OwlGuardian Privacy Policy

Last updated: October 1, 2026

OwlGuardian ("we", "our", "the app") is an email security service that protects vulnerable individuals from phishing, fraud, and social engineering by analyzing incoming emails and alerting a designated Trusted Contact when threats are detected.

This privacy policy explains what data we collect, how we use it, who we share it with, and how we protect it.

1. Data We Collect

Account Data

When you sign in with a supported email provider (only Gmail for now), we receive:

• Email address — to identify your account and monitor your inbox
• OAuth access and refresh tokens — to access your email on your behalf via the provider's API or IMAP
• First names — the first name of the Protected User and of their Trusted Contact, if provided during setup. Used so that messages and screens can refer to each person by name.
• Subscription status — when someone subscribes, Apple tells us which plan was bought, when it renews or ends, and whether it is in a free trial. We record whether the subscriber is the Protected User or their Trusted Contact. We never receive or store card numbers or other payment details; Apple handles payment.

Email Data

We access your email through provider-specific methods:

Gmail (via Gmail API):

• gmail.readonly — to read incoming email content (sender, subject, body, headers, labels) for scam analysis
• gmail.modify — to quarantine dangerous emails by modifying Gmail labels (moving to a quarantine label, removing from inbox) and to restore emails when a Trusted Contact marks them as safe

Yahoo Mail and AOL Mail (When Available, via IMAP):

• mail-r (read) — to read incoming email content (sender, subject, body, headers) for scam analysis
• mail-w (write) — to quarantine dangerous emails by moving them to a dedicated "OwlGuardian Quarantine" IMAP folder and to restore emails back to the inbox when a Trusted Contact marks them as safe

We access email content only for the purpose of automated scam detection. We do not access drafts, sent mail, contacts, calendar, or any data beyond what is necessary for threat analysis.

Call My Owl (Photos and Screenshots)

OwlGuardian's "Call My Owl" feature lets you check anything suspicious on demand: a text message, a website, a piece of physical mail, or anything else. You take a photo or choose a screenshot, and that image is sent to OpenAI's API for automated scam analysis, the same way email content is analyzed. OpenAI processes it under their API data usage policy: it is not used to train their models, and OpenAI may keep it for up to 30 days to monitor for abuse. The image is analyzed in real time and is not stored on OwlGuardian's servers; the result is shown on your device. We keep only a record that a check was made and what it cost, not the image or the result.

If you tap "Send to Trusted Contact," the image and its analysis are emailed to your Trusted Contact. That email is sent through Amazon Web Services and then sits in your Trusted Contact's inbox, which OwlGuardian does not control. Nothing is sent to your Trusted Contact unless you tap that button.

The app uses your camera and photo library only for Call My Owl, and only when you use it: the camera to photograph something you want checked, and the photo library to find the screenshot or photo you choose. After a check, you can ask the app to delete that screenshot from your photo library; it does so only after you confirm.

Trusted Contact Information

• Trusted Contact email address — provided by the user during setup, used to send security alert notifications

Phone Numbers and Identity Verification Data

During account setup, we collect:

• Protected User's phone number — provided by the Trusted Contact and confirmed by the Protected User during onboarding. Used for identity verification and to deliver account-related SMS messages (see Section 3 below).
• Trusted Contact's phone number — verified via SMS at the Trusted Contact's own signup, used to deliver account notifications and to establish identity for anti-impersonation purposes.
• Identity verification facts — three short personal facts about the Protected User (such as a pet's name, a grandchild's name, or a street they grew up on) supplied by the Trusted Contact during signup. These facts are displayed to the Protected User during the onboarding flow so that they can confirm the Trusted Contact's identity is legitimate. Facts are encrypted at rest