Short Version — What Data Do We Collect?
The plain-language summary. The full policy below has every detail.
Just the essentials:
- Email addresses — encrypted, never stored in plain text. Your account email is used for sign-in and account communication; the addresses you choose to monitor (up to 3) are only used for breach monitoring.
- Name (optional) — displayed on your profile only. You can use any name you like, including a nickname or pseudonym. It isn’t used for any functional purpose and doesn’t affect your service.
- Device token — for sending push notifications.
- Profile preferences — region, character, language. These tailor your comic experience. You choose them freely, and you can change them anytime to explore scams affecting other age groups or regions. Since you choose them, they carry no real privacy value to us — they don’t identify you or reveal anything personal.
- Subscription status — trial, active, cancelled, etc. Synced from Apple or Google; we don’t see your payment details.
That’s it. We don’t collect browsing data, location data, contact lists, or anything else not strictly needed to provide the service.
1. Introduction
1.1 About This Policy
This Privacy Policy (“Policy”) describes how DIGIGRACE PTY LTD ABN 58 695 498 545 (“Company,” “we,” “us,” or “our”), an Australian company, collects, uses, discloses, and protects your personal information when you use the Protect-Me mobile application (“App,” “Service”).
We are committed to protecting your privacy and handling your personal information in accordance with the data-protection laws of the places where the Service is offered, including:
- The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), and other applicable U.S. state privacy and breach-notification laws
- The Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada, and the personal information protection Acts of British Columbia and Alberta
- The Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth)
- The New Zealand Privacy Act 2020
- The Singapore Personal Data Protection Act (PDPA)
- The Hong Kong Personal Data (Privacy) Ordinance (PDPO)
- The United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 (which will apply when the Service becomes available in the United Kingdom)
- Other applicable data protection laws in the regions where we operate
Service availability: Protect-Me is offered in the United States, Canada, Australia, New Zealand, Singapore, and Hong Kong, with the United Kingdom to follow. We determine your region from your App Store / Google Play storefront country. The Service is not offered in the European Union or European Economic Area, the province of Quebec (Canada), South Korea, Japan, or Taiwan. If you reside in any of those regions, please do not use the Service. (Localized scam-alert content and translated interface text may be available within the app, but using such content does not change the region that applies to you — that is always your app-store storefront country.)
1.2 Your Consent
By downloading, installing, or using our App, you consent to the collection, use, and disclosure of your information as described in this Policy. If you do not agree with this Policy, please do not use our Service. If you use the app as a guest (without an account), we hold only the minimal guest record described in Section 5. Your explicit consent — age confirmation and agreement to these policies — is collected before an account is created.
1.3 Children’s Privacy
Our Service is intended for users aged 16 years or older per our Terms and Conditions, and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe we have collected information from a person under 16, please contact [email protected] and we will delete the information promptly. (Before your account is created — when you subscribe or add an email address to monitor — we ask you to confirm you are 16 or older; we do not collect a date of birth.)
1.4 Geographic Restrictions
This Service is not available in certain regions (see our Terms and Conditions for the full list). If you are in a restricted region, you should not use this Service.
2. Information We Collect
2.1 Information You Provide
We collect: your account email address (used for sign-in and account communication — with Sign in with Apple this may be an Apple private-relay address; encrypted at rest, never plain text), the email addresses you choose to monitor — up to three, chosen by you (also encrypted), an optional name (may be a pseudonym), and pre-defined dropdown selections for region, language, and comic character preference. If you use fake face detection, the image you submit is processed transiently — sent to our AI image-analysis provider, the result returned to your phone, and the image itself is never retained on our servers. Support inquiries you send us are held by our email provider for continuity of conversation.
2.2 Information Collected Automatically
When you use the app we automatically collect: device type, operating system, and app version (for service optimization); a push notification token (for delivery — not linked to your identity); a coarse country derived from your IP address (no GPS, no precise location — used for fraud prevention and regional scam-alert localization); and basic server access logs (IP, endpoint, timestamp).
