On this page (23 sections)
Privacy Policy
The short version: We help you spot scams. When you run an AI check, your message goes to our servers to be analyzed. For a photo check we keep only the scam signals afterwards. Texts and links you check, and scam emails you forward to us, we keep in full, so we can study how attackers work and protect people from the next version of the same trick. You can delete your checks whenever you like and they are removed from our servers too. We attach a private device code (not your name) used only to prevent abuse. We never sell your data.
Who we are
Scam Sentinel is a fraud-detection and education app operated by Sentinel Vault Consulting, a sole proprietorship and a Sentinel Vault brand, based in California, USA. For any privacy question or data request, contact support@sentinelvault.net.
Scam Sentinel is offered only in the United States, and we design our data practices around U.S. law. We do not offer or market the app to people in the European Union or the United Kingdom.
Our principles
- On-device where we can. Some checks run entirely on your device and nothing about them leaves your phone, such as the offline phone-call wizard. Running on your device is not by itself a promise that nothing is sent, so the section for each check below says what it sends us.
- What you send, we use to protect you and others. When you send something to us for a check, we keep the content and the result in our own secure, access-controlled systems and use them to make Scam Sentinel more accurate and to protect other users from the same scam. We do not sell it, and we never use it to advertise to you.
- No selling. We do not sell personal data.
- The shared database holds patterns, not people. The crowdsourced scam database other users benefit from stores only de-identified patterns and indicators, never a copy of your messages. The device code we use to prevent abuse is not your name.
- Transparency. We tell you, in plain language, what each feature does with your data before you enable it.
The phone-call check (on your device)
The “suspicious phone call” check runs entirely on your phone against a list built into the app. Nothing about it leaves your device.
The AI text and email check
When you paste or scan a suspicious text or email and tap Analyze, the message is sent to our servers and our AI provider (Anthropic) to produce a plain-language verdict, the tactics it found, and matching current scam reporting. For a pasted or scanned text, and for a link you check, we keep the full message or link, along with the scam signals we pull out of it (numbers, links, sender) and a pattern of the scam. We keep the wording because the way a scam is written (its phrasing, its structure, what it asks you to do) is how we recognize the next version of it and test new protections against real examples. A pasted text can include your own details, such as your name or an account number, so please remove anything personal you do not need us to see before you check it. What we keep this way is stored apart from your account and is never shown to other users. To have a message you checked removed, email us at support@sentinelvault.net and tell us what it said. Emails you FORWARD to us are kept too, which the next section explains. For the shared scam database we keep the pattern and the signals, never a copy of your message. If you are signed in, a short preview and the verdict are also saved to your Check history (below), which you can delete. The free plan includes a small number of AI checks each day. Sentinel+ and Family Sentinel have no daily limit for your own personal use.
Checks that run on your iPhone. On an iPhone with Apple Intelligence, Scam Sentinel may check a text or email on your iPhone instead of on our servers. That is faster and works without a connection, but it is not a private mode. When you are signed in and online, the message is still sent to us and kept in full as described above, together with the result, and a short preview is saved to your Check history. It is not sent to Anthropic. We keep these because Scam Sentinel is a security product: real scams are how we make it more accurate, and comparing your iPhone’s answer with our own is how we make sure the on-device check is good enough to trust.
Emails you forward to us
When you forward a suspicious email to us, we keep the whole original message, including its hidden technical headers, until you delete it.
You can do this from any device, not just this one. Forwarding a suspicious email to our scan address works from your computer, your webmail in a browser, your tablet, or a different phone, wherever the email is easiest to reach. It is the same account and the same check either way, and the result appears in this app. Many people read mail on a phone but keep the awkward ones on a desktop, and you should not have to move an email to your phone to have it looked at.
