Privacy Policy

1. Information we collect

We collect only what we need to detect scams and run the service. "Transient" means Oversight processes and then discards it; this does not override a provider's retention rules. Retention is described below (see Third-party processors and Retention & Deletion).

Note the difference between processed and retained: we always read the sender and subject of a message to compute its risk score, but we only keep them afterward if you've turned on the sharing options above. Oversight does not retain scan message bodies or screenshots; provider retention is described below.

Mobile activity: identity and exclusions

This channel covers only foreground main-app interactions, not the marketing website, browser extension, native extensions, or background protection. A random app-private installation identifier is sent to Oversight, which converts it into a stable keyed hash before relaying events to PostHog; the raw installation identifier is not forwarded. The identity is pseudonymous, not anonymous, and is not linked to your Oversight account, even after sign-in. It is separate from first-party install/activation and location records. One installation can be used by multiple people or accounts, and one person can use multiple installations. Sessions group activity and renew after inactivity or an app process restart; repeated actions can create new events.

No onboarding answer values, scan content or verdicts, screenshots, message/SMS bodies, senders, phone numbers, URLs, raw errors, names, email addresses, passwords, purchase tokens or IDs, billing amounts, advertising IDs, or raw device identifiers enter this channel. There is no session replay, automatic screen capture, crash reporting, or AI-provider observability in this integration. A scan failure event records only the flow milestone, not an error message or scam result. Oversight does not forward incoming IP addresses, cookies, authorization, or other client headers to PostHog; the relay asks PostHog to disable GeoIP and supplies no client IP. Network infrastructure still processes connections, and PostHog sees the backend connection, not a guarantee of no infrastructure logs.

2. How we use your data

• Detect scams and phishing in the messages you choose to scan.
• Show you your results and scan history.
• Send family / guardian alerts when enabled by the protected person.
• Process and manage your subscription and billing.
• Verify and restore iOS purchases and understand subscription performance using RevenueCat.
• Prevent abuse and enforce rate limits.
• Authenticate you, link login methods only with fresh proof, revoke sessions after sensitive account changes, and prevent repeated introductory-trial abuse.
• Respond to support requests, investigate technical issues, and track request status.
• Understand acquisition and activation by platform and report aggregate approximate country counts from first install/first-launch events. Authorized administrators see aggregate map and table counts, including an Unknown bucket, rather than user-level location pins.
• Send optional reminders, scam-checking tips, product updates, and promotional offers to mobile accounts that make the current in-app notification choice and also allow device notifications.
• Use limited PostHog mobile activity to understand onboarding drop-off, scan-flow friction, paywall and checkout journeys, feature discovery, and returning installations, so we can improve the app. Installation counts are not counts of individual people or accounts.
• Improve our detection (using results and your feedback — never your stored emails or images).

We never sell your data or use it for third-party advertising. Optional promotional notifications concern Oversight's own products and are sent only after the current in-app opt-in and device permission.

3. Third-party processors

We share data with the service providers below only as needed to run Oversight. Each processes data under its own privacy policy.

OpenAI Decisions: SMS processing and retention

When this optional second opinion is enabled, OpenAI receives the sender and message text only for SMS checks that remain uncertain after Oversight's first-stage analysis. Oversight sends no account credential or installation identifier with this content. The content itself can still contain personal information, so an unlinked check is not necessarily anonymous. The second opinion can raise an uncertain message to Junk; it cannot lower the first-stage score or mark the message safe. A timeout or error keeps the first-stage result. You can disable SMS filtering in iOS Settings.

Oversight discards SMS sender and text after scoring and does not persist or log them. OpenAI's default Decisions API terms allow abuse-monitoring logs containing content to be retained for up to 30 days, with longer retention in specified legal or safety circumstances. Prompt caching may retain encrypted processing data for up to 24 hours. Zero Data Retention requires OpenAI approval and the applicable account configuration; this policy does not claim it is enabled. Deleting your Oversight account does not automatically delete provider-held logs from these unlinked SMS checks. See OpenAI's API data controls for retention details and exceptions. This disclosure does not itself enable the feature.

4. Data sharing

• With guardians: consent-based and controlled by the protected person, who decides what (if anything) is shared.
• Within teams / organizations: admins can see alerts for the members they manage.
• With the processors listed above.

We do not sell your data or share it for third-party advertising.

