Everyday Security for Android (the "App") is operated by EverydaySecurity Incorporated ("EverydaySecurity," "we," "our," or "us") and distributed through Google Play. The App does four things:

• It protects your phone by refusing lookups for websites known to be used for scams.
• It observes how your device looks up websites, which contributes to shared fraud research.
• It checks the apps on your phone for the ones scams rely on.
• It reads your incoming message notifications, to help sort junk and scam leads out of your texts, email and chat.

It also lets you send us a report when you spot something suspicious.

Some of this stays on your phone and some is sent to us. This Policy says which is which, why, and how long it is kept.

This Policy covers the Everyday Security Android app only. Our Scam Checker service at check.everydaysecurity.ai, and this website, are covered by their own policy.

1. What the App handles

Website lookups (sent to us)

When protection is on, the App records how your device looks up websites, plus some basic facts about your phone so we can tell whether the App is working badly for you. Specifically:

• Website lookups (DNS):
  • the website addresses your device looks up, for example bankofamerica.com;
  • the address each one resolves to;
  • the type of lookup, when it happened, and how long it took;
  • whether the App refused it, and a short reason code.
• Your device and connection type: the make and model of your phone, its Android version, roughly how much memory it has, its processor type, and whether each lookup went over Wi-Fi or mobile data. These describe the model of phone, not you: every phone of the same model reports the same values.
• A data ID: a random number the App generates on your phone the first time it runs, and sends with your lookups so we can tell one device's data apart from another's.
  • It is not derived from your phone's hardware, and we hold no record of which phone it belongs to.
  • It is not your name, email or phone number, and we do not use it for advertising.
  • You can see it under Settings & about, quote it to us to ask for your data or have it deleted, and get a new one by clearing the App's data.
  • It is a persistent identifier, so we do not describe this data as anonymous.

Never collected from lookups:

• page content or passwords;
• what you do on a site once you arrive;
• the contents of any connection.

Apps on your phone (stays on your phone)

The App looks at every app installed on your phone and shows you, under Settings & about → Your apps, the ones worth a second look:

• remote-access tools that let someone else see and control the phone (scammers often ask people to install these);
• apps from outside an app store that hold powers scams rely on.

For each app it reads:

• the app's package name and version;
• whether it came from an app store, was preinstalled, or came from somewhere else;
• when it was installed and last updated;
• whether it has been granted any of these powers: reading your screen (accessibility), acting as a device administrator, reading notifications, reading text messages, drawing over other apps, or installing other apps.

It never reads what is inside an app or how you use it.

In this version of the App, this information stays on your phone. It is not sent to us. The consent screen already describes it as collected, because a future version may upload this same information to improve scam detection. If that happens, this Policy will be updated before the release that does it.

Message notifications (stays on your phone)

When Google Messages, Samsung Messages, Gmail, Outlook, WhatsApp or Telegram shows you a notification about something new, the App reads who it is from and what it says, and checks it for signs of a scam. This happens only for apps you have installed, and only once you have given the App notification access in Android's settings.

• It reads only what is inside the notification itself. It never reads your inbox, sent mail, message history, or anything you were not just notified about.
• It does not send message content to us. In this version of the App, notifications are read, checked and stored entirely on your phone.
• Automatic protection is off until you turn it on, separately for each messaging app. When it is on, a message that matches a rule you created, by marking a similar message as unwanted, can be silenced. On Gmail and Outlook it can also be archived, using that app's own Archive action.
  • The App never deletes a message, in any app.
  • Everything it acts on is listed in the App for 30 days, with one-tap undo.
  • Archived mail stays in your mail app's archive.
• A message you have approved, or that was handled for you, is deleted from your phone 30 days after that decision. A message still waiting for your review is kept until you decide.

Reports you choose to send (sent to us)

Scam reports. You can report something suspicious whenever you want to. Nothing in this category is collected in the background.

