Privacy Policy

Quick Summary

1) Information We Collect

• Account & Contact. Name, email, subscription tier, plan metadata, and a mobile number only when you explicitly enroll in a text-message feature.
• Guardian Submissions. Text, links, publicly shared images/screenshots, and context you provide to our guardians for analysis.
• Device/Usage. IP address, device/browser type, timestamps, pages, diagnostics, crash reports, performance metrics.
• Mama Network Protection (optional) (by invitation while it is in pilot; in the Play app from version 1.0.92). When you turn it on, this phone's network traffic is encrypted to a private PRINCE VPN gateway. The gateway processes destination domain names, IP addresses, connection timing, and data volume only as needed to route connections and block verified scam destinations. When Mama stops a destination from the signed warning list, the app sends that destination to PRINCE only to recheck the current warning evidence. PRINCE immediately converts a confirmed stop into a keyed, unreadable security-event identifier and does not store the raw destination. The minimized event stops contributing to protection continuity after 30 days and scheduled cleanup removes it. PRINCE does not decrypt the contents of protected HTTPS connections and does not create or keep a browsing history. Allowed system DNS lookups go through the encrypted tunnel to Cloudflare 1.1.1.1; Cloudflare may keep limited resolver logs for up to 25 hours and may keep combined statistics. This network data is not sold or used for advertising. If you cut off an app, PRINCE reads the list of apps on this phone so you can choose, and checks on this phone which app opened each new connection, so Mama can refuse the ones you cut off. If you turn on the family lock and choose to hold remote-control apps, PRINCE checks on this phone whether they are installed and notices new ones. None of this leaves the phone. Family lock (optional): with your agreement, someone you trust sets a PIN needed to restore a held app or pause protection, and Mama can hold known remote-control apps offline when they are installed and tells you. Android's VPN settings can always turn protection off.
• Message watch (optional, on your phone). If you turn on message watch in Mama Mode and grant Android's notification access, the PRINCE app reads the sender and text of new notifications from texting, chat and email apps on your device to check them for scam signs. This check happens on your phone: the words are not sent to PRINCE and are not stored, unless you tap a warning to have that message scanned, which is then handled like any scan you submit. To catch scams that build over days, the app keeps on your phone only which scam signs a conversation showed and when, for up to 14 days, filed under a number derived from the conversation's name, never the words. Switching message watch or Mama Mode off erases it.
• Transactional. Purchase history, amounts, currency, limited Stripe tokens (no full card numbers stored by us).
• Community/Support. Messages you send to support or feedback you choose to provide.
• Sensitive Personal Information. We don’t ask for SPI; if you submit it, we process it only to provide the requested service and protect users (see Limit Sensitive PI).

Victim-safety first. When users submit links or evidence about scams/abuse, we remove direct identifiers before any awareness use and follow least-privilege access internally.

2) Sources

We collect data directly from you, automatically via the Services, and from service providers acting on our behalf (e.g., payments, cloud hosting, fraud prevention). We may also ingest publicly available signals you point us to (e.g., a public social post URL) to detect impersonation or deception.

3) Cookies & Similar Technologies

We use a small number of essential and functional cookies (e.g., session, security, rate-limit). We do not run behavioral advertising cookies. You can control cookies in your browser. If we add analytics, we will use privacy-preserving settings and update this page.

4) How We Use Data

• Provide, maintain, and improve the Services (including safety detections)
• Authenticate users, prevent fraud, abuse, and security incidents
• Respond to support requests and communicate about the Service
• Generate aggregate, de-identified insights and threat statistics
• Meet legal, regulatory, and compliance obligations

Not legal/medical/financial advice. Outputs are AI-generated safety signals to help you decide; they are not professional advice or certification of fact.

5) Lawful Bases (EEA/UK only)

• Contract — to provide the Services you request
• Legitimate interests — security, fraud prevention, service improvement (balanced with your rights)
• Consent — where we rely on it (you may withdraw at any time)
• Legal obligation — to comply with applicable laws

6) Sharing & Sub-processors

We share personal data only with service providers that process it for us under contracts that require confidentiality and appropriate safeguards. We may also disclose data to comply with law, protect users, or in a merger/acquisition (with notice and choices where required).

