OTBOYOTBOY
Back

Privacy Policy

Last updated: 2026-07-31

This policy explains what information OTBOY collects, why, and your choices. We keep data collection to a minimum and do not sell your data — ever.

Who we are

OTBOY is a Cordeon project (cordeon.org). For any privacy question, contact us through https://cordeon.org.

What we collect, and why

  • Your email address — only if you create an account. It is used to send you a one-time sign-in code and to save your progress across devices. We never ask for or store a password.
  • Your learning progress — which lessons and questions you've done. This is stored on your device, and also on our server if you sign in, so you can continue on another device.
  • Anonymous usage statistics — we use a privacy-friendly, self-hosted analytics tool (Umami) to understand how the app is used (for example, which lessons are opened, general device type, and approximate location at the country level). This uses no cookies and does no cross-site tracking, and the data stays on our own server.
  • Payment information — if you subscribe, payment is handled entirely by Lemon Squeezy (our payment provider and merchant of record). We never see or store your card details.
  • Messages you paste into the Scam Checker — see the section below. We do not keep the text.

The Scam Checker

The Scam Checker lets you paste a suspicious message, email or link and tells you which warning signs it contains. You do not need an account to use it.

  • Where your text goes. To check it, we send it to an AI service (OpenRouter, which routes it to the AI model we use). It is sent over an encrypted connection, and it is used only to produce your result.
  • What we keep. We keep the result, and a one-way scrambled fingerprint (a hash) of the message. A hash cannot be turned back into your text. We keep it so that if the same message is checked again we can reuse the answer instead of re-checking it.
  • What we do not keep. We do not store the text you paste. It is not written to our database and it does not appear in our logs. We do not link a check to your account, even if you are signed in.
  • To be precise about the result we do keep. The result explains what is wrong with the message, so by its nature it describes the message — for example "it asks for a six-digit code" or "the link is not the real courier's website" — and it may quote a short phrase from it. We instruct the AI not to repeat back names, account numbers, passwords or codes, but the result is written by an AI and we cannot promise it never will.
  • So please be careful what you paste. Paste the suspicious message, not your own passwords, card numbers or codes — you never need to include those for us to check something.
  • The result is an automated opinion, not advice or a guarantee. It can be wrong in both directions. We will never tell you that a message is safe.

Who processes data for us

  • Supabase — secure sign-in and storage of your account and progress.
  • Lemon Squeezy — payment processing (merchant of record).
  • Umami — anonymous, cookieless usage analytics, self-hosted on our own server.
  • OpenRouter — routes Scam Checker text to the AI model that analyses it. Used only when you submit a check.

How long we keep it

We keep account and progress data while your account is active. If you delete your account (available in the app), your associated data is removed. Anonymous analytics are retained in aggregate only. Scam Checker results are kept with their scrambled fingerprint; because the fingerprint cannot be reversed and is not linked to you, this data cannot identify you.

Your rights

Depending on where you live (including under the EU GDPR, Israel's Privacy Protection Law, Brazil's LGPD, and South Africa's POPIA), you may have the right to access, correct, or delete your personal data, and to withdraw consent. You can delete your account and its data yourself from within the app, or contact us to make a request.

Cookies

OTBOY does not use tracking or advertising cookies. We store a small amount of data on your device (in local storage) only to remember your progress and settings — this is essential to the app working and is not shared.

Children

OTBOY is intended for adults and is not directed at children under 16. We do not knowingly collect data from children.

Changes

We may update this policy. Significant changes will be reflected in the date above.

Contact

To exercise a right or ask a question, reach us through https://cordeon.org.

OTBOY is a Cordeon project. Learn more at cordeon.org.