Legit — Scam Detection
This policy explains what Legit collects, why, who we share it with, and how you get rid of it. Every section starts with a plain-language summary in green. The full text follows.
You send us a message or a screenshot. We send it to an AI to check if it is a scam. We store the result so you can look at it later. You can delete all of it at any time.
The service is operated by Amir Muradov, Bishkek, Kyrgyz Republic. We are the data controller for the personal data described here.
Contact for any privacy question or request: legit.support@proton.me.
Your sign-in email, the things you ask us to check, the results, who is in your family group, and basic subscription status.
| Data | Why we have it |
|---|---|
| Email address and name from Google or Apple Sign-In | To create and secure your account. |
| Content you submit to be scanned — message text, links, and screenshots | To analyse it and return a scam verdict. This is the core function of the app. |
| Scan results: risk score, verdict, red flags, timestamp | To show your scan history and to alert your family group about dangerous results. |
| Family group membership and invite codes | To let a family share protection under one plan. |
| Device push notification token | To send alerts about high-risk scans in your family group. |
| Approximate country | To show scam warnings and fraud hotlines relevant to where you are. We resolve country only. We do not store precise coordinates or track your movement, and we never request location without asking you first. |
| Subscription status | To unlock paid features. Payment itself is handled by the app store — see section 4. |
| Feedback you give on a scan result | To measure and improve accuracy. |
A scam message usually contains someone else's details: a phone number, a sender name, sometimes a photo. When you submit it, we process that content only to give you an answer. Please do not submit content that is unrelated to a suspected scam, and do not submit other people's private information you have no reason to check.
Mostly because you asked us to check something, which is us doing the job you signed up for.
Where the UK GDPR or EU GDPR applies, our legal bases are:
A short list of service providers who help run the app, plus the family members you invited. We do not sell your data. Ever.
| Provider | What they handle |
|---|---|
| Google (Gemini API) | Analyses the text or image you submit and returns the scam assessment. |
| Supabase | Database, authentication, and file storage. |
| Render | Hosting for our backend service. |
| Google Firebase Cloud Messaging | Delivers push alerts to devices. |
| Google Play / Apple App Store | Process your payment and manage your subscription. We never see or store your card details. |
Your family group. If you join a family group, members can see items that are explicitly shared into the group and can receive an alert when a group member gets a high-risk result. Alerts identify the group, not the person. You can leave a family group at any time.
We do not sell personal data and we do not share it for advertising.
Our database and file storage are operated by Supabase in France (European Union). Our backend service is hosted by Render in Oregon. Content you submit for analysis is processed by Google's Gemini API, which may process it outside the EU, including in the United States. Push notifications are delivered by Google Firebase. Where personal data leaves the UK or EEA, we rely on the appropriate safeguards available to us, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.
Scans stay in your history until you delete them. Delete your account and everything goes.
Ask us for a copy, ask us to fix it, or ask us to erase it. Deleting your account is available inside the app and by email.
You can ask us to: give you a copy of your data, correct it, delete it, restrict or object to our use of it, or export it. If you are in the UK or EU you also have the right to complain to your national data protection authority. If you are in California, you have the right to know, delete, correct, and to opt out of sale or sharing — and we do not sell or share your data as those terms are defined there.
To delete your account and data: open the app, go to Settings and choose to delete your account, or email legit.support@proton.me from your account address. We complete deletion requests within 30 days.
Data is encrypted in transit. Access to your records is enforced at the database level so that only you and, where you have chosen to share, your family group can read them. No system is perfect. If a breach affects your rights, we will notify you and the relevant regulator as required by law.
Legit is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.
Legit gives an opinion, not a guarantee. Never move money based only on what this app says.
Legit uses automated AI analysis. It can be wrong in both directions: it can miss a scam, and it can flag something harmless. It is not financial, legal, or professional advice. Always verify anything involving money directly with your bank, using the number printed on the back of your card.
If we change this policy in a way that matters, we will update the date at the top and notify you in the app before the change takes effect.