Privacy Policy for Is This a Scam?

1. How the App Works

Is This a Scam? allows you to submit messages, links, or explicitly selected screenshots/images for automated analysis to help identify potential scam, phishing, fraud, or suspicious characteristics.

The app provides informational guidance only. Results are generated using automated analysis and should not be treated as a guarantee that content is safe or fraudulent.

2. Information You Submit for Analysis

When you choose to analyze a message, link, or screenshot, the content you submit is transmitted to Soukai's backend infrastructure and to OpenAI, a third-party artificial intelligence provider, for analysis.

Before the first analysis under the current disclosure version, the app informs you of this processing and asks you to explicitly choose whether to continue. The disclosure covers message, link, and screenshot analysis.

We recommend that you avoid submitting highly sensitive personal information unless it is necessary for the analysis.

3. OpenAI Processing

Submitted message, link, or screenshot content may be processed using OpenAI's artificial intelligence services to generate a risk assessment, explanation, category, and recommended action.

The app does not send your anonymous device identifier to OpenAI.

Provider-side storage, logging, and retention practices are governed by the applicable service provider's own policies and contractual arrangements.

4. Anonymous Device Identifier

The app creates a random anonymous device identifier that is stored locally on your device.

This identifier is sent to Soukai's backend and is used for rate limiting and abuse prevention.

For rate limiting, a cryptographically derived identifier is sent to our rate-limit infrastructure rather than the raw device identifier.

The anonymous device identifier is not used for advertising or cross-app tracking.

5. Recent Scans

Recent Scans are stored locally on your device.

Each Recent Scan may contain:

• the message or link you submitted;
• the risk level;
• the reasons for the result;
• the recommended action;
• the result category; and
• a server-issued result reference for voluntary result reporting; and
• the date and time of the scan.

The app keeps up to the 20 most recent scans.

For message and link checks, Recent Scans may retain the submitted text locally. For screenshot checks, Recent Scans do not retain the screenshot, image URI, thumbnail, or base64. They retain only a local screenshot-analysis label, result, and timestamp sufficient to reopen the result.

Recent Scans do not automatically expire based on time.

You may delete all Recent Scans at any time using the Clear option in the app. Clearing Recent Scans also removes their locally stored result-reference metadata.

Clearing Recent Scans does not delete the app's anonymous device identifier.

6. Service Metadata

For completed analyses, Soukai may retain limited metadata about the check.

This metadata may include:

• a server-generated check identifier;
• timestamp;
• content type; and
• risk level.

Soukai does not intentionally store submitted messages, links, or screenshot/image data in its application database or analytics system. Completed screenshot checks may use content_type=image alongside the check identifier, timestamp, and risk level.

The reasons, recommended action, and result category are also not intentionally stored in those systems.

7. Analytics

We use limited aggregate lifecycle analytics to understand accepted checks, completed checks, and terminal analysis failures, and to operate and improve the service.

Each analytics event uses a fresh server-generated random identifier and limited metadata such as content type, response language, risk level, category, and a fixed terminal failure type where applicable. This identifier is not returned to the app, reused between events, or associated with a check, report, or device identifier. Analytics do not receive check identifiers, device identifiers, report identifiers, submitted messages, links, screenshot/image content, image paths, or image data.

We do not use these analytics for advertising or cross-app tracking.

8. Voluntary AI-Result Reporting

You may explicitly report an AI-generated result from within the app by choosing one of the fixed reporting reasons provided.

A report contains a server-issued result reference and the selected fixed reason. It does not include the original message, link, screenshot, image data, or a free-text report narrative.

We use this limited metadata to review safety and quality trends privately. Reports are not used for advertising or cross-app tracking. Report records are retained for up to 90 days.

To prevent report abuse, we may use transient network-address-derived metadata. It is HMACed before rate-limit storage and is not stored in report records.

9. Rate Limiting and Abuse Prevention

We use rate-limiting infrastructure to protect the service from abuse and excessive automated usage.

A cryptographic representation derived from the anonymous device identifier is used for this purpose.

Rate-limit information may be retained temporarily as necessary to enforce usage limits.

10. Infrastructure and Service Providers

We use third-party service providers to operate Is This a Scam?, including providers for:

• cloud hosting;
• artificial intelligence analysis;
• database services;
• analytics; and
• banner advertising; and
• rate limiting.

These providers may process information as needed to provide their respective services, subject to their applicable policies and agreements.

