PRIVACY POLICY

Legal: Legal Notice · Privacy Policy · Delete Account · Deutsch

This is a courtesy translation. Only the German version is legally binding.

This page explains which data the Shielded app and this website process, for what purpose, for how long, and what rights you have.

Contents

• 1. Controller
• 2. Summary
• 3. Data in the app
• 4. This website (shielded.care)
• 5. Recipients and third countries
• 6. How long we keep data
• 7. Your rights
• 8. Note on the AI check
• 9. Sensitive information in messages
• 10. Minimum age
• 11. Data security
• 12. Changes to this policy

1. Controller

Felix Beresinski
Fischbeker Holtweg 57F, 21149 Hamburg, Germany
Email: shielded.eu@gmail.com

We are not required to appoint a data protection officer (fewer than 20 people regularly process personal data).

2. Summary

• Shielded checks messages that you yourself paste into the app or share with it for signs of fraud.
• To do so, the text is sent to our server and, for analysis, to the AI service Anthropic.
• No advertising, no tracking, no analytics tools, no sale of data.
• You can use the app without an email address.
• The SMS filter on the iPhone works only on your device. Filtered text messages do not leave the iPhone.

3. Data in the app

a) Your account

• Without signing in: a random identifier, so that your checks and your family can be linked to you.
• If you secure your account or sign in: your email address. We only use it to send you sign-in codes, never advertising.
• Optional: name, phone number, your role (protected person or family member).

Legal basis: performance of a contract, Art. 6(1)(b) GDPR.

b) Checked messages

• The text of the message, the result (fraud yes/no, confidence, explanation, type of fraud) and the time of the check.
• Stored so that you can see your previous checks and so that your family can be warned.
• Please note: the message may contain data of other people (e.g. the sender). We use it only for the check. The legal basis for this is our legitimate interest in protecting our users from fraud (Art. 6(1)(f) GDPR).

Legal basis: Art. 6(1)(b) GDPR.

c) Sender number (as a hash only)

• If you provide the sender’s number, we do not store it in plain text, only as a pseudonymised hash (SHA-256).
• From this we count how often this number has been rated as fraud or as harmless across all users. This helps recognise known fraud numbers faster.

Legal basis: legitimate interest in protecting all users from fraud, Art. 6(1)(f) GDPR.

d) Family feature

• If you connect a trusted contact: the link between both accounts, the invitation code (valid for a limited time) and the relationship (e.g. “daughter”).
• Family members see the text of a message only if it was detected as fraud. For other checks they only see the time and result of the most recent check, never the text.
• Connected contacts can see each other’s name and phone number, if you have provided them.
• If you press the help button, your trusted contacts are notified (time of the call for help).
• Warnings are sent as push notifications. For this we store your device’s push token.
• The push token and the settings on your device are strictly necessary for the service you requested (Section 25(2) no. 2 TDDDG).

Legal basis: Art. 6(1)(b) GDPR. You set up the connection yourself and can disconnect it at any time.

e) On your device

• Chosen mode (Simple / Family) and text size. These settings stay on your device.

f) Server logs

• Our server logs every request from the app: IP address, time, requested address, result of the request and app or browser identifier.
• We use this to detect and prevent attacks and abuse and to find errors. We also use the IP address to limit how many requests can be made in a short time.
• Logs are deleted automatically after 14 days.

Legal basis: legitimate interest in secure operation, Art. 6(1)(f) GDPR.

g) Do you have to provide data?

Providing data is not required by law or by contract. However, no check is possible without the text of a message. Name and phone number are optional.

4. This website (shielded.care)

This website is hosted by Hostinger International Ltd. (Cyprus). When you visit it, the server stores technically necessary access data (including IP address, time, page requested) in server logs to ensure secure operation (Art. 6(1)(f) GDPR). How long Hostinger keeps these logs is determined by Hostinger; we do not analyse them. We do not use analytics or advertising cookies on this website.

Contact form: if you write to us via the contact form, we process your details (name, email address, message) in order to answer your enquiry (Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR based on our interest in answering enquiries). We delete them once the enquiry has been dealt with.

5. Recipients and third countries

We use the following service providers as processors. A data processing agreement under Art. 28 GDPR is in place with each of them; it forms part of their terms of service.

Where data is transferred to the USA or can be accessed from the USA, this is based on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the provider is certified under it, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

We do not sell data and do not share it for advertising purposes.

6. How long we keep data

• Checked messages and their results: 12 months after the check, then deleted automatically. If you delete your account earlier, they are gone immediately.
• Account and family connections: until you delete your account.
• Invitation codes: until they expire or are redeemed.
• Stored sender numbers (pseudonymised) and their counts: 24 months after the number was last reported. They are not linked to any person.
• Anonymous accounts: if you delete the app without having secured your account, we can no longer link it to you. If such an account is not used for 3 months, we delete it automatically with all its data.
• Server logs: 14 days.

7. Your rights

You have the right to

• access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20),
• object to processing based on legitimate interest (Art. 21), each under the GDPR.

Simply write to us at shielded.eu@gmail.com.
Delete your account: you can do this yourself at any time in the app under Settings (Einstellungen) → “Delete account” (Konto löschen). All options are listed on the Delete Account page.

Right to object: you may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (sender hashes, server logs, third-party data in checked messages) (Art. 21 GDPR).

You can lodge a complaint with a data protection supervisory authority, e.g. the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.

8. Note on the AI check

The check is automated using AI and can be wrong. It does not replace your own judgement. No automated decision with legal or similarly significant effect (Art. 22 GDPR) takes place; the result is advice only.
If in doubt: do not pay anything, do not pass on any codes, and contact the company via its official phone number.

9. Sensitive information in messages

Only check what is needed for the assessment. Before pasting a message, please remove particularly sensitive details that have nothing to do with the possible scam, such as information about health, religion or political opinions (Art. 9 GDPR), as well as full account numbers, PINs or passwords. Only paste other people’s messages if you are entitled to do so.

10. Minimum age

Shielded is intended for adults. You must be at least 18 years old to use it. Persons under 18 may not create an account. If we learn that an account belongs to a minor, we will delete it together with the associated data.

11. Data security

We protect your data with technical and organisational measures under Art. 32 GDPR, including encrypted transmission between the app and the server, access restrictions, and storing senders only as a pseudonymised hash. However, no one can guarantee completely secure transmission over the internet.

12. Changes to this policy

If the app, our service providers or the law change, we will update this Privacy Policy. The version published here applies; its date is shown below.

Last updated: 5 October 2026

Legal: Legal Notice · Privacy Policy · Delete Account · Deutsch