Privacy Policy
The short version: We help you spot scams. When you run an AI check, your message goes to our servers to be analyzed. For a text, URL or photo check we keep only the scam signals afterwards. Scam emails you forward to us we keep in full, so we can study how attackers work and protect people from the next version of the same trick. You can delete your checks whenever you like and they are removed from our servers too. We attach a private device code (not your name) used only to prevent abuse. We never sell your data.
Who we are
Scam Sentinel is a fraud-detection and education app operated by Sentinel Vault Consulting, a sole proprietorship and a Sentinel Vault brand, based in California, USA. For any privacy question or data request, contact [email protected].
Our principles
- On-device first. Where a check can run on your device, it does, and nothing leaves your phone (for example, the offline phone-call wizard).
- What you send, we use to protect you and others. When you send something to us for a check, we keep the content and the result in our own secure, access-controlled systems and use them to make Scam Sentinel more accurate and to protect other users from the same scam. We do not sell it, and we never use it to advertise to you.
- No selling. We do not sell personal data.
- The shared database holds patterns, not people. The crowdsourced scam database other users benefit from stores only de-identified patterns and indicators, never a copy of your messages. The device code we use to prevent abuse is not your name.
- Transparency. We tell you, in plain language, what each feature does with your data before you enable it.
The phone-call check (on your device)
The “suspicious phone call” check runs entirely on your phone against a list built into the app. Nothing about it leaves your device.
The AI text and email check
When you paste or scan a suspicious text or email and tap Analyze, the message is sent to our servers and our AI provider (Anthropic) to produce a plain-language verdict, the tactics it found, and matching current scam reporting. For a pasted or scanned text, we delete the message right after we pull out the scam signals (numbers, links, sender) and a de-identified pattern of the scam. Emails you FORWARD to us are treated differently and kept, which the next section explains. For the shared scam database we keep the pattern and the signals, never a copy of your message. If you are signed in, a short preview and the verdict are also saved to your Check history (below), which you can delete. Free users get a small number of AI checks each day. Premium unlocks unlimited checks.
Emails you forward to us
When you forward a suspicious email to us, we keep the whole original message, including its hidden technical headers, until you delete it.
You can do this from any device, not just this one. Forwarding a suspicious email to our scan address works from your computer, your webmail in a browser, your tablet, or a different phone — wherever the email is easiest to reach. It is the same account and the same check either way, and the result appears in this app. Many people read mail on a phone but keep the awkward ones on a desktop, and you should not have to move an email to your phone to have it looked at.
We are telling you this plainly because it is a real trade and you should get to judge it. Scam email in 2026 does not look like scam email in 2025. Attackers now use AI to write clean, personalized lures, hide text inside invisible characters, disguise attachments as harmless file types, and buy aged domains so their mail passes every reputation check. Working out how a new trick functions, and building a detection that catches it for everyone else, needs the actual message. A summary of a scam is not enough to learn from; the evidence is in the raw thing.
The hidden headers matter most. They record which servers really sent the mail and whether the sender was genuinely who they claimed, and they exist nowhere except the original. They are also how we tell a real scam from a false alarm when we get one wrong.
You stay in control. Delete any forwarded check, or clear them all, and the original message is destroyed on our servers along with it. What we keep after that is what we already learned from the scam itself: the sender address, the links, the domains, the file types, and the pattern of the trick. That information is about the criminal, not about you, and it is not linked back to your account.
We do not use these messages for advertising, we do not sell them, and we do not use them to build a profile of you.
Your check history
When you are signed in, we keep a history of your checks so you can look back on what you checked and when. Each entry has the date and time, the type of check, the verdict, our result, and a short preview of what you checked, tied to your account so it shows on your devices. It is your own private record, separate from the anonymized scam database. You can delete any entry or clear your whole history at any time, and deleting removes it from our servers. Free accounts see the last 30 days; Premium keeps everything.
The private device code
Each AI check carries a private device code created from Apple App Attest and a value stored on your phone.
Each AI check carries a private device code created on your phone the first time you open the app.
The photo check
If you submit a photo to check whether someone is who they say they are, we send it to Google Cloud Vision to look for other places that image appears online, and to Sightengine to estimate whether it was AI-generated. We use the results to answer your question and do not keep the photo afterwards. Please only submit a photo you are allowed to share.
Threat reporting
If you report a number, sender, or message as a scam, we store the reported indicator and minimal context to protect other users. Reports may be rate-limited and reviewed to prevent abuse.
