Privacy

Written in plain English, because privacy policies in legalese don't protect anyone. Last updated 23 October 2026.

The short version

• You can use Scamly anonymously. No account required.
• Anonymous scans never leave your device.
• If you sign in, your scans sync privately so only you can see them across devices.
• We don't sell, share, or rent your data. We never show ads. We make money from subscriptions.
• You can delete everything — your account, scans, guardians — from Settings → Data, immediately, no email required.

Who we are

Scamly is operated by the publisher listed on your App Store or Google Play listing. If you want to reach a real person, email scamlysupport@scamly.app. We read every email.

What we collect

When you use Scamly anonymously

• Your scans. The message, image, voicemail, or live-call audio you ask Scamly to analyse — plus the verdict and red flags we produce. Stored locally on your device. We identify your device by a random anonymous ID so your scans are isolated to your phone.
• Minimal technical data. App version, platform (iOS/Android), language setting, timezone offset so we can reset your daily caps at your local midnight. No name, no email, no advertising identifier.

When you sign in

• Your email address and display name from Google or Apple (whichever you signed in with). Apple's private-relay email is honored if you choose it — we never see your real email.
• Your scans, synced to your account so you see them across devices. Only you can see them.
• Your trusted senders, guardians, and family contacts if you add any.

What we don't collect

• Your SMS messages, emails, or voicemails — unless you explicitly send one to Scamly for a scan. We don't intercept, read, or scan anything in the background.
• Your location.
• Your contacts (unless you tap “Add from Contacts” and grant permission for that one action).
• Any advertising identifier (we don't show ads, so we don't need one).

How your scans are analysed

To produce a verdict, Scamly sends the message (or screenshot text, or voicemail transcript) to our AI providers:

• Anthropic Claude for text + image analysis.
• OpenAI Whisper for voicemail transcription.

Both providers process your request to produce a response and do not use your scans to train their AI models. Our contracts with them require this. See Anthropic's policy and OpenAI's policy.

How we store and secure your data

• Signed-in scans are stored on servers in the United States, encrypted at rest and in transit.
• Anonymous scans stay on your device unless you choose to sign in later.
• We retain signed-in scans only as long as your plan allows — 7 days on Free, 30 days on Guard, 90 days on Family. After that they're permanently deleted. We don't keep backups beyond this window.

Elder-care sharing (Guardians)

If you add a Guardian by email, we send that person a short message when Scamly confirms a scam on your account. The email includes the sender, verdict, and red flags — never the full message content. Guardians do not get access to your scan history, your account, or anything else. You can remove a Guardian from Settings any time; they stop getting emails immediately.

Subscriptions

Billing is handled entirely by Apple (App Store) or Google (Play Store). Scamly never sees your credit card. Our billing provider RevenueCat tells our servers whether you have an active subscription so we can unlock features — nothing more. See RevenueCat's privacy policy.

Analytics & crash reports

We collect basic, anonymous usage counts (scans run per day, feature adoption, crash reports) to improve the app. We do not use third-party advertising analytics (no Facebook SDK, no Google Analytics, no AppsFlyer). Crash reports strip out message content before transmission.

Your rights

• Access. See everything you've scanned on the History tab.
• Delete. Clear scan history or delete your entire account from Settings → Data. Instant, no email required.
• Export. Email scamlysupport@scamly.app and we'll send you a copy of everything we hold for your account within 30 days.
• Correct. Change your name in Settings. Change your email through Google or Apple.
• Object or withdraw consent. Email scamlysupport@scamly.app and we'll action it.

If you're in the EU/UK, these rights are under GDPR. In California, under the CCPA. In Australia, under the Privacy Act 1988. The paths above work regardless of where you live.

Children

Scamly isn't designed for children under 13 and we don't knowingly collect data from them. If you believe a child has signed in, email us and we'll delete the account.

Changes to this policy

If we change anything meaningful, we'll update the date at the top and notify signed-in users inside the app. We won't silently change what we do with your data.

Contact

Questions about privacy? Email scamlysupport@scamly.app.