2.3 Information from Third Parties
We receive: authentication tokens and your verified email from our third-party authentication provider when you sign in; anonymous purchase receipts and subscription status from Apple App Store / Google Play when you subscribe; and breach records matching your monitored emails from Have I Been Pwned (HIBP) when we run breach checks on your behalf.
2.4 Sensitive Information
Our app cannot collect sensitive information. All data inputs in the app are either email addresses or pre-defined selections (region, language, character preference). There are no free-text fields, so there is no path through which racial or ethnic origin, political opinions, religious beliefs, health information, sexual orientation, criminal records, or other special-category data could enter our systems.
3. How We Use Your Information
3.1 Primary Purposes
We use your data to provide and maintain the Service, process subscriptions via app stores, monitor for data breaches affecting you, send security alerts and notifications, provide customer support, and authenticate your identity. The legal basis for all of these is contract performance (or, for authentication, our legitimate interest in keeping your account secure).
3.2 Secondary Purposes
We may also use limited, non-identifying signals (described in Section 5.1) to prevent fraud and abuse, comply with legal obligations, and improve our help content.
We do not send newsletters, marketing emails, or product-update mailings, and we do not maintain a marketing contact list. The only emails you will receive from us are transactional: breach alerts, account / billing notices, and support replies.
3.3 Automated Decision-Making
Our Service uses automated processing to calculate risk scores, determine breach severity levels, and generate security recommendations. These automated processes inform but do not make legally binding decisions about you. You can request human review of any automated assessment by contacting us.
4. Information Sharing and Disclosure
4.1 We Do NOT Sell Your Data
We do not sell, rent, or trade your personal information to third parties for their marketing purposes.
For California residents: We do not “sell” or “share” personal information as defined under the CCPA.
4.2 Third-Party Service Providers
We share information with service providers who assist in operating our Service:
| Provider Type | Purpose | Data Shared |
|---|---|---|
| Cloud Hosting (our third-party hosting provider, a third-party CDN and DDoS protection provider) | Server infrastructure, CDN, DDoS protection | Encrypted service data, request metadata |
| Apple App Store / Google Play | App distribution and in-app purchase processing | Purchase receipts (no card data) |
| third-party email delivery provider | Breach notification and account emails | Email address, alert content |
| third-party authentication provider | User authentication | Auth tokens, verified email |
| third-party push notification service | Push notifications | Device token, notification payload |
| AI image-analysis provider | AI image analysis; alert-image generation | Submitted images (transient, not retained); no user identity |
| Have I Been Pwned (HIBP) | Breach monitoring queries | Monitored email addresses (hashed k-anonymity where supported) |
| third-party object storage | Comic image storage | Generated comic images only (no user PII) |
All service providers are contractually bound to use data only for specified purposes, maintain appropriate security measures, not disclose data to other parties, and delete data upon contract termination.
4.3 Threat Intelligence Queries
Email breach monitoring: We send your monitored email addresses to Have I Been Pwned to check for exposure in known data breaches. Queries do not include your name, password, device ID, or other account information.
Image analysis: Images you submit (from your camera or photo gallery, through another app's Share button, or as screenshots of your screen taken by a check during a video call) are transmitted to our third-party AI image-analysis provider. They are used solely to produce the assessment shown to you, are not retained on our servers after analysis, and are not associated with your account identity at the provider. Provider terms are available on request.
Third-party privacy policies. The processors listed in §4.2 each operate under their own published privacy policies. We will provide a current copy or link for any of those processors on request — email [email protected]. The single processor whose policy we link directly is Have I Been Pwned, because users need to be able to independently query the public breach database themselves: haveibeenpwned.com/Privacy.
4.4 Legal Disclosures
We may disclose your information when required to comply with applicable laws, respond to lawful requests from public authorities, protect our rights, enforce our Terms and Conditions, or investigate potential violations or fraud.