We are telling you this plainly because it is a real trade and you should get to judge it. Scam email in 2026 does not look like scam email in 2025. Attackers now use AI to write clean, personalized lures, hide text inside invisible characters, disguise attachments as harmless file types, and buy aged domains so their mail passes every reputation check. Working out how a new trick functions, and building a detection that catches it for everyone else, needs the actual message. A summary of a scam is not enough to learn from; the evidence is in the raw thing.
The hidden headers matter most. They record which servers really sent the mail and whether the sender was genuinely who they claimed, and they exist nowhere except the original. They are also how we tell a real scam from a false alarm when we get one wrong.
You stay in control. Delete any forwarded check, or clear them all, and the original message is destroyed on our servers along with it. What we keep after that is what we already learned from the scam itself: the sender address, the links, the domains, the file types, and the pattern of the trick. That information is about the criminal, not about you, and it is not linked back to your account.
We do not use these messages for advertising, we do not sell them, and we do not use them to build a profile of you.
Your check history
When you are signed in, we keep a history of your checks so you can look back on what you checked and when. Each entry has the date and time, the type of check, the verdict, our result, and a short preview of what you checked, tied to your account so it shows on your devices. It is your own private record, separate from the anonymized scam database. You can delete any entry or clear your whole history at any time, and deleting removes it from our servers. On the free plan you see the last 30 days; Sentinel+ and Family Sentinel keep everything.
The private device code
Each AI check carries a private device code created from Apple App Attest and a value stored on your phone.
Each AI check carries a private device code created on your phone the first time you open the app.
The photo check
If you submit a photo to check whether someone is who they say they are, we send it to Google Cloud Vision to look for other places that image appears online, and to Sightengine to estimate whether it was AI-generated. We use the results to answer your question and do not keep the photo afterwards. Please only submit a photo you are allowed to share.
Threat reporting
If you report a number, sender, or message as a scam, we store the reported indicator and minimal context to protect other users. Reports may be rate-limited and reviewed to prevent abuse.
News and alerts
The News tab and the cited reporting shown after a check come from The Nexus, a fraud-intelligence service, and are fetched by our servers. Reading them sends The Nexus nothing about you.
Protection features (call, text, and email filtering)
If you turn on call protection, message filtering, or email checks, your device or our servers check those items for scams.
Call protection. We periodically send your device an updated list of known-scam phone numbers, and the matching happens entirely on your device as an offline lookup with no network call while your phone is ringing. We are never told which calls you receive. On iPhone: A match is labeled on the native call screen as “Likely Scam” so you can decide whether to answer; Scam Sentinel does not block calls on iPhone. On Android: A match is blocked before your phone rings. It still appears in your call log, and we post a notification telling you it was blocked.
For text-message filtering, your iPhone first checks messages from people who are not in your contacts against a list built into the app, and routes a known scam to Junk without anything leaving your device. Only if that check finds nothing AND the message contains a link or a phone number does your iPhone send it to us for a Junk or Not-Junk answer. A plain message with neither never leaves your phone. When we are asked, we return a verdict and keep the scam signals (such as the sender’s number) only when the message IS a scam. If it is not a scam we keep nothing at all: no message, no number, no record.
Scam Sentinel does not filter your text messages on Android.
Family Circle
If you add a helper, someone you trust to see the checks you send them, or are added as one, we store the pairing and a notification token to deliver alerts. Both people can view and end the pairing at any time.
Nothing is shared unless it is sent. Your helper does not see your checks, your texts, or your email in the background. A check reaches them only when you tap Send on a result, or when you turn on automatic sending (it is off unless you turn it on), which then sends your risky results for you.
What a sent check includes. The verdict, the reasons we found, our advice, and the message you checked: the text of the message, up to 2,000 characters (on iPhone) or the first 160 characters of the message (on Android). When you send a check of an email you forwarded to us, your helper receives their own copy of that check: the scam sender’s address, the subject, the verdict and reasons, and the email’s text with its hidden technical parts removed.
How long it stays. Alerts sent in the app are deleted when either of you deletes your account. Ending the pairing stops anything new from being shared; alerts already received stay until one of you deletes your account. A forwarded-email check you send becomes a copy in your helper’s list, which they can delete; deleting your own copy, or your account, does not remove theirs.
