering, call protection, or Guardian at any time in Settings.
- Delete your account and associated data by contacting support@sentinelvault.net.
- Region-specific rights for California (CCPA and CPRA) and the EU and UK (GDPR) will be added before we serve those markets.
8. Children
Scam Sentinel is not directed to children under 13 (or the applicable age), and we do not knowingly collect their data.
9. Security
We use encryption in transit and at rest, access controls, and data minimization. No method is perfectly secure, and we work to protect your information.
10. Changes
We will post updates here and, for material changes, notify you in the app.
11. Contact
support@sentinelvault.net · Sentinel Vault Consulting (a sole proprietorship), California, USA.