4.5 Business Transfers
If we are involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.
5. Data Retention
We are deliberately stingy about what we keep. Most of what you see in the app exists for as long as your account does, and is permanently deleted when you ask us to close it. The table below is the complete picture of every category of personal data we touch.
5.1 Data Lifecycle
Anything not in this table is not retained.
| What | Where it lives | How long | Why |
|---|---|---|---|
| Your account email address (encrypted) | Server-side | Until you delete your account | Sign-in and account communication |
| Email addresses you monitor (encrypted) | Server-side | Until you delete your account | Breach monitoring |
| Optional name; region, language, comic character preference | Server-side | Until you delete your account | Personalized scam alerts |
| Apple's record of your subscription (plan, status and renewal dates; it holds no name or email) | Server-side | While the subscription exists, including after you delete your account: it belongs to your Apple ID, not to your Protect-Me account | Premium access, and reconnecting the subscription if you use the app again with that Apple ID |
| Apple's notifications about your subscription (the changes Apple reports, such as renewals, cancellations and refunds) | Server-side | 90 days after we receive each one, then deleted | Applying each change exactly once |
| Push notification token | Server-side | Until you delete your account or disable notifications | Push delivery |
| Names + detection dates of breaches your emails appeared in | Server-side (names only — never breach contents) | Until you delete your account | “1 new breach this month” delta |
| Full breach details (passwords, leaked field types, descriptions, dates) | Your phone only — never written back to our servers | Until you uninstall the app or delete your account | In-app breach history |
| Images you submit for a fake face check | Never stored — sent transiently to our AI image-analysis provider; result returned to your phone | N/A | One-time analysis |
| Image check results (the result, its summary and the kind of manipulation found; never the image) | Server-side | Until you delete your account | Your weekly check limit, and the same answer if you check the same image again within 24 hours |
| Recent Checks (each check’s result and a small preview of the image) | Your phone only — never sent to our servers | Until you delete them, sign out, or uninstall the app | Awareness → Recent Checks |
| Scam alert comics | Cached on your phone; canonical catalog held server-side | On phone: until you uninstall. Server: until library updated. | Offline viewing |
| Help-article interaction logs (which articles you tapped) | Server-side (anonymous to article codes; never the wording of any question or answer) | 180 days, then auto-purged | Help-content quality |
| Email correspondence with help@ | Server-side (per third-party email provider defaults) | Per third-party email provider defaults | Continuity of support conversations |
| Server access logs (IP, endpoint, timestamp) | Server-side (per hosting provider defaults — typically up to 90 days) | Per hosting provider defaults | Security and debugging |
| Account-deletion audit record (internal identifiers, the timestamp of your deletion request, and which subscriptions the account was connected to — never the email itself) | Server-side | Indefinite legal hold | Proof we honored your deletion request if challenged |
| Guest preview record (no name, no email address) | Server-side | Up to 3 months after the guest preview ends, then deleted. If you subscribe without an account, kept while it is connected to an active subscription, then deleted under the same rule (no reminder: a guest record has no email address). | Operating the 14-day guest preview, and a subscription bought without an account |
| Abuse-prevention record for the guest preview (no name, no email address, no account) | Server-side | Up to 12 months, then deleted | Preventing repeated free previews on the same device |
| Account created but never subscribed | Server-side | 37 days after your guest preview ends (warning email sent first), then permanently deleted unless you subscribe | Grace period to subscribe with your account intact |
| Account after a subscription lapses | Server-side | 30 days after your subscription ends (reminder sent first), then permanently deleted unless you re-subscribe | Grace period to come back with your history intact |
| Account disconnected from a shared subscription | Server-side | 7 days after the account is disconnected because its Apple subscription was used by more than five accounts (warning email sent first), then permanently deleted unless you open the app with the Apple ID that holds the subscription | Limit on how many accounts one subscription can serve |
| Account we have disabled (suspended or terminated under Section 3.4 of our Terms) | Server-side | 30 days after the account is disabled, then permanently deleted | Enforcing the Terms |
What we do not retain at all:
- Your Apple Account password — Sign in with Apple is handled by Apple and our third-party authentication provider; we never see it.
