Privacy Policy

Last updated: 2026-08-01

This policy explains what information OTBOY collects, why, and your choices. We keep data collection to a minimum and do not sell your data — ever.

Who we are

OTBOY is a Cordeon project (cordeon.org). For any privacy question, contact us through https://cordeon.org.

What we collect, and why

Your email address — only if you create an account. It is used to send you a one-time sign-in code and to save your progress across devices. We never ask for or store a password.
Your learning progress — which lessons and questions you've done. This is stored on your device, and also on our server if you sign in, so you can continue on another device.
Anonymous usage statistics — we use a privacy-friendly, self-hosted analytics tool (Umami) to understand how the app is used (for example, which lessons are opened, general device type, and approximate location at the country level). This uses no cookies and does no cross-site tracking, and the data stays on our own server.
Payment information — if you subscribe, payment is handled entirely by Lemon Squeezy (our payment provider and merchant of record). We never see or store your card details.
Messages or photos you send to the Scam Checker — see the section below. We do not keep the message text or the photo. The one exception is a link you ask us to report, described there.

The Scam Checker

The Scam Checker lets you paste a suspicious message, email or link — or upload a photo or screenshot of one — and tells you which warning signs it contains. You do not need an account to use it.

Where your text or photo goes. To check it, we send it to an AI service (OpenRouter, which routes it to the AI model we use). A photo is sent so the model can read it, the same way pasted text is sent so it can be read. It is sent over an encrypted connection, is used only to produce your result, and is not kept by us.
What we keep. We keep the result, and a one-way scrambled fingerprint (a hash) of the message or photo. A hash cannot be turned back into your text or your picture. We keep it so that if the same message or photo is checked again we can reuse the answer instead of re-checking it.
What we do not keep. We do not store the message or photo you submit. Neither is written to our database and neither appears in our logs — a photo exists only for the moment it takes to check it. The one exception is a link: if a message is flagged as a likely scam and contains a shortened link, you can choose to have us report that link, and only that link is then kept — see "Reporting a scam link" below. We do not link a check to your account, even if you are signed in.
To be precise about the result we do keep. The result explains what is wrong with the message, so by its nature it describes the message — for example "it asks for a six-digit code" or "the link is not the real courier's website" — and it may quote a short phrase from it. We instruct the AI not to repeat back names, account numbers, passwords or codes, but the result is written by an AI and we cannot promise it never will.
So please be careful what you paste or photograph. Send us the suspicious message, not your own passwords, card numbers or codes — you never need to include those for us to check something.
The result is an automated opinion, not advice or a guarantee. It can be wrong in both directions. We will never tell you that a message is safe.
Reporting a scam link. When a message is flagged as a likely scam and it contains a link on a link-shortening service (for example bit.ly or tinyurl), you may be offered the choice to report it. If you tap to report, we keep: the link itself, what kind of scam it looked like, which language version of the app you were using, when it was first and most recently seen, how many times it has been reported, and whether we have reported it on yet. We do not keep anything else about the message it came from, and we do not keep who reported it — no account, name or IP address is stored with the report, so we cannot tell which report came from which reader. We only keep a link if you tap to report it; we never do this automatically. Links kept this way are passed on to the company that runs the shortening service and to organisations that track and block scam and phishing links, so the link can be taken down or blocked for others.

Who processes data for us

Supabase — secure sign-in and storage of your account and progress.
Lemon Squeezy — payment processing (merchant of record).
Umami — anonymous, cookieless usage analytics, self-hosted on our own server.
OpenRouter — routes Scam Checker text and photos to the AI model that analyses them. Used only when you submit a check.
The company that runs a link-shortening service, and organisations that track and block scam and phishing links — receive a link only if you tap to report it, as described in the Scam Checker section above.

How long we keep it

We keep account and progress data while your account is active. If you delete your account (available in the app), your associated data is removed. Anonymous analytics are retained in aggregate only. Scam Checker results are kept with their scrambled fingerprint; because the fingerprint cannot be reversed and is not linked to you, this data cannot identify you. A link you ask us to report is kept indefinitely; we have no automatic deletion for it at this time.

Your rights

Depending on where you live (including under the EU GDPR, Israel's Privacy Protection Law, Brazil's LGPD, and South Africa's POPIA), you may have the right to access, correct, or delete your personal data, and to withdraw consent. You can delete your account and its data yourself from within the app, or contact us to make a request.

Cookies

OTBOY does not use tracking or advertising cookies. We store a small amount of data on your device (in local storage) only to remember your progress and settings — this is essential to the app working and is not shared.

Children

OTBOY is intended for adults and is not directed at children under 16. We do not knowingly collect data from children.

Changes

We may update this policy. Significant changes will be reflected in the date above.

Contact

To exercise a right or ask a question, reach us through https://cordeon.org.

OTBOY is a Cordeon project. Learn more at cordeon.org.