What we collect, what we deliberately don't, and who else touches it.
Shieldr exists to help you tell whether a message is real. That only works if you trust us with the things you're unsure about — so this policy explains exactly what we collect, what we deliberately don't, and why.
The short version: we do not store the contents of the messages you check. Not the text, not the images, not the audio. Our database has no column for it.
Shieldr ("we," "our," or "us") is a mobile application that analyzes suspicious text messages, emails, voicemails, letters, and links, and tells you whether they appear safe, suspicious, or fraudulent. This Privacy Policy applies to the Shieldr mobile application and the website tryshieldr.app.
Account information. Your email address and name. If you sign in with Apple and use Apple's Hide My Email feature, we receive and store only the relay address Apple provides.
Onboarding answers. Your country, which categories of scam concern you, whether you're using Shieldr for yourself or for someone else, whether you've encountered a scam before, and how you heard about us. These personalize your experience and help us understand which channels bring people to Shieldr.
Scan results. For every check you run, we store the verdict (safe, suspicious, or scam), the category, our plain-language explanation, the warning signs we identified, and the sender's phone number or email address where one could be extracted.
What we do not store. We do not store the message content itself. When you check a text, screenshot, letter, or voicemail, that content is sent to our analysis provider, a verdict is returned, and the content is discarded. It is never written to our database — the table that holds your scan history has no field for it, so this is enforced by the system's design rather than by policy alone.
Voicemail transcripts, only if you ask. When you check a voicemail, we show you a transcript of what was said. That transcript is discarded unless you explicitly tap "Save it." If you do, it is stored against that scan and visible only to you.
Device identifier. A randomly generated identifier stored securely on your device, used to enforce the one-device limit on Solo plans. It is not linked to any advertising identifier and cannot be used to track you across other apps.
Push notification token. If you enable notifications, we store your device's push token so we can send you alerts. You can revoke this at any time in your device settings.
Subscription status. Whether you have an active subscription and which plan. Payment details are handled entirely by Apple; we never see your card information.
Family membership. If you use a Family plan, we store which accounts belong to which family group.
When a check identifies a sender as fraudulent — and only when a phone number or email address could be extracted from what you shared — we record that sender's identifier, the verdict, and the scam category in a database shared across all Shieldr users. This is what powers the "Trending Scams" feature and lets us warn you when someone else has already reported the same sender.
This record contains no message content and nothing that identifies you. It holds only the sender's identifier, the verdict, the category, and a count of how many times it has been reported.
We also record senders that appear legitimate, so that a known-good number can be recognized as such. If you believe a sender has been recorded incorrectly, you can dispute it from within the app, and the report will be reviewed.
If you join a Family plan, the person who pays can see that you checked something and what the verdict was. They cannot see what the message said — that content does not exist in our systems to be shown. This is deliberate: the feature is meant to let someone notice that a relative is being targeted, not to read their messages.
We keep your account data and scan history for as long as your account exists. You can delete your account at any time from the Settings screen in the app. Deletion removes your account, your scan history, your family membership, and your subscriber record with RevenueCat.
Deleting your account does not cancel your subscription. Subscriptions are managed by Apple and must be cancelled in your Apple ID settings.
Entries already contributed to the shared scam database are not removed on account deletion, because they contain no information about you — only a sender identifier and a verdict.
Your data is protected by row-level security policies, meaning your scans are readable only by your account. Sensitive fields such as subscription status can be written only by our servers, never by an app on a device. All connections use encrypted HTTPS. Your device identifier is stored in the iOS Keychain rather than ordinary app storage.
No system is perfectly secure, and we can't guarantee absolute security — but the architecture is built so that the most sensitive thing we could hold, the content of your messages, simply isn't held at all.
Shieldr is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has provided us with information, contact us and we will delete it.
Depending on where you live, you may have the right to access your data, correct it, delete it, or object to certain processing. You can delete your account directly in the app. For anything else, email hello@tryshieldr.app.
California residents have the right to know what personal information we collect, to request its deletion, and to opt out of its sale. We do not sell personal information. To make a request, email hello@tryshieldr.app.
We may update this policy. Significant changes will be reflected in the date at the top of this page, and where the change affects how we handle your data, we will ask you to review the updated terms in the app.
Questions about this policy: hello@tryshieldr.app