- The plain text of your email address — only the encrypted form and a hash for lookups.
- The images you submit for fake face analysis — passed transiently to the AI provider and dropped.
- The content of breaches your email appeared in — only breach names and detection timestamps.
- Any in-app analytics, behavioural tracking, screen-view, feature-use, or user-journey data — the app does not collect them and we do not run any analytics or crash-reporting SDK.
- Any marketing list — we do not run marketing campaigns, send newsletters, or share your details with marketers.
5.2 Account Deletion
You can delete your account at any time from Settings → Data & Privacy → Delete Account in the app, or by emailing [email protected] from the address associated with your account with the subject line “Delete My Account”. On deletion:
- Your authentication record at our third-party authentication provider is removed.
- Every row in §5.1 marked “Until you delete your account” is permanently deleted within 30 days.
- Backups containing your data are purged within 90 days.
- What survives is described in §5.1: the account-deletion audit record, which demonstrates compliance with your request if challenged, and Apple’s records of your subscription, which belong to your Apple ID. None of them holds your email address or your name.
Deleting your account does not cancel your subscription: it belongs to your Apple ID and Apple keeps renewing it until you cancel it (see Terms Section 4.6).
Separate from deletion you request, guest preview records, lapsed-subscription accounts and accounts we have disabled are deleted automatically on the schedules shown in §5.1.
For the full step-by-step guide — every deletion method, timelines, and exactly what is removed and retained — see our Account & Data Deletion page.
6. Data Security
6.1 Security Measures
Technical Safeguards:
- Encryption in transit and at rest using industry-standard methods
- Database access controls
- Network firewalls and monitoring
- Regular security audits
Organizational Safeguards:
- Employee access restrictions
- Security awareness training
- Incident response procedures
- Vendor security assessments
6.2 Security Limitations
While we take reasonable steps to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.
6.3 Privacy-First Architecture
Email addresses are NEVER stored in plain text in our database.
All email addresses are encrypted at rest and additionally hashed for lookups. Your actual email address is never kept in readable form. Even in the event of a database compromise, your email address cannot be recovered by an attacker.
Most of your sensitive data never leaves your phone.
When we check your monitored email addresses against breach databases, the result — which breaches your address appeared in, what types of information were leaked, and when — is delivered to your phone and held there. Our servers retain only:
- A count of how many breaches were found
- The name of each breach detected, and when we detected it (used to tell you “1 new breach this month” — not the breach contents)
The breach details — the leaked field types, the breach description, the breach date — are not written to our servers. They remain on your phone and are gone when you uninstall the app or delete your account.
The same principle applies to fake face image checks: the image is sent to our AI image-analysis provider, the result is returned to your phone, and the image itself is never retained on our servers. The result you receive is an AI-assisted second opinion with a confidence score, not a guarantee of authenticity.
Scam alert comics are cached on your phone for offline viewing; we keep the canonical copy server-side so the same comic can be re-delivered if you reinstall.
6.4 Security Incidents
In the event of a data breach affecting your information:
- We will notify you and the relevant supervisory authorities as soon as practicable after becoming aware, and in any event within any timeframe required by applicable law
- We will provide information about steps you can take
7. Your Privacy Rights
7.1 What you can do, today, in-app
These controls are available to every user, regardless of location:
| Capability | Where to find it |
|---|---|
| Delete your account — removes all server-side records (encrypted email, monitored addresses, breach counts and names, scan history, comic preference) within 30 days; backups purge within 90 days. What survives is an audit record of the deletion and Apple’s record of your subscription (see §5.1). | Settings → Data & Privacy → Delete Account |
| Add or remove monitored email addresses | Breaches → Add (press and hold an email to edit or delete it) |
| Change your comic preference (region, character, language) | Awareness → Comic Profile |
| Turn push notifications on or off | Settings → Notifications → Push Notifications |
| Turn the scam alert comics on or off | Settings → Comic Alerts → Comic Scam Alerts |
Because the app collects only your name, email, and dropdown preferences — and stores most of the interesting data on your phone, not on our servers — the data you can see in the app is the data we have. The in-app screens are effectively your data export. If you would like a copy of the personal information we hold in a portable form (for example, to exercise a data-portability right), email [email protected] and we will provide it.