Optional Trusted Circle protection totals. Mama Network Protection does not share browsing activity with family members. If you separately choose a current Trusted Circle member, that person can see only seven-day aggregate counts of protected situations, stops or slow-downs, and moments paused for verification. They never receive sites, destinations, messages, caller words, contacts, case identifiers, or browsing history. The grant expires automatically, can be stopped immediately, and is checked against current Circle membership every time the totals are opened.

See Appendix A for our core sub-processors.

7) International Transfers

We are U.S.-based. When transferring personal data internationally, we rely on appropriate safeguards such as the EU Standard Contractual Clauses with our processors, plus additional measures (encryption in transit, access controls). Where local law requires different mechanisms, we follow those requirements.

8) Retention

We keep personal data only as long as needed to provide the Services, comply with law, resolve disputes, and protect users. You can request deletion at any time (see Make a Request). Aggregated, de-identified metrics may be retained for service integrity.

Mama Network Protection. The PRINCE VPN gateway processes routed traffic in transit but does not write destination domains, IP addresses, timing, or data volume to a browsing-history or traffic log. The technical STOP receipt with its readable destination stays only on your phone and expires after 24 hours; allow-once receipts expire after ten minutes. For a current signed-warning STOP, the app sends the stopped destination transiently to PRINCE for server-side evidence revalidation. The raw destination is not stored. A keyed, unreadable event identifier with fixed protection labels and timestamps may be retained under your account; it stops contributing after 30 days and scheduled cleanup removes it. If you separately grant access, seven-day aggregate protection totals are computed from those minimized events for the Trusted Circle member you selected; no browsing timeline is created. Cloudflare may keep limited DNS resolver logs for up to 25 hours and may keep combined statistics under its resolver privacy commitments. Turning protection off stops future VPN routing. Deleting your account revokes its device credentials and deletes the minimized events and protection-sharing grants, but it cannot retroactively remove resolver records already handled under Cloudflare's retention terms.

Message watch. Notification text is read on your phone and then dropped; it is not sent to or kept by PRINCE. The on-phone record of which scam signs a conversation showed expires after 14 days and is erased when you switch message watch or Mama Mode off.

Your scans. When you run a scan, the raw content you submit — the message text, any image, and the full web address with its path and parameters — is used to produce your answer and is not retained afterward. For accounts with a command center (dashboard), we keep a signal-only record of what the scan found: the verdict, its severity, the website's bare domain (never the full link), which guardian answered, threat-intelligence flags about the site, and the timestamp. This record is never shared, auto-deletes after 90 days, and can be cleared by you at any time. If you switch on "Help others," a separately sanitized threat record (no message, no personal details) may be added to the public feed — see your permissions page for details.

Solomon story originals. If you explicitly choose Keep this original recording or Keep this photo in PRINCE, we retain that audio or photo privately with your life-story chapter until you delete the original or your account. These originals are not public, are not available to Trusted Circle members, are not sent to an AI model, and are never used to clone or synthesize your voice. The app gives you visible play/view, export, and permanent-delete controls for each original.

Helping the guardians learn. If you choose to share (either by leaving "Help others" on for a genuine threat, or by tapping "Help improve PRINCE" on a specific result), the raw example — the message, image, or link — may be kept in a de-identified training set for up to 30 days to make the guardians better at real scams, then it auto-deletes. It is tied to a one-way hash, never to your name or account, is used only to improve detection under review, and is never sold or shown publicly. If you don't share, nothing about your scan enters this set.

The confirmed-threat pattern library. A scam that is confirmed real teaches the guardians the most — so when a shared example is confirmed (because it matched a known-scam list, was independently reported by several unrelated households, was verified by our team, or was judged a threat by our deterministic evidence check), a redacted, de-identified version of it may be kept in a durable threat-pattern library with no fixed deletion date, the way antivirus software keeps virus definitions permanently. Before anything is stored, the content is scrubbed: names, emails, phone numbers, web links, dollar amounts, and long number strings are replaced with typed placeholders (such as [NAME] or [LINK]). What remains is the manipulation pattern and the brand or agency the scammer impersonated — never your identity, and never the raw message. Each entry is tied to a one-way hash, never to your name or account. It is used only to improve detection: our team reviews how the library is used, and, for examples shared on or after October 12, 2026, an automatic check on our own servers may test whether a new detection pattern catches them (the entry is read only on our servers, is never sent to an AI model, and is never copied into a pattern). It is never sold, never shown publicly, and never used to profile any individual. Only shared examples that are confirmed are added: uncertain or harmless scans never enter it, and if you don't share, nothing of yours does either. We keep these de-identified signatures indefinitely because a scam pattern we can still recognize years from now protects more people over time.

