Privacy Policy — Phishy

Last updated: July 2026 · עברית למטה ⬇

Introduction

Phishy ("the App", "we") is an app that detects phishing and scam messages. We take your privacy seriously and are committed to protecting it.

What Data We Collect and How

Content you submit for analysis: the message text (SMS, WhatsApp, email or other) and sender details, if you enter them. This content is collected only when you actively submit it — by pasting it into the App, sharing it from another app, or via automatic notification scanning if you explicitly enabled it. It is transmitted over an encrypted connection (HTTPS/TLS) to our server and to the third-party providers listed below, solely for phishing detection.

Consent first: no content leaves your device before you explicitly agree inside the App — via a dedicated consent step during onboarding and, if consent has not yet been given, a consent dialog shown before your first scan.

Not collected: we do not collect or store your name, phone number, email address, contacts, location, biometric data, or advertising identifiers. Scan history is stored on your device only.

How We Use the Data

Submitted content is used exclusively to analyze whether a message is a phishing or scam attempt, and for no other purpose — no advertising, no profiling, no model training. Analysis happens in real time and the content you check is not stored on our servers. The only exception: if you choose to submit a message via the Report feature, that reported content is stored for up to 90 days and used solely to improve detection.

Third-Party Providers

The message text and sender details are analyzed by Cloudflare (Workers AI) for content analysis. URLs extracted from the message are sent to URL-reputation services. The providers:

• Cloudflare (Workers AI) — AI analysis of the message text
• Google Safe Browsing — URL reputation
• VirusTotal (Google) — URL reputation
• PhishTank (Cisco) — URL reputation
• URLScan.io — URL reputation
• IPQualityScore (IPQS) — URL reputation
• AbuseIPDB — IP reputation
• RDAP — domain registration age lookup
• Cloudflare — server infrastructure

Each provider processes the data under its own privacy policy, linked above, and provides equivalent protections for the data. We never send more data than the analysis requires.

Data Sharing

We do not sell, trade, or transfer personal data to third parties beyond the analysis providers listed above.

Family Mode

Family Mode is an opt-in service that requires an active step on both devices (a pairing code). When enabled:

• Shared with the guardian family member: only the fact that a phishing detection occurred, and when.
• Never shared: message content, sender identity, links, or any other identifying detail.
• Stored on our server: an anonymous device identifier (no name, phone, or email), the pairing identifier, and the time of the last event only.
• Either side may disconnect at any time from the "Family Mode" screen — disconnection is immediate and deletes the pairing from the server.

This anonymous device identifier is used solely to route family alerts and is not linked to your identity or used for tracking.

Data Retention & Security

Analysis is performed in real time; the content you check is not retained on our servers. The only exception: content you explicitly submit via the Report feature is stored for up to 90 days to improve detection. Scan history is stored on your device only and can be deleted at any time from the History screen. Deleting the App removes all local data. API keys are kept on a secured server — never inside the App.

Your Rights

You may withdraw consent at any time by deleting the App. For any question or request regarding your data, contact support@phishyapp.com.

Children

The App is not intended for children under 13, and we do not knowingly collect data from children.

Policy Changes

We may update this policy from time to time. Material changes will be announced in an App update.

Contact

Questions about this Privacy Policy: support@phishyapp.com