7.2 Australian Privacy Rights
Under the Privacy Act 1988 (Cth), Australian residents have the right to access their personal information, request correction of inaccurate information, and lodge a complaint with the OAIC about privacy practices.
7.3 Canadian Privacy Rights (PIPEDA)
Canadian residents have the right to access the personal information we hold about them, request correction of inaccurate information, withdraw consent for the collection, use, or disclosure of personal information (subject to legal and contractual restrictions), and lodge a complaint with the Office of the Privacy Commissioner of Canada.
7.3.1 New Zealand Privacy Rights (Privacy Act 2020)
New Zealand residents have the right to request access to and correction of the personal information we hold (we respond within 20 working days). Personal information is processed overseas (in the United States); because the United States is not prescribed as having comparable safeguards, overseas recipients may not be required to protect the information in a way that is, overall, comparable to the New Zealand Privacy Act — by using the Service you authorise this overseas disclosure. We also collect breach information about you from third-party breach databases (such as HIBP), as described when you add an email address to monitor and in this Policy. Complaints may be made to the Office of the Privacy Commissioner (privacy.org.nz).
7.3.2 Singapore Privacy Rights (PDPA)
Singapore residents may request access to and correction of their personal data (we respond within 30 days) and may withdraw consent. Personal data is transferred to and processed in the United States under contractual safeguards consistent with the PDPA Transfer Limitation Obligation. Our Data Protection Officer can be reached at [email protected]. Complaints may be made to the Personal Data Protection Commission (PDPC).
7.3.3 Hong Kong Privacy Rights (PDPO)
Hong Kong residents may make a data access request or data correction request, to which we respond within 40 days. Requests and enquiries may be sent to [email protected]. Complaints may be made to the Office of the Privacy Commissioner for Personal Data (PCPD).
7.3.4 United Kingdom Privacy Rights (UK GDPR)
When the Service becomes available in the United Kingdom, UK residents will have the rights to access, rectification, erasure, restriction, portability, and to object to processing based on legitimate interests; we respond within one month. Personal data is transferred to the United States under appropriate safeguards (such as the UK International Data Transfer Agreement or the UK Extension to the EU–US Data Privacy Framework, depending on the recipient). Complaints may be made to the Information Commissioner’s Office (ICO). The contact details of our UK representative will be published here when appointed.
7.3.5 Regions Where the Service Is Not Offered
The Service is not offered in the European Union or European Economic Area, the province of Quebec (Canada), South Korea, Japan, or Taiwan. If you are located in any of those regions, please do not use the Service.
7.4 California Privacy Rights (CCPA/CPRA)
California residents have the right to:
| Right | Description |
|---|---|
| Know | Know what personal information we collect and why |
| Delete | Request deletion of personal information |
| Correct | Correct inaccurate personal information |
| Opt-out | Opt-out of “sale” or “sharing” of personal information |
| Non-discrimination | Not be discriminated against for exercising rights |
Notice at Collection (CCPA/CPRA § 1798.100). In the preceding 12 months, we have collected the following categories of personal information:
- Identifiers — email address (encrypted at rest), optional display name or pseudonym, authentication ID issued by our third-party authentication provider, push notification token
- Commercial information — subscription state passed to us by the platform store (Apple App Store / Google Play). We do not receive or store payment card details.