• What a report can contain: a description in your own words, a photo or screenshot you attach, and a voice note you record. Taking a screenshot uses Android's screen-capture permission, which Android asks for each time. Recording a voice note uses the microphone, only while you are recording.
• What it is usually about: reports are typically scam content, such as text a fraudster sent you, a screenshot of a fraudulent message, or an account of a scam. That content is generally not about you.
• What it carries: no name, email or account, but the same data ID as your lookups. A report can therefore be associated with the device that sent it and with other reports from the same phone. If you would rather send something with no such link, email privacy@everydaysecurity.ai instead of using the in-App report.

"Report as wrongly blocked." If the App refused a site you believe is safe, you can tell us. This report contains:

• the site's address;
• the version of the block list your phone held, and the App's version;
• an optional note you type.

It does not carry your data ID. A person on our team reviews it, and it is delivered to them through Slack, which acts as our service provider for this. These reports, including the review message in Slack, are deleted after 90 days.

Our right to use what you report. We obtain a right to use this content, not ownership of it. By submitting it, you grant EverydaySecurity a worldwide, royalty-free, perpetual, irrevocable and sublicensable right to process, analyze, store, modify, license, publish, publicly display, distribute, broadcast and share that content, and any threat indicators or analysis derived from it, for fraud detection, security research and public education.

• You are not transferring ownership of the content to us.
• Submitting it does not give you ownership of anything you did not already have a claim to.
• This is how the security industry generally operates. Whoever created malicious content has no right to have it shielded from security analysis, and a person who receives it and passes it to a security service is contributing to a public safety effort, not exposing themselves.

We use submitted reports to:

• analyze the report and decide whether it describes a scam;
• build and improve our fraud detection;
• extract threat indicators, such as phone numbers, website addresses and message patterns, which are shared as security intelligence with fraud analysts at financial institutions and other security teams;
• publish examples and analysis of scams to warn and educate the public (see Section 6).

How you use the App (sent to PostHog)

After you agree to the in-App disclosure, the App records which of its screens you open, when you open and leave it, and a few things you do in it: turning protection or blocking on or off, marking a message fine or unwanted, letting a blocked site through, and sending a report. It records that you did these things, never the content: no message, who sent it, website, app on your phone, or report text is ever part of these records.

Each record carries your phone's make, model and Android version, the App's version, and a random ID that PostHog's software makes up on your phone. That ID is separate from your data ID, and we do not link the two. We switch off PostHog's location lookup, and the App removes your carrier, language and time zone before anything is sent.

These records go to PostHog, our analytics service provider, through a web address of ours. We use them only to understand whether the App is used and where people get stuck, so we can improve it. Nothing is recorded before you agree.

Technical data (received by our servers)

Whenever the App contacts our servers, they receive your IP address and the time of the request, as every internet service does. The App contacts us when it:

• uploads lookups;
• sends a report;
• downloads a fresh copy of the block list, several times a day. This download sends only the App's version and the version of the list the phone already has, never anything about what you looked up.

We use technical data only for operational security and reliability: detecting attacks, blocking abusive traffic, and keeping the service working. Technical logs are kept for up to 90 days, unless a specific security incident requires keeping them longer. They are held separately from lookups and reports, and we do not join them together to identify who sent a contribution.

2. How protection works

Protection uses Android's built-in VPN facility, and Android asks your permission before it can start. Because "VPN" means different things in different apps, here is exactly what ours does.

Only website lookups pass through the App. The App's VPN handles your device's DNS lookups and nothing else. Every other connection your phone makes (web pages, email, calls, messages, apps) goes out on your normal network and never passes through the App. Your browsing is not routed through Everyday Security's servers.

The App can refuse a lookup. The App carries a list of website addresses known to be used for scams. When your device looks up an address on that list, the App answers the lookup itself, saying the address does not exist, instead of passing it on. Your device then does not connect to that site.

• This affects the lookup only. The App does not read, alter or redirect the contents of any connection.
• Nothing extra is collected when a lookup is refused. It is recorded like any other lookup, plus the fact that it was refused and a short reason.

The decision is made on your phone. The App checks its own on-device list, and nothing about a lookup is sent anywhere to decide whether to refuse it. The list is updated by downloading a new copy (see "Technical data" above).

You control it. Blocking is on by default.

• To turn blocking off, use Settings & about → Block dangerous sites. The App then goes on recording lookups without refusing any.
• To see what was refused, and let an individual site through, use Settings & about → Blocked sites.