Deleting your account. You can delete your PRINCE account and its data yourself from your account page or the app. This erases your profile, plan access, scan-signal history, Solomon memories and stored story originals, trusted-circle records, survey and feedback responses, and connected devices. An active subscription is canceled immediately so it cannot renew; unused time is not automatically refunded. If other people still belong to a team you own, deletion stops until a safe handoff or closure is arranged. Two things remain by design: (1) Billing records — invoices and payment history are retained as financial-record and tax law require, while PRINCE removes their link to your account. (2) Already-shared, de-identified contributions to the public threat feed, the 30-day training set, or the durable confirmed-threat pattern library are not tied to your identity and are covered by the timelines above; because a redacted, confirmed scam pattern is stripped of everything that points back to you, it stays part of the shared shield after your account is gone.

9) Security

• Encryption in transit; limited, logged access in production
• Role-based access control; principle of least privilege
• Backups and disaster recovery for core systems
• Vulnerability and abuse monitoring

No security program is perfect; if we identify a breach affecting you, we will notify you and regulators as required.

10) AI Systems & Model Training

• We use reputable AI providers (currently Amazon Web Services for most guardian analysis, run on our own AWS account (Amazon Bedrock), a second AI reading of some messages, translation, image/video safety analysis, threat-speech scoring, backup AI inference, and voice, plus two checks that are not AI: where a link you scan really leads, and what kind of line a phone number in a scan is; Mistral AI for analysis and image reading; Together AI for inference and audio transcription; and Google, Microsoft Azure, and ElevenLabs for speech synthesis of our answers — see Appendix A) to process the content you submit for safety signals, under data-processing terms; they do not use your content for their own purposes.
• We do not use your personal data to train third-party foundation models. Where a provider allows it, we disable training/retention; otherwise we minimize, pseudonymize, or redact.
• We may train our own lightweight classifiers on de-identified, aggregated patterns to improve threat detection. These training sets are stripped of direct identifiers and are not used to profile individuals for ads or unrelated purposes.
• We keep a durable, de-identified library of confirmed scam patterns (see Retention) to help our own guardians recognize known manipulation over time. Its entries are redacted before storage, tied only to a one-way hash, retained with no fixed deletion date, and used only to improve our detection: under human review and, for examples shared on or after October 12, 2026, by an automatic check on our own servers that tests new detection patterns against them without sending them to any AI model — never to profile people and never sold or shared for advertising.

11) Automated Decision-Making & Profiling

Our guardians generate risk ratings and flags automatically. These are assistive signals for you; we do not make consequential decisions about individuals (e.g., credit, employment, housing) without human review. You may contest or request human review of any automated output that materially affects you.

12) Your Privacy Rights

EEA/UK users: you can lodge a complaint with your local supervisory authority. We’ll cooperate in good faith with all regulators.

13) Children’s Privacy

PRINCE accounts are for people 13 and up, or the age of digital consent where you live. When you create an account we ask for your birth month and year; we keep only whether the check passed, never the date. The Services, including Wallah’s Circle, are not directed to children under 13, and we do not knowingly collect their personal information. A younger child can read Wallah’s Circle together with a parent, from the parent’s account; no account and no data is created for the child. If you believe a child under 13 provided data, contact us for deletion.

Wallah’s Circle, what leaves the phone: the help and lesson choices a young person makes are not recorded. Contacts saved under “My people” and topic picks are stored encrypted on the phone and never uploaded. Opening a lesson checks that the account’s plan includes the Circle and sends no lesson identifier. Ask Wallah, when available, sends the typed question once to our server and to Amazon Bedrock only to choose reviewed lessons; PRINCE does not store the question and keeps no record of who asked.

14) “Do Not Track”

Browsers may send a DNT signal. Because there’s no common industry response standard, we don’t respond to DNT at this time; we already avoid behavioral ads and minimize tracking.

15) Changes to this Policy

We may update this policy to reflect changes to the Services or law. We post updates here and, if changes are material, we’ll provide additional notice.

16) Contact Us

Email our privacy team at info@projectprince.ai. If we appoint an EU/UK representative or Data Protection Officer, we will update this section.

Appendix A · Core Sub-processors