- Visual information — images you voluntarily submit for fake face analysis. Images are transmitted transiently to our third-party AI image-analysis provider and are not retained by us afterwards. We keep only the result of the analysis, never the image itself.
- Internet or network activity — server-side access logs (IP address, endpoint, timestamp) retained by our hosting provider per their default retention. We do not use these for profiling.
We do not collect geolocation beyond what an IP address inherently reveals, do not run any analytics or crash-reporting SDKs in the app, and do not maintain a marketing list. We do not sell and do not share your personal information as those terms are defined under the CCPA/CPRA, and we do not use it for targeted or cross-context behavioral advertising. Because we do not sell or share personal information, there is no “Do Not Sell or Share” action to take. We do not use or disclose sensitive personal information for purposes outside those permitted by CPRA § 1798.121.
7.5 Exercising Your Rights (including Account Deletion)
To access, correct, or delete your account and associated data, you have three options:
- In-App: open the Protect-Me app and navigate to Settings > Data & Privacy > Delete Account.
- Web deletion request: email [email protected] from the address associated with your account with the subject line “Delete My Account”. We will confirm and process the request.
- Written request: send a letter to the contact address in Section 12.
We respond to rights requests within the timeframe required by your local law — within 45 days for California (CCPA, extendable once to 90 days with notice); 30 days for Canada (PIPEDA), Australia, and Singapore; 20 working days for New Zealand; 40 days for Hong Kong; and one month for the United Kingdom. We aim to acknowledge every request promptly and to meet the strictest applicable timeline wherever feasible. We may request identity verification before processing a request. Upon deletion, personal identifiers are removed within 30 days and purged from backups within 90 days.
7.6 Right to Complain
If you are unsatisfied with our response, you may lodge a complaint with:
- United States (California): California Privacy Protection Agency (cppa.ca.gov) or the California Attorney General (oag.ca.gov)
- United States (other states): your state Attorney General’s consumer protection office
- Canada: Office of the Privacy Commissioner of Canada — priv.gc.ca — 1-800-282-1376 (Alberta residents may also contact the Alberta OIPC)
- Australia: Office of the Australian Information Commissioner (OAIC) — oaic.gov.au — 1300 363 992
- New Zealand: Office of the Privacy Commissioner — privacy.org.nz
- Singapore: Personal Data Protection Commission (PDPC) — pdpc.gov.sg
- Hong Kong: Office of the Privacy Commissioner for Personal Data (PCPD) — pcpd.org.hk
- United Kingdom: Information Commissioner’s Office (ICO) — ico.org.uk (when the Service becomes available in the United Kingdom)
8. Mobile App Specific Information
8.1 App Permissions
| Permission | Purpose | Required? |
|---|---|---|
| Internet | Core functionality | Yes |
| Notifications | Security alerts | Recommended |
| Camera | Fake face image detection | Optional |
| Photo Gallery | Fake face image detection | Optional |
8.2 Local Storage
The App stores certain data locally on your device: authentication tokens (secure storage), user preferences, and cached breach data. This data is encrypted and remains on your device unless synced to our servers.
8.3 Push Notifications
We use push notifications to alert you about new data breaches affecting your monitored emails, critical security updates, and subscription status changes. You can turn push notifications off in the app at Settings > Notifications > Push Notifications (and the scam alert comics at Settings > Comic Alerts > Comic Scam Alerts), or in your device’s notification settings.
8.4 In-App Analytics
The Protect-Me app does not collect in-app analytics, behavioural tracking, screen-view events, feature-use metrics, or user-journey data. No third-party analytics SDK, crash-reporting SDK, attribution SDK, or comparable telemetry SDK is integrated into the mobile app.
Server-side access logs (IP address, endpoint hit, timestamp, response status) are managed by our hosting provider per their default retention — see § 5.1. Crash reports may be collected at the operating-system level by Apple (iOS) or Google Play (Android); those are governed by the respective platform’s privacy policies, not by us.