News and alerts
The News tab and the cited reporting shown after a check come from The Nexus, a fraud-intelligence service, and are fetched by our servers. Reading them sends The Nexus nothing about you.
Protection features (call, text, and email filtering)
If you turn on call protection, message filtering, or email checks, your device or our servers check those items for scams.
Call protection. We periodically send your device an updated list of known-scam phone numbers, and the matching happens entirely on your device as an offline lookup with no network call while your phone is ringing. We are never told which calls you receive. A match is labeled on the native call screen as “Likely Scam” so you can decide whether to answer; Scam Sentinel does not block calls on iPhone.A match is blocked before your phone rings. It still appears in your call log, and we post a notification telling you it was blocked.
For text-message filtering, your iPhone first checks messages from people who are not in your contacts against a list built into the app, and routes a known scam to Junk without anything leaving your device. Only if that check finds nothing AND the message contains a link or a phone number does your iPhone send it to us for a Junk or Not-Junk answer — a plain message with neither never leaves your phone. When we are asked, we return a verdict and keep the scam signals (such as the sender’s number) only when the message IS a scam. If it is not a scam we keep nothing at all: no message, no number, no record.
Scam Sentinel does not filter your text messages on Android.
Guardian and Family Circle
If you add a guardian, or are added as one, we store the pairing and a notification token to deliver alerts. When a scam text or email is detected, or a call you report, we notify your guardian of the event (time, channel, scam category). Guardians do not see message contents by default. Both people can view and revoke the pairing at any time.
Account and subscription
Purchases are handled by Apple through the App StoreGoogle through Google Play; we do not receive your card details. We store your subscription status to unlock premium features, and we may store an app-generated account identifier and your Guardian contact information.
Diagnostics and analytics
Our default posture is minimal, with no third-party advertising SDKs. The app does not currently use Google Analytics or any other usage-analytics SDK; if that changes, we will name the provider and the data here.
Our website, scamsentinel.app, uses Google Analytics to understand traffic: which pages are visited, how long, and general device, browser, and approximate location (from your IP address, not exact). We have not enabled Google Signals or ad personalization, so this data is not used to build an advertising profile of you or to target ads.
What we never do
We do not sell your personal data. We do not show ads or use advertising trackers. We do not read your mailbox or monitor your messages in the background.
How we use data
To detect and warn about scams; to maintain and improve the threat database; to improve our detection accuracy using the content you submit for checks; to deliver Guardian alerts; to provide and bill premium features; and to keep the service secure and prevent abuse.
Who helps us run the service
Apple (billing, notifications, device verification)Google (Google Play billing and Firebase Cloud Messaging notifications), Anthropic (the AI analysis), The Nexus (news content, fetched by our servers), Twilio (phone-number reputation), Google (link reputation via Web Risk, and reverse-image search via Cloud Vision when you run a photo check), Sightengine (checks whether a photo you submit was AI-generated), urlscan.io (safely opens a suspicious link on our behalf to see where it really goes; our scans are submitted privately and never appear in their public feed), SendLayer (sends our emails to you, such as sign-in codes and check results), RDAP registries (tell us how old a scam’s website domain is), mempool.space and TronGrid (public blockchain lookups, when a scam names a Bitcoin or Tron address, so we can tell you whether money has already moved through it), and DigitalOcean (hosting). The last three receive only the scam’s own details — a domain or a crypto address — never anything about you. We may disclose abuse-related information to AppleGoogle and law enforcement.
How long we keep things
Content from a pasted text, URL or photo check is deleted right after the verdict. An email you forward is kept in full until you delete it (see above), and deleting it destroys the original on our servers. De-identified scam patterns and signals are kept while they are useful for protecting people. The private device code is kept only as long as needed to prevent abuse. If you’re signed in, your Check history is kept until you delete it. Free accounts see the last 30 days, and you can clear it any time.
Your choices and rights
You can turn any feature off in Settings at any time. To request a copy of your data or its deletion, email us at [email protected]. California residents may make the same requests by email. Deleting your account does not cancel an App Storea Google Play subscription — that is held by AppleGoogle, so you cancel it in your device settings.
Children
Scam Sentinel is not directed to children under 13, and we do not knowingly collect their data.
Security
We protect your information with encryption in transit and at rest, access controls, and data minimization. No method is perfectly secure, but we work to keep your information safe.
Changes
We will post updates here and tell you in the app about important changes.
Contact
[email protected] Sentinel Vault Consulting (sole proprietorship), California, USA