We will sometimes get this wrong. A list of scam addresses assembled at scale will occasionally contain one that should not be on it. The result is a site that will not load. That is why:

• blocking can be switched off;
• refused lookups are listed with a way to allow them;
• you can report a wrong block to a person;
• the App carries a correction list that removes a wrongly listed address without waiting for a new App version.

Your lookups go to Google Public DNS. While protection is on, any lookup the App does not refuse is resolved by Google Public DNS (8.8.8.8), instead of the resolver your network normally uses. Google therefore receives those lookups, under Google's own privacy policy, just as it would if you had chosen that resolver yourself. If you would rather it did not, pause protection.

It stays on until you pause it. Android shows a notification while protection is running. If you leave protection on, the App turns it back on after your phone restarts, and after the App is updated. If you pause it, it stays paused, including across restarts. If an update changes what the App collects, protection does not restart until you have read and agreed to the new wording. The App sends you a notification saying protection is off.

3. Permissions the App asks for

• VPN. Needed for protection, as described in Section 2. Android asks you before it is granted.
• Notifications. Asked for when you turn protection on. They let the App show that protection is running, and tell you if it has stopped. If you decline, protection still works.
• Notification access. Granted in Android's own settings, only if you want message checking.
• Package visibility. Lets the App see every installed app, for "Your apps".
• Screen capture and microphone. Used only when you attach a screenshot or voice note to a report. Android asks you each time for screen capture, and the first time for the microphone.

The App does not request your location, contacts, call log or text-message permissions. It does not read your photo library: it only receives a photo you pick and attach to a report yourself.

4. Consent, and how to withdraw it

The App collects nothing until you have read the three-step disclosure in the App and agreed to it, and then separately granted Android's VPN permission.

• We record when you consented and which version of the disclosure you agreed to. If we ever change what the App collects, consent to the old wording is not treated as consent to the new.
• You can review what you agreed to, and when, under Settings & about.

You can stop at any time.

• Pausing protection stops lookup collection immediately.
• Turning off the App's notification access in Android's settings stops message checking.
• Clearing the App's data, or uninstalling it, stops usage records and discards the random ID they carried.
• Uninstalling the App ends everything, and deletes everything the App holds on your phone.
• Each report is a separate, deliberate act. There is no standing consent to send reports.

5. Where your data goes

Lookups are uploaded to our own infrastructure and are not shared with third parties in raw form. Derived signals and threat indicators, for example that a particular domain is associated with fraud, may be shared as security intelligence with fraud analysts at financial institutions and other security teams.

Reports may be analyzed with help from a third-party AI provider. When you send a scam report, its text and any image you attached may be sent to a third-party provider that performs analysis on our behalf, under contract terms restricting its use of the content. We say "may" because we can turn this on without releasing a new version of the App, and we would rather tell you in advance than after the fact. Lookups are never sent to such a provider.

A person may read what you send. A person at EverydaySecurity will likely review your report as well. They may do so to check an automated verdict, pick out scams worth featuring in public education, audit detection quality, or improve our detection. Assume a person may see what you submit.

Service providers. We store and process data on Amazon Web Services. Our servers' technical logs and performance metrics are monitored with Grafana Cloud. Records of how you use the App are processed by PostHog. "Report as wrongly blocked" reports are delivered to our reviewers through Slack.

Your data is used for fraud research and protection. It is not sold, and it is not used for advertising.

6. How long things are kept

On your phone:

• Recorded lookups are deleted automatically after approximately 42 hours.
• Checked messages are deleted 30 days after a decision.
• Uninstalling the App removes everything it holds on your phone, immediately.

On our systems:

• Lookups and scam reports are kept for one year, then deleted.
• "Report as wrongly blocked" reports, including the Slack review message, are deleted after 90 days.
• Technical logs are deleted within 90 days.
• Records of how you use the App are kept for as long as PostHog's plan retains events: one year on its free plan, which we use today, and up to seven years on a paid plan.

Threat indicators and analysis derived from your data, and public education content published under Section 7, may be kept indefinitely, because they no longer contain the original submission.