5. Data retention & deletion

• Scan screenshots & images: Oversight discards them immediately after analysis rather than storing them. Provider retention is separate. A file you intentionally attach to a support request is stored with that ticket until you delete your account.
• Scan metadata: retained until you delete your account (or for the retention window your organization sets, if any).
• Support requests: ticket text, limited diagnostics, status, and optional attachments are retained until you delete your account.
• First-party install and activation events: retained for product analytics and onboarding diagnosis. Account-linked events are removed on account deletion. Events not linked to an account are not automatically removed by account deletion; contact us about these records using the data deletion page below.
• PostHog mobile activity: provider retention duration is unknown / not yet verified; no automatic provider deletion deadline is implemented. The app keeps a bounded pending-event queue; its 24-hour delivery eligibility is not a PostHog retention or deletion deadline. Account deletion does not automatically locate or erase PostHog installation profiles or events. Disabling server capture or clearing app storage does not erase already accepted provider data; clearing app storage can create a new identity and make earlier records harder to locate. Per-installation identity discovery, opt-out handling, and provider deletion completion still require operational validation. We do not promise that requesting deletion, stopping capture, or receiving a provider acceptance response means erasure is complete.
• Approximate first-event location: the detailed country/state-or-region/estimated-city result is retained for up to 90 days and then removed. Non-identifying country/day/platform totals may remain for the historical globe; they contain no account, installation identifier, IP, region/city, timestamp, or user coordinates. A previously recorded privacy withdrawal or deletion suppression remains blocked so delayed traffic cannot restore that installation's estimate. Because this record may remain unlinked until sign-in, use our data deletion page if you need help identifying and deleting an unlinked installation record. The service stores no raw IP with the estimate.
• Optional notifications: turning the in-app Notifications choice off revokes campaign eligibility. Push-installation data is also removed or replaced when the installation is disconnected, transferred, or the account is deleted.
• Server logs: retained for about 30 days.
• Social sign-in: one-time security records expire automatically. Linked Google/Apple identities are removed when you unlink them or delete your account. Apple revocation credentials are encrypted and deleted after revocation; minimal retry metadata may remain briefly if Apple is temporarily unavailable. A keyed, pseudonymous trial claim may be retained after deletion only to prevent repeated introductory-trial abuse.
• Account deletion: delete your account in-app (Settings → Delete account) at any time. This permanently removes your account and cascades deletion of your scans, support tickets and attachments, alerts, team memberships, and guardian links. You can also email admin@renderwise.net or use our data deletion page (https://oversightscan.com/data-deletion). Organization attribution, billing records, and records held by payment and subscription providers (including creator attributes already sent to RevenueCat) can remain after account deletion. An organization may continue under a remaining member. Manage Apple or Google subscriptions in the store, and contact us for requests concerning retained billing records.

6. Your rights

Depending on where you live, you have rights over your data, including the right to access, correct, delete, and port it. Under the GDPR (EEA/UK) and the CCPA/CPRA (California), you also have the right to know what we collect, to request deletion, and to opt out of the sale of personal information — and we do not sell personal information. We will not discriminate against you for exercising these rights.

To exercise any of these, delete your account in-app, visit our data deletion page, or email admin@renderwise.net.

Mobile analytics limitations: No analytics consent popup is shown, and there is no implemented analytics-specific in-app opt-out or deletion control. The account geography and notification controls do not switch this channel off. To ask about these separate installation records, use the contact or data deletion page above; an account email alone cannot locate them, and the per-installation request process is not yet validated. This disclosure does not establish consent, a lawful basis, or compliance where additional choices or safeguards are required.

7. Security

• All data is encrypted in transit with HTTPS/TLS.
• Passwords are hashed with scrypt; sessions use signed JWTs.
• Sender email addresses are stored only as HMAC (one-way) hashes.
• Authentication tokens are stored securely on each platform — the iOS Keychain, Android EncryptedSharedPreferences, and chrome.storage.local in the extension.
• Internal access is limited to authorized staff, who may view account and scan metadata, and the contents of support requests you choose to submit, only as needed to operate, support, and secure the service. Oversight does not retain scanned message bodies or screenshots for staff to review. Provider retention is described above.

8. Children's privacy

Oversight is not directed to children under 13 (or under 16 in the EEA/UK), and we do not knowingly collect their personal data. Family Overwatch is a tool for guardians to help protect family members from scams — it is not a service that targets or profiles children.

9. Per-platform permissions

Why each sensitive permission is requested on each platform.

10. Changes to this policy

We may update this policy from time to time. When we do, we'll revise the "Last updated" date above, and for material changes we'll notify you by email or in-app.

11. Contact

Questions about this policy or your data? Contact Renderwise at admin@renderwise.net.