Privacy

Last updated: July 6, 2026

ScamReflex helps you build a reflex for spotting scams. This page explains what information we collect and how we use it. We keep it plain, because you deserve to understand it.

The short version

We collect only what we need to run ScamReflex and to make it better. We never sell your information. When we measure how the application is used, we do it with a random internal code, not your name, email, or phone. ScamReflex is a service for adults.

What we collect and why

When you sign up, we collect three things:

• Your name, so we can address you.
• Your phone number, so we can send you practice scams by text and send a code to confirm it is really you.
• Your email address, so we can send you practice scams and messages about the service by email.

Confirming it is really you

To make sure an account belongs to you, we send a code by text and a link by email. These work only for a short time and then stop working. If one expires, you can ask for a new one.

Your practice-scam history

ScamReflex sends you practice scams. We keep a record of which ones we sent you and whether you reached the lesson page for each. We use this only to see whether the practice is helping.

The practice-scam pages are safe. Nothing you type into one is ever saved or sent. They only look real so that you can practice. You can see your own history any time on your Practice page.

How we contact you

We contact you by text and email to confirm your account, to welcome you, to send the practice scams themselves, and, if you did not open one, to follow up with the lesson.

You can stop the practice scams at any time. Open your Account page and choose Unsubscribe. You keep your account and your history. We simply stop sending you new practice scams.

Who helps us run ScamReflex

To run ScamReflex we rely on a few trusted companies to deliver our text messages and our email. They receive only what they need to deliver the message, such as your phone number or your email address, and they may not use it for anything else.

To improve ScamReflex, we also need to understand how people use it: which pages they visit, what they click, and where they get stuck. We use a product-analytics service called PostHog to help us see this.

• We send PostHog a random internal code that stands in for your account. We do not send your name, your email address, or your phone number.
• We use this only to understand and improve the application. We do not use it to advertise to you, and we never sell it.
• You can turn this off. During sign-up there is a checkbox you can uncheck. If it is off, we still count visits in a way that cannot identify you.

You can read about PostHog and how it handles data on their website: posthog.com/privacy.

How we keep it safe

• When you sign in, we keep only a scrambled version of your sign-in key, never one that someone could copy and reuse.
• We use a tool that records how our pages behave, so we can find and fix problems. It is set up to leave out personal information, such as anything you type.

How long we keep it

We keep your information only as long as we need it to run ScamReflex. If you want us to remove your account, write to us at [email protected] and we will close it.

Even after an account is closed, we keep a small record of which practice scams we sent, so we can keep the service safe and honest. We do not keep more than we need.

Cookies

On the ScamReflex website we use a small number of cookies. Some are necessary to keep you signed in securely. Others help us measure usage, as described above, and only run if you have allowed it.

Changing your analytics choice

To change whether we measure how you use the application, write to us at [email protected] and we will update it for you.

Questions

Write to us at [email protected]. For security matters, [email protected].