9. International Data Transfers
9.1 Data Location
Your data is processed in the United States via our third-party hosting provider, and by our third-party providers for authentication, push notifications, AI image analysis, and email delivery. DIGIGRACE PTY LTD is incorporated in Australia, so contractual governance and company records are held in Australia. Wherever you are, your personal information is transferred to and processed in the United States; by using the Service you acknowledge and (where your local law requires consent for such a transfer) consent to this. We determine which region’s rules apply to you from your App Store / Google Play storefront country.
9.2 Transfer Safeguards
When data is transferred across borders, we rely on Data Processing Agreements with all sub-processors and on the contractual and security certifications (e.g., SOC 2, ISO 27001) maintained by those providers.
9.3 Cross-Border Safeguards by Region
- Australia (APP 8): we take reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles, principally through our agreements with each provider.
- New Zealand (IPP 12): because the United States is not prescribed as having comparable safeguards, we rely on contractual protections and your authorisation of the overseas disclosure (see 7.3.1).
- Singapore (PDPA s.26): we ensure a comparable standard of protection through contractual obligations on our providers.
- United Kingdom (UK GDPR Chapter V): transfers rely on the UK International Data Transfer Agreement / Addendum or the UK Extension to the EU–US Data Privacy Framework, depending on the recipient.
- Canada (PIPEDA): we remain accountable for personal information transferred to providers for processing and use contractual safeguards to protect it.
10. Third-Party Links and Services
Our Service may reference external resources for security guidance. We are not responsible for the privacy practices of third-party websites or services. The App is distributed through the Apple App Store and Google Play Store, whose privacy policies govern app download, in-app purchase processing, and app review data. Sign-in is provided via Sign in with Apple or, for accounts created before it was introduced, via email and password through a third-party authentication provider; we do not offer other social sign-in providers.
11. Changes to This Policy
We may update this Policy periodically. Changes will be indicated by an updated “Last Updated” date, in-app notification for material changes, and email notification for significant changes. Your continued use of the Service after changes constitutes acceptance of the updated Policy. Previous versions are available upon request.
12. Contact Information
Privacy Inquiries
Privacy Officer / Data Protection Officer
DIGIGRACE PTY LTD
Email: [email protected]
This address is also the published contact for our Data Protection Officer for the purposes of the Singapore PDPA and the privacy-rights contact for all other regions.
General Contact
For general support inquiries: [email protected]
Response Times
We aim to respond to privacy inquiries promptly, and to formal access/correction/deletion requests within the timeframe required by your local law (see Section 7.5).
13. Summary of Key Points
- We collect the bare minimum needed to run the Service — encrypted email, monitored email addresses, profile preferences, subscription state, push notification token
- We use your data to deliver breach alerts, scam alerts, and fake face checks; nothing else
- We do NOT sell your personal information to third parties — and we do not run a marketing list, newsletter, or analytics SDK
- We share data only with the small number of service providers needed to operate the Service
- We protect your data with encryption at rest and in transit; email addresses are never stored in readable form
- You can delete your account, add or remove monitored email addresses, change your comic preference, and adjust notification settings at any time from the in-app Settings screen
- We retain server-side data only while your account is active; account deletion is permanent within 30 days, with backups purged within 90 days. Guest preview records and lapsed-subscription accounts are deleted automatically (see Section 5)
- Your rights apply wherever the Service is offered. Local laws (U.S. state laws incl. California CCPA/CPRA, Canada PIPEDA + BC/Alberta, Australia Privacy Act, New Zealand Privacy Act 2020, Singapore PDPA, Hong Kong PDPO, and — when the Service becomes available in the UK — UK GDPR) give you formal rights and we honor them (see Section 7). The Service is not offered in the EU/EEA, Quebec, South Korea, Japan, or Taiwan.
Document Version: 3.3 · Policy Version: 2026-09-29 · Last Reviewed: October 10, 2026