Introduction
SpamWatch is developed and operated by Eric Brasch, an individual developer based in Costa Mesa, California. This privacy policy explains how SpamWatch collects, uses, and protects your information when you use our spam call blocking application.
Information We Collect
- Email address and name at registration
- Phone numbers you report as spam are stored as a cryptographic hash for matching. The phone number you provide for your account is stored in readable form so we can verify it and contact you, and it is included in any complaint you certify
- Spam call reports submitted by the user including reported phone numbers and optional category selection
- If you use complaint documentation: your name, phone number, reported call details, Do Not Call information, consent answers, stop-request information, descriptions and notes, and your certification and authorization records, including the exact text you accepted, the date and time, your IP address, and your browser information
- App usage data including sync timestamps and subscription status
- Payment information processed by Stripe, we never see or store your card details
Information We Do NOT Collect
- Call content or recordings of any kind
- Your contact list or address book
- Location data or GPS coordinates
- Device identifiers beyond what Apple provides for push notifications
- Browsing history or activity outside the app
How We Use Your Information
- To provide spam call identification and blocking through iOS CallKit
- To match your registered number against active marketing lists to warn you proactively before calls arrive
- To aggregate reported numbers into campaign clusters for blocking
- To send push notifications about your protection status and at-risk alerts
- To process subscription payments via Stripe
- To improve our spam detection algorithms
How We Protect Your Information
- Phone numbers you report as spam are stored using HMAC-SHA256 cryptographic hashing with a secret server-side key, so a reported number cannot be recovered from that hash. The phone number you provide for your own account or for a complaint is stored in readable form, because it must be usable for those purposes.
- All data transmission uses TLS 1.2 or higher encryption
- Database access is restricted using row level security policies meaning users can only access their own data
- We never sell your personal information to any third party
- We never share your information with marketers or data brokers
Complaint Submissions
- If you certify a complaint and authorize submission, we may send your complaint information to the telecommunications carrier or voice service provider we identify as associated with the reported calls, or to its abuse, fraud, or compliance department.
- A submission may include your name, phone number, reported call details, Do Not Call information, consent answers, stop-request information, descriptions, notes, and a complaint reference.
- The exact recipient may be identified after you provide your authorization, because the carrier associated with a call is often not known when you certify.
- You may withdraw your authorization at any time before a complaint is sent, which stops any complaint that has not already been sent.
- SpamWatch does not determine whether any law, regulation, or carrier policy was violated. We transmit information at your request and with your authorization. The recipient controls its own review and response.
Spam Number Reporting
- Numbers you report as spam are used to build our shared community block list
- Reported numbers are processed by our clustering system but are not individually attributed to you when distributed to other users
- Reported numbers that reach our confidence threshold are distributed to all SpamWatch users as part of the shared block list
- The block list contains reported spam numbers only, never user personal data
Third Party Services We Use
- Supabase for database and authentication infrastructure
- Stripe for payment processing, subject to Stripe's own privacy policy
- Cloudflare for security and performance
- Apple CallKit for on-device call blocking and identification
- Expo for app build and push notification infrastructure
- PostHog for website analytics and session recording, subject to PostHog's own privacy policy
Website Analytics and Session Recording
- On our website we use PostHog, a product analytics service, to understand how visitors use our pages so we can improve them. This includes page views, the links and buttons visitors click, and the path visitors take through the site.
- On our public sign up and membership pages we also capture session recordings. A session recording is a playback of on page actions such as mouse movement, clicks, and scrolling. We use these only to find where visitors get stuck so we can make the pages clearer.
- We mask everything you type into a form, including your name, email address, phone number, and password, so the characters you type are not captured in a recording.
- We do not record the member area or any complaint pages, so complaint details and reported numbers are never part of a recording.
- We honor your browser Do Not Track setting. When it is turned on, we do not load analytics or session recording for your visit.
- This information is associated with a random identifier stored in your browser and is not linked to your name or email address.
Data Retention
- Account data is retained until you delete your account
- Spam reports are retained to improve platform detection accuracy
- When you delete your account, your active account information is removed or deidentified. We may retain limited records of certifications, authorizations, submitted complaints, transactions, security events, and disputes when reasonably necessary for recordkeeping, fraud prevention, security, dispute resolution, enforcing our agreements, or compliance. Retained information is access restricted and is not used for unrelated marketing.
- Aggregated, non-personal spam detection data may be retained indefinitely
Your Rights
- Request access to the personal data we hold about you
- Request deletion of your account and associated personal data
- Opt out of push notifications at any time through iOS Settings
- Contact us at privacy@getspamwatch.com for any privacy related requests
Children's Privacy
SpamWatch is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information please contact us immediately.
California Privacy Rights
As a California resident you have additional rights under the California Consumer Privacy Act including the right to know what personal information we collect, the right to delete your personal information, and the right to opt out of the sale of personal information. We do not sell personal information. Contact privacy@getspamwatch.com to exercise these rights.
Changes to This Policy
We may update this privacy policy from time to time. We will notify you of significant changes through the app or by email. Continued use of SpamWatch after changes constitutes acceptance of the updated policy.