Privacy Policy

1. Information We Collect & Process

ScamWatch is a public-benefit platform. We process the suspicious text narratives, phone numbers, emails, URLs, and screenshots you submit. Additionally, we transiently log network IP addresses solely for rate-limiting and abuse mitigation.

2. Screenshot & EXIF Metadata Stripping

When users upload screenshots, ScamWatch strips hidden EXIF metadata before storage or review when technically possible.

3. Data Retention Periods

• Raw Connection IP Logs: Deleted automatically within 30 days.
• Submitted Scam Indicators & Redacted Narratives: Retained for up to 3 years to track multi-year threat campaigns and assist law enforcement.

4. AI Training & Model Utilization

De-identified scam texts may be used to fine-tune our local threat-classification models. We do not submit raw narratives containing personal information to third-party AI training sets or commercial models.

5. Who Can Access Reports

Only authorized ScamWatch staff and moderators have access to raw submissions. Publicly published campaign summaries and indicators are completely scrubbed of personal details. De-identified indicator sets are shared with official consumer protection agencies (such as the FTC, FDLE, and Attorney General).

6. Deletion Requests & Access Rights

If you accidentally submitted private information (like your phone number or email) and wish to request deletion, please contact us at privacy@scamwatch.org. We will redact or purge the target records within 24 hours.

7. Minor & Vulnerable User Protection

ScamWatch is not directed at children under 13. We actively redact submissions that appear to contain details of minors. We work with elder protection groups in Florida to ensure our reporting paths are accessible and protective of seniors who are disproportionately targeted by utility and toll scams.

8. Security Standards & Auditing

We implement industry-standard cryptographic practices. All communication with ScamWatch is encrypted via Transport Layer Security (TLS 1.3). Database storage utilizes Row-Level Security (RLS) to enforce data boundaries, and we conduct bi-annual internal security reviews of our ingestion pipelines.

9. Cookies & Analytical Telemetry

ScamWatch does not use tracking cookies or sell your activity data. We collect anonymous, aggregate telemetry regarding route usage to optimize page loads and server resources.

10. Legal Disclosures & Compliance

We cooperate with legal processes when required by law. However, because we strip all personal identification and EXIF data upon ingestion, the data we retain is typically de-identified and aggregate threat data.

11. Florida Sunshine Law & Public Record Exemptions

As a Florida-centric platform, we advocate for consumer safety. We treat user submissions with high confidentiality. We redact sensitive identifiers from reports shared with state agencies to prevent submissions from being subject to unrestricted public records requests that could expose victims.