7. Publishing analysis and examples, including on social media

Publishing what we learn is part of how this work protects people beyond the person who reported a scam. EverydaySecurity may publish content based on its analysis of reports, including social media posts, blog posts, research and press materials. That content may include all or part of what was submitted, not just an extracted indicator.

We will not publish your personal information without your permission.

• Details inside a scam message. Personal information can appear inside someone else's message, for example a scammer addressing you by name or quoting your phone number back at you, without us recognizing it as yours. We make a good-faith, best-efforts attempt to find and remove personal details before anything is published. This is not a guarantee that every embedded detail will be caught.
• Details that are part of the scam. This commitment does not stop us publishing information that is part of the scam itself, such as a phone number, a website address or the scammer's own wording, where that serves the public warning.
• Using your own details. If we want to use your personal information more directly, for example by naming you or quoting your own account of what happened, we will ask your permission first.

How we present examples.

• We may combine several reports into a composite example.
• We make no representation that anything we publish is an exact quote or a faithful reproduction of any one report.
• We do not guarantee credit or attribution, or that we will contact a reporter before or after publishing.

Lookups are never published in raw form, only aggregate patterns derived from them.

If you find your personal information in something we have published, email privacy@everydaysecurity.ai and we will promptly redact or remove it.

8. Personal information inside a report

Scam messages sometimes include personal details: a scammer may address you by name, mention your account, or quote your phone number. If you send a screenshot or the full text of such a message, those details come with it. When you describe a scam in your own words, describe only the scam, not your own name, account numbers or address.

If you have already sent something containing your personal information and want it removed, email privacy@everydaysecurity.ai. We will ask for details that let us find it, such as roughly when you sent it, what it said, and your data ID. Any email address you use for the request is used only to handle it.

9. What we do not do

• We do not sell your data to anyone, for any purpose.
• We do not use your data for advertising, and the App contains no advertising SDK.
• The App has no sign-in, and does not ask for your name, email or any other personal details.
  • We plan to add an account in a future release, so your own decisions about what is junk can carry over to a new phone.
  • When that ships, the App will show a new disclosure describing exactly what becomes linked to your account, and you will be asked to agree before it takes effect.
• We do not collect your location, contacts, call log, photos or advertising ID.
• We do not upload your message notifications, or the list of apps on your phone, in this version of the App.
• We do not read, decrypt or store the contents of your network traffic.

10. Data security

• Everything the App sends to us is encrypted in transit (HTTPS/TLS).
• Our systems use access controls and encrypted storage.
• Data on your phone is kept in the App's private storage, which Android isolates from other apps.
• The block list is digitally signed, and the App refuses a list that does not carry our signature.

No internet service can guarantee absolute security, but as a security company we take protecting this data seriously.

11. Your rights

Finding and deleting your data.

• Uploaded data. Lookups and scam reports carry your data ID, and nothing else that identifies you. To ask for, or delete, what we hold from your phone, email privacy@everydaysecurity.ai with the data ID shown under Settings & about.
• After clearing the App's data. Clearing the App's data gives your phone a new data ID. Data sent under the old one can then no longer be linked to your phone, even by us, so tell us the old ID before you clear it if you want that data deleted.
• On your phone. Pause protection at any time, or uninstall the App to delete everything it holds on your phone.

EU, UK and Switzerland. Our legal basis for processing is our legitimate interest in fraud prevention and public safety. Your data ID is an online identifier, so we treat data carrying it as personal data, with all the rights that come with it. You have the right to complain to your local data protection authority.

California. You have rights under the CCPA. We do not sell or share personal information for advertising. To exercise your rights, email privacy@everydaysecurity.ai.

12. Children

The App is intended for adults. It is not directed at children, and we do not knowingly collect information from children under 13. If you believe a child has used the App, email privacy@everydaysecurity.ai.

13. Changes to this Policy

We will update this Policy as the App changes, and post the new version here with a new date. If we change what the App collects or how it is handled, the in-App disclosure is updated and shown to you again, so your consent applies to the current wording.

14. Contact

Privacy questions and requests: privacy@everydaysecurity.ai