Privacy

Last updated: October 21, 2026

ScamReflex helps you build a reflex for spotting scams. This page explains what information we collect and how we use it. We keep it plain, because you deserve to understand it.

The business responsible for your data is the one named in our Legal notice.

The short version

We collect only what we need to run ScamReflex and to make it better. We do not sell your personal information, and we do not share it for advertising. When we measure how the application is used, we do it with a random internal code, not your name, email, or phone. ScamReflex is a service for adults.

What we collect and why

When you sign up, we collect three things:

• Your name, so we can address you.
• Your phone number, so we can send you scam examples by text and send a code to confirm it is really you.
• Your email address, so we can send you scam examples and messages about the service by email.

Confirming it is really you

To make sure an account belongs to you, we send a code by text and a link by email. These work only for a short time and then stop working. If one expires, you can ask for a new one.

Your scam-example history

ScamReflex sends you scam examples. We keep a record of which ones we sent you and whether you reached the lesson page for each. We use this only to see whether ScamReflex is helping.

The fake pages are safe. Nothing you type into one is ever saved or sent. They only look real so that you can practice. You can see your own history any time on your Scams page.

Your answers to our questions

At the bottom of a lesson page we sometimes ask a short question, such as whether the tips were clear. Answering is optional, and you can scroll past.

We keep your answers so we can see which lessons are working and write better ones. Some questions also have a box where you can answer in your own words. We keep what you write there too.

If someone invited you to ScamReflex, your host may read what you write there. Your host is the person who set ScamReflex up for you, and your Account page always names them.

What you write in that box stays in our own records. It is never sent to the service we use to measure how the application is used, and it is never sold.

Write it as something you are happy for your host to read. Please do not put anything private in that box, such as an account number or a health detail. We never need them, and we never ask for them.

If someone invited you to ScamReflex

Some people find ScamReflex on their own. Others are invited by someone who sets it up for them, such as a family member or a community group. We call that person your host, and your Account page always names them.

If you were invited, your host gave us your email address so that we could send you the invitation. Everything else about your account came from you.

Your host holds your place and can see how you are getting on with your scam examples, so they know when to give you a hand. If you stop your scam examples, your host is told that you stopped, and never why.

Your host never sees anything you type into a fake page, because nothing typed there is ever saved. They are never told when your next scam example is coming.

You can stop at any time. Open your Account page and choose Unsubscribe.

If you are a host

A host is someone who invites other people to ScamReflex and looks after their practice. This section is about your own host account. The section above is for the people you invite. The agreement for a host account is the host terms.

When you create a host account we collect your name, so the people you invite know who invited them, and your email address, which is how you sign in and how we reach you. If your account is for an organization, we collect the organization name, which appears in your invitations. If you signed in with Google, we keep the link to that Google account so you can sign in with it again.

Your name and your email address appear in every invitation you send and on the Account page of each person who joined through you.

We measure how the host pages are used, and link it to your host account, only if you allowed it on the last host sign-up step, which every way of signing up reaches, including Google. If you did not, we still count visits to the host pages in a way that cannot identify you, and nothing is linked to your account. To change that choice, write to us and we will change it for you. You can also stop us from measuring your visits in this browser with the button under "Changing your analytics choice" below.

Write to us at [email protected] with any question about your host account.

How we contact you

We contact you by text and email to confirm your account, to welcome you, to send the scam examples themselves, and, if you did not open one, to follow up with the lesson.

You can stop the scam examples at any time. Open your Account page and choose Unsubscribe. You keep your account and your history. We simply stop sending you new scam examples.

Who helps us run ScamReflex

To run ScamReflex we rely on a few trusted companies to deliver our text messages and our email. They receive only what they need to deliver the message, such as your phone number or your email address, and they may not use it for anything else.

To improve ScamReflex, we also need to understand how people use it: which pages they visit, what they click, and where they get stuck. We use a product-analytics service called PostHog to help us see this.

• We send PostHog a random internal code that stands in for your account. We do not send your name, your email address, or your phone number.
• We use this only to understand and improve the application. We do not use it to advertise to you, we do not sell it, and we do not share it for advertising.
• You can turn this off. The last sign-up step has a checkbox you can uncheck, whichever way you sign up, including with Google. Outside the United States it starts unchecked. Further down this page you can turn it off for this browser. If it is off, we still count visits in a way that cannot identify you.

You can read about PostHog and how it handles data on their website: posthog.com/privacy.

How we keep it safe

• When you sign in, we keep only a scrambled version of your sign-in key, never one that someone could copy and reuse.
• We use a tool that records how our pages behave, so we can find and fix problems. It is set up to leave out personal information, such as anything you type.

How long we keep it

We keep your information only as long as we need it to run ScamReflex. If you want us to remove your account, write to us at [email protected] and we will close it.

Even after an account is closed, we keep a small record of which scam examples we sent, so we can keep the service safe and honest. We do not keep more than we need.

Asking us about your information

If you want to know what we hold about you, if something we hold is wrong, or if you want your account closed, write to us at [email protected] from the email address on your account. That address is how we know the request is really from you.

We will answer you, and we will not treat you differently for asking.

To stop the scam examples, open your Account page and choose Unsubscribe. To change whether we measure how you use the application, write to us and we will change it.

If something goes wrong

We hope never to need this section. If your information is ever taken, or seen by someone who should not have it, and that puts you at risk, we will tell you. We will write to the email address on your account, as soon as we reasonably can, and we will say plainly what happened, what was involved, and what we suggest you do about it. Where the law requires it, we will tell the authorities too.

Cookies

On the ScamReflex website we use a small number of cookies. Some are necessary to keep you signed in securely. If you were invited by someone, one more necessary cookie carries your invitation from the link you opened to the page where you finish signing up. It lasts less than an hour and is cleared as soon as your account is created.

Other cookies help us measure usage, as described above. If you are visiting from the United States, they are on by default, unless you turn them off below or your browser sends Global Privacy Control. Everywhere else, they run only if you allowed them when you signed up. Without them, we still count visits in a way that cannot identify you. One more small cookie records only whether your visit comes from the United States, so we know which of these applies.

Changing your analytics choice

The button below changes whether we measure your visits in this browser only. To change the choice saved with your account, write to us at [email protected] and we will update it for you.

Do Not Track and Global Privacy Control

Some browsers have a "Global Privacy Control" setting. If your browser sends it, we do not measure your visits in that browser before you sign up, and the sign-up checkbox starts unchecked. If you check it when you sign up, we follow the choice you made.

Some browsers have a "Do Not Track" setting. There is no agreed standard for what a website should do when it sees one, so ScamReflex does not respond to it. You can use the button above, or the sign-up checkbox, instead.

Questions

Write to us at [email protected]. For security matters, [email protected].