Account and subscription
Purchases are handled by Apple through the App Store or Google through Google Play; we do not receive your card details. We store your subscription status to unlock paid features, and we may store an app-generated account identifier and your helper’s contact information.
Usage counts. We count the checks your account runs each day and each month, and their estimated cost to us, to apply the free allowance and the fair-use limits on paid plans. We keep only the counts, not what you checked. If an account reaches the monthly limit, we are notified so we can look into possible abuse.
Signed-in devices. Each time you sign in, we record the device: its name, its model, whether it is an iPhone or Android, when it signed in, and when it was last used. On iPhone the name is a general one such as “iPhone”. On Android this is the name you gave the phone in its settings, which may include your first name. You can see the list in Account, under Signed-in devices, and sign any device out there. We use it to let you do that, to keep your account secure, and to keep one account to one person. A signed-out device’s record is kept until you delete your account, and deleting your account removes them all.
Diagnostics and analytics
Our default posture is minimal, with no third-party advertising SDKs. The app does not currently use Google Analytics or any other usage-analytics SDK; if that changes, we will name the provider and the data here.
Our website, scamsentinel.app, uses Google Analytics to understand traffic: which pages are visited, how long, and general device, browser, and approximate location (from your IP address, not exact). We have not enabled Google Signals or ad personalization, so this data is not used to build an advertising profile of you or to target ads.
What we never do
We do not sell your personal data. We do not show ads or use advertising trackers. We do not read your mailbox or monitor your messages in the background.
How we use data
To detect and warn about scams; to maintain and improve the threat database; to improve our detection accuracy using the content you submit for checks; to deliver Family Circle alerts; to provide and bill paid features; and to keep the service secure and prevent abuse.
Who helps us run the service
Apple (billing, notifications, device verification) or Google (Google Play billing and Firebase Cloud Messaging notifications), Anthropic (the AI analysis), The Nexus (news content, fetched by our servers), Twilio (phone-number reputation), Google (link reputation via Web Risk, and reverse-image search via Cloud Vision when you run a photo check), Sightengine (checks whether a photo you submit was AI-generated), urlscan.io (safely opens a suspicious link on our behalf to see where it really goes; our scans are submitted privately and never appear in their public feed), SendLayer (sends our emails to you, such as sign-in codes and check results), RDAP registries (tell us how old a scam’s website domain is), mempool.space and TronGrid (public blockchain lookups, when a scam names a Bitcoin or Tron address, so we can tell you whether money has already moved through it), and DigitalOcean (hosting). The last three receive only the scam’s own details (a domain or a crypto address), never anything about you. We may disclose abuse-related information to Apple or Google and law enforcement.
How long we keep things
A pasted text or a link you check is kept in full, as described under The AI text and email check. Content from a photo check is deleted right after the verdict. An email you forward is kept in full until you delete it (see above), and deleting it destroys the original on our servers. De-identified scam patterns and signals are kept while they are useful for protecting people. The private device code is kept only as long as needed to prevent abuse. A check you send to your helper is kept as described under Family Circle. If you’re signed in, your Check history is kept until you delete it. Free accounts see the last 30 days, and you can clear it any time.
Your choices and rights
You can turn any feature off in Settings at any time. To request a copy of your data or its deletion, email us at support@sentinelvault.net. California residents may make the same requests by email. Deleting your account does not cancel an App Store or a Google Play subscription. That is held by Apple or Google, so you cancel it in your device settings.
Children
Scam Sentinel is not directed to children under 13, and we do not knowingly collect their data.
Security
We protect your information with encryption in transit and at rest, access controls, and data minimization. No method is perfectly secure, but we work to keep your information safe.
Changes
We will post updates here and tell you in the app about important changes.
Contact
support@sentinelvault.net Sentinel Vault Consulting (sole proprietorship), California, USA