Our current infrastructure may include Vercel, OpenAI, Supabase, PostHog, Google Mobile Ads, and Upstash.

11. Network Information

Like most online services, infrastructure providers may process technical network information such as IP addresses, request metadata, or device/network information as part of operating, securing, and delivering their services.

Soukai's backend services do not use this information for advertising or cross-app tracking. Google Mobile Ads may process relevant device or network information for advertising as described below.

12. Sharing a Result

The app includes native Share Result and Share App features. Sharing occurs only when you choose to use them.

Share Result contains localized static information such as the app name, risk status, category, a generic risk explanation, a generic protective action, and a protection message. It does not include backend-generated reasons or recommended actions.

Share App contains only localized generic product messaging.

Neither sharing feature includes the original message, link, screenshot/image, image data, image or file path, check identifier, device identifier, or report identifier.

The destination of shared content is selected by you through your device's native sharing interface.

13. Sharing Content into the App

On supported iOS and Android share sheets, you may explicitly share one text item, web URL, or image with Is This a Scam?. On iOS, the Share Extension temporarily places the selected item in the app's private shared App Group. On Android, the app temporarily copies a supported shared item into its private app storage so the main app can prepare it for you.

Sharing an item does not automatically analyze it. For text and web URLs in the iOS Share Extension, you must explicitly choose Check with AI after seeing a disclosure before the item is sent for analysis. Images remain available in the main app, where the existing CHECK control and consent flow apply.

The handoff is limited to one pending item. Pending handoff metadata is removed after import, and temporary image files are removed when they are replaced, cleared, or expire; platform cleanup may also remove temporary files.

14. Advertising, Accounts, and Information We Do Not Collect Through V0.1

The current version of Is This a Scam? does not require you to create an account or provide your name or email address to use the scam-analysis feature.

The Android and iOS apps may display Google AdMob banner ads. Google Mobile Ads and its providers may process advertising-related information, including device or advertising identifiers where permitted, approximate location derived from IP address, advertising data, ad or product interaction data, crash diagnostics, and performance data, under their applicable policies.

On iOS, the app requests Apple App Tracking Transparency permission before Google Mobile Ads initializes. If that permission is not granted, restricted, unavailable, interrupted, unresolved, or results in an error, advertising remains disabled on iOS. Google User Messaging Platform (UMP) is used separately after this step to meet applicable regional privacy and consent obligations. Banner requests remain non-personalized.

On Android, Google AdMob banner ads may also be used, and UMP or other privacy-consent choices may apply based on your region. The content-analysis disclosure is separate from advertising and privacy consent: it applies when you choose to send a message, link, or screenshot for scam analysis.

The app's anonymous operational device identifier is separate from advertising identifiers. It is used for functions such as rate limiting and abuse prevention and is not intentionally sent to Google AdMob. PostHog analytics are backend-only and do not use the app's device, check, or report identifiers.

The app does not request access to your contacts, location, microphone, or camera. It may request photo-library access solely so you can explicitly choose one screenshot/image for analysis.

15. Data Retention

Recent Scans remain locally on your device until they are cleared, displaced by newer scans beyond the 20-item limit, or removed when application storage is deleted. The app does not intentionally retain selected screenshots in Recent Scans or Soukai application metadata stores after analysis; platform image-processing components may manage temporary files according to device behavior.

Voluntary AI-result report records are retained for up to 90 days. Limited check metadata stored by Soukai may be retained for service operation, reliability, security, analytics, and troubleshooting.

Third-party service providers may maintain their own retention schedules according to their applicable policies and agreements.

16. Data Security

We use reasonable technical and organizational safeguards designed to protect information processed through the service.

However, no internet transmission or storage system can be guaranteed to be completely secure.

17. Children's Privacy

Is This a Scam? is not designed to knowingly collect personal information from children for advertising or profiling purposes.

If you believe a child has provided personal information that should be removed, contact us at the address below.

18. Your Choices

You can:

• choose not to submit content for analysis;
• cancel the AI-processing disclosure before the first analysis;
• clear Recent Scans stored on your device;
• avoid submitting highly sensitive information; and
• contact us with privacy questions or requests.

19. Changes to This Privacy Policy

We may update this Privacy Policy when the app, our service providers, or our data practices change.

The updated version will be published on this page with a revised "Last Updated" date.

20. Contact

For privacy questions, support requests, or concerns regarding Is This a Scam?, contact: