Privacy Policy

About this policy

Scamward — The Practice Room is provided by Malthe Hertz (“we”, “us”). This policy covers the app, these information pages, and information you choose to send when requesting support.

What the app stores, and why

The app stores the following in its own storage on your device. We do not receive or have remote access to these records.

Practice conversations are fictional, written scenarios bundled with the app. Replies are selected from provided choices. The app does not read your real messages or ask you to upload them. Searches of practices and lessons run on your device.

Optional email account

If you choose Account and request a sign-in code, the app sends your email address to auth.scward.email over HTTPS. Our Cloudflare-hosted authentication service uses Cloudflare Email Service to send a six-digit verification code. Your email provider also processes that message. Requesting a code does not create an account; successful verification does.

The authentication database stores your normalized email address, a generated user ID, verification and creation dates, and session records including creation, expiry, last-use, and revocation dates. It stores keyed digests of session tokens and verification codes, not the raw tokens or codes. Email and IP-derived keyed digests are used to limit abusive requests. Cloudflare necessarily processes IP addresses and request information to deliver and protect the service.

On your device, the session token, account email, user ID, and session expiry are saved only in the iOS Keychain, accessible while the device is unlocked and not transferable to another device. They are not stored in practice history, ordinary preferences, analytics, or app logs. Signing in does not upload, recover, or synchronize your practices or bookmarks.

Account retention and deletion

A verification code expires after ten minutes and can be used once. Sessions expire after thirty days unless revoked earlier; there is no automatic refresh. Account records remain until you delete your account. Expired challenge and session records are removed by scheduled cleanup.

In Account, Sign out revokes the current session and removes its local Keychain record; it does not delete your account or other devices’ sessions. If the server cannot be reached, you can separately remove the session from this device. Local removal does not revoke the server session, which remains valid until revoked or expired.

Choose Delete account in Account and confirm to delete your user record, all its sessions, and the current email challenge from the active authentication database. This needs a valid session and a working connection. If you are signed out, verify your email first. If the result cannot be confirmed, the app tells you rather than claiming deletion succeeded. Contact us if you cannot regain access.

Account deletion does not delete device-local practice history. You may create a new account with the same email later. Pseudonymous anti-abuse buckets are retained until their existing expiry (at most twenty-four hours from creation); deletion does not restart that period. Expired buckets no longer restrict requests and are physically removed by scheduled cleanup, which can occur later.

Deletion from the active database is not immediate erasure from provider backups. Cloudflare D1 point-in-time recovery can retain previous database states for up to thirty days. Cloudflare also processes delivery, security, and operational records under its service terms. Email preview is currently enabled for our sending domain; sent-message previews may be retained for approximately seven days. Copies already delivered to your mailbox are governed by your email provider and your settings. These provider records and mailbox copies are not removed by the app’s account deletion action.

Application authentication logs contain fixed operational event names, not email addresses, raw IP addresses, codes, or tokens. This does not mean that infrastructure or email providers keep no operational records. See Cloudflare’s Privacy Policy, D1 backup documentation, and Email Service activity-log documentation.

What the app does not collect or access

• No advertising identifiers or location access. An email address is collected only when you use the optional account service or contact support.
• No access to your contacts, photos, camera, microphone, messages, or financial accounts.
• No advertising, tracking across apps or websites, or third-party analytics or crash-reporting SDKs.
• No upload of practice data, live AI processing, or app-managed practice sync. Optional authentication uses network requests.
• No sale or sharing of your local practice data.

Retention, deletion, and backups

Local progress remains until you delete it or remove the app. Open the app’s settings (“Your room”), choose Delete all progress, and confirm to remove your unfinished practice, practice history, and saved lessons. Your haptics preference is kept.

Delete all progress does not delete your email account or sign you out. Account deletion and local progress deletion are separate choices. Deleting or offloading the app is not an account-deletion request; use Account before uninstalling. Keychain records may survive reinstallation on the same device.

Deleting the app using the system’s Delete App option removes its local storage, including preferences. Offloading the app can retain its data.

Scamward disables CloudKit sync, but iCloud or computer backups may still include app data according to your system settings. Deleting progress does not remove copies in existing backups; restoring a backup may restore earlier data. Manage backups through Apple’s system settings. We cannot access, recover, or delete those backups for you.

If you contact support

If you email us, we receive your email address and any information or attachments you send. We use this information to respond to your request and troubleshoot the reported issue. Support correspondence is handled by the email providers involved and is separate from sign-in and local practice data.

We keep support correspondence only as long as reasonably needed to handle your request and any applicable legal obligations. Do not send passwords, payment details, verification codes, or other sensitive information. You can request deletion of support correspondence at the address below, subject to applicable legal requirements.

These web pages and platform services

These pages contain no analytics scripts, advertising, forms, or cookies set by us. When served through GitHub Pages, GitHub may process technical information such as your IP address and request details under its Privacy Statement. Website hosting is separate from use of the offline app.

Apple’s App Store, operating-system diagnostics, and backup services operate under Apple’s own privacy terms and your settings. This policy describes Scamward’s behavior and does not replace those terms.

Children’s privacy

Practice does not require an account or personal information. If a child provides personal information through an optional account or support email, a parent or guardian can contact us to request its deletion. Account deletion is also available inside the app as described above.

Your choices and privacy requests

You control local progress through the deletion option above. Depending on your location, you may also have rights to access, correct, or delete personal information you have sent us, or to object to or restrict its processing. Contact us to make a request. We cannot retrieve practice records that remain only on your device. You may also contact your local data protection authority.

Changes

If the app’s data practices change, we will update this policy and its “Last updated” date.

Contact

Malthe Hertz · Scamward
Privacy questions: ivy.barlow9617@gmail.com