Privacy

Last updated: August 22, 2026

ScamReflex helps you build a reflex for spotting scams. This page explains what information we collect and how we use it. We keep it plain, because you deserve to understand it.

The short version

We collect only what we need to run ScamReflex and to make it better. We do not sell your personal information, and we do not share it for advertising. When we measure how the application is used, we do it with a random internal code, not your name, email, or phone. ScamReflex is a service for adults.

What we collect and why

When you sign up, we collect three things:

• Your name, so we can address you.
• Your phone number, so we can send you practice scams by text and send a code to confirm it is really you.
• Your email address, so we can send you practice scams and messages about the service by email.

Confirming it is really you

To make sure an account belongs to you, we send a code by text and a link by email. These work only for a short time and then stop working. If one expires, you can ask for a new one.

Your practice-scam history

ScamReflex sends you practice scams. We keep a record of which ones we sent you and whether you reached the lesson page for each. We use this only to see whether the practice is helping.

The practice-scam pages are safe. Nothing you type into one is ever saved or sent. They only look real so that you can practice. You can see your own history any time on your Practice page.

Your answers to our questions

At the bottom of a lesson page we sometimes ask a short question, such as whether the tips were clear. Answering is optional, and you can scroll past.

We keep your answers so we can see which lessons are working and write better ones. Some questions also have a box where you can answer in your own words. We keep what you write there too.

If someone invited you to ScamReflex, your host may read what you write there. Your host is the person who set ScamReflex up for you, and your Account page always names them.

What you write in that box stays in our own records. It is never sent to the service we use to measure how the application is used, and it is never sold.

Write it as something you are happy for your host to read. Please do not put anything private in that box, such as an account number or a health detail. We never need them, and we never ask for them.

If someone invited you to ScamReflex

Some people find ScamReflex on their own. Others are invited by someone who sets it up for them, such as a family member or a community group. We call that person your host, and your Account page always names them.

If you were invited, your host gave us your email address so that we could send you the invitation. Everything else about your account came from you.

Your host holds your place and can see how you are getting on with your practice scams, so they know when to give you a hand. If you stop your practice scams, your host is told that you stopped, and never why.

Your host never sees anything you type into a practice-scam page, because nothing typed there is ever saved. They are never told when your next practice scam is coming.

You can stop at any time. Open your Account page and choose Unsubscribe.

If you are a host

A host is someone who invites other people to ScamReflex and looks after their practice. This section is about your own host account. The section above is for the people you invite. The agreement for a host account is the host terms.

When you create a host account we collect your name, so the people you invite know who invited them, and your email address, which is how you sign in and how we reach you. If your account is for an organization, we collect the organization name, which appears in your invitations. If you signed in with Google, we keep the link to that Google account so you can sign in with it again.

Your name and your email address appear in every invitation you send and on the Account page of each person who joined through you.

We measure how the host pages are used only if you allowed it when you signed up. If you did not, we record nothing about your use of them. To change that choice, write to us and we will change it for you.

Write to us at [email protected] with any question about your host account.

How we contact you

We contact you by text and email to confirm your account, to welcome you, to send the practice scams themselves, and, if you did not open one, to follow up with the lesson.

You can stop the practice scams at any time. Open your Account page and choose Unsubscribe. You keep your account and your history. We simply stop sending you new practice scams.

Who helps us run ScamReflex

To run ScamReflex we rely on a few trusted companies to deliver our text messages and our email. They receive only what they need to deliver the message, such as your phone number or your email address, and they may not use it for anything else.

To improve ScamReflex, we also need to understand how people use it: which pages they visit, what they click, and where they get stuck. We use a product-analytics service called PostHog to help us see this.

• We send PostHog a random internal code that stands in for your account. We do not send your name, your email address, or your phone number.
• We use this only to understand and improve the application. We do not use it to advertise to you, we do not sell it, and we do not share it for advertising.
• You can turn this off. During sign-up there is a checkbox you can uncheck. If it is off, we still count visits in a way that cannot identify you.

You can read about PostHog and how it handles data on their website: posthog.com/privacy.

How we keep it safe

• When you sign in, we keep only a scrambled version of your sign-in key, never one that someone could copy and reuse.
• We use a tool that records how our pages behave, so we can find and fix problems. It is set up to leave out personal information, such as anything you type.

How long we keep it

We keep your information only as long as we need it to run ScamReflex. If you want us to remove your account, write to us at [email protected] and we will close it.

Even after an account is closed, we keep a small record of which practice scams we sent, so we can keep the service safe and honest. We do not keep more than we need.

Asking us about your information

If you want to know what we hold about you, if something we hold is wrong, or if you want your account closed, write to us at [email protected] from the email address on your account. That address is how we know the request is really from you.

We will answer you, and we will not treat you differently for asking.

To stop the practice scams, open your Account page and choose Unsubscribe. To change whether we measure how you use the application, write to us and we will change it.

If something goes wrong

We hope never to need this section. If your information is ever taken, or seen by someone who should not have it, and that puts you at risk, we will tell you. We will write to the email address on your account, as soon as we reasonably can, and we will say plainly what happened, what was involved, and what we suggest you do about it. Where the law requires it, we will tell the authorities too.

Cookies

On the ScamReflex website we use a small number of cookies. Some are necessary to keep you signed in securely. If you were invited by someone, one more necessary cookie carries your invitation from the link you opened to the page where you finish signing up. It lasts less than an hour and is cleared as soon as your account is created. Others help us measure usage, as described above, and only run if you have allowed it.

Changing your analytics choice

To change whether we measure how you use the application, write to us at [email protected] and we will update it for you.

Do Not Track

Some browsers have a "Do Not Track" setting, and some have a "Global Privacy Control" setting. There is no agreed standard for what a website should do when it sees one, so ScamReflex does not respond to them. Whether we measure how you use the application is set by the choice you made when you signed up, and you can change it by writing to us.

Questions

Write to us at [email protected]. For security matters, [email protected].