Scam Protector privacy policy
Scam Protector is developed by Richard Brereton (“we”, “us” or “our”). This policy explains how the Android app handles information.
Contact: rick@mutantwork.com
Website: https://mutantwork.com
The short version
Scam Protector is designed to check suspicious messages privately on your Android device. You do not create an account. We do not operate a cloud database of your messages. The image you choose and the text recognised from it are processed on your device. Nothing is sent to another person unless you deliberately choose an app and recipient through Android's share screen.
The app uses Google's ML Kit for on-device text recognition. Google says ML Kit does not send the input image/text or the resulting recognised text to Google servers. Google also says ML Kit ordinarily processes limited technical metrics for diagnostics and usage analytics. These are explained below.
Information processed by the app
When you choose or photograph a message, or share an image into Scam Protector, the app may process:
- the selected message image;
- text recognised from the image;
- any edits you make to that text; and
- the warning result and reasons produced by the app's local rules.
This processing is needed to provide the message-checking function you requested. The app may process personal information contained in a message, but we do not receive or store that message content on our servers because there is no message-content server or cloud database.
How message information is used and retained
- Images and text are used only to show the preview, recognise and let you correct the text, produce the warning result, and prepare a share that you initiate.
- Temporary local image copies are deleted by the app after text recognition, after completed trusted-person sharing, or when you abandon a preview.
- Recognised text and results are kept only in the app's current working state. They are not intentionally written to a developer database or printed to application logs.
- Closing or resetting the app removes the current working state. Android or a chosen receiving app may separately retain files or previews under its own operation and privacy terms.
Taking and choosing images
Scam Protector uses Android's system camera and image picker. The audited release does not request ongoing access to your camera, contacts, photo library or general device storage. Android and the camera/photo app you use operate under their own privacy practices.
Asking someone you trust
When you tap Ask Someone I Trust, Scam Protector opens Android's share screen. You choose the receiving app and person. Nothing is sent automatically. Once you share, the receiving app and recipient control their copy under their own privacy practices. Check that the image does not contain information you do not want to share.
Google ML Kit technical metrics
Scam Protector uses the bundled Latin text-recognition feature of Google ML Kit. Google states that:
- input images/text and resulting OCR output are processed on-device and are not sent to Google servers;
- ML Kit may process device and app information, a per-installation identifier, performance information, API configuration, feature sizes/versions/events and error codes;
- those technical metrics are used for diagnostics and usage analytics, encrypted in transit using HTTPS, and not transferred by ML Kit to third parties.
The current Scam Protector release removes Android's general internet and network-state permissions, so it is designed to work offline and prevent normal app network access. We still disclose Google's documented SDK behaviour conservatively because platform and SDK behaviour can change. We do not receive a copy of your message image or recognised message text through ML Kit.
Google's privacy policy is available at https://policies.google.com/privacy and ML Kit information is available at https://developers.google.com/ml-kit/terms.
Support enquiries
If you email us for support, we receive the information you choose to include, such as your email address, description of the problem and any attachments. Do not send real passwords, one-time codes, bank details or an unredacted suspicious message. We use support information to respond, diagnose faults and improve the app. We normally keep support correspondence for up to 12 months after the issue is closed, unless we need it longer to establish, exercise or defend legal claims.
Lawful basis under UK data protection law
Where UK data protection law applies to our processing, we rely on our legitimate interests to:
- provide and secure the privacy-focused app function requested by the user;
- diagnose faults and improve reliability; and
- answer support and privacy enquiries.
We limit this processing by keeping message content on-device, avoiding accounts and advertising, minimising technical data, and deleting temporary app copies. You may object to processing based on legitimate interests by contacting us. This section should be reviewed if the app's features, telemetry, countries or business model change.
Automated warning results
Scam Protector uses automated rules to identify selected warning signs. It does not make a legal, financial or similarly significant decision about you. You can inspect and edit the recognised text, see the reasons for a warning, ignore the result, contact the organisation independently or ask someone you trust.
The app can miss scams and may flag genuine messages. A result of No obvious warning signs is not a guarantee that a message is genuine.
Sharing, sales and advertising
We do not sell personal information. The app contains no advertising and does not create an advertising profile. Apart from the Google ML Kit technical processing described above and sharing that you initiate through Android, we do not disclose app message content to third parties.
International processing
Google may process ML Kit technical metrics in countries outside the United Kingdom under Google's privacy terms and applicable transfer safeguards. Scam Protector does not send message images or recognised message text to Google through ML Kit, according to Google's documentation.
Security
The app is designed to minimise data by processing messages locally, requesting no ongoing access to photos or camera, operating without an account, and avoiding a cloud message database. No method is completely secure. Keep your phone updated, use a screen lock, and avoid sharing sensitive information in support emails.
Your rights
Depending on the circumstances, UK data protection law may give you rights to ask for access, correction, erasure, restriction, portability or objection. Because we do not hold an account or server copy of your message images/text, we may have no message content that we can identify or provide. To make a request, email rick@mutantwork.com. We may need enough information to verify and respond to your request.
If you are unhappy with our response, you can complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or call 0303 123 1113.
Children
Scam Protector is intended for adults and is not designed for children under 18. Do not use the app to process a child's information without an appropriate reason and authority.
Changes to this policy
We may update this policy when the app, SDKs, law or distribution changes. We will publish the revised policy with a new effective date. Material changes may also be explained in the app or store listing.
Contact
Richard Brereton
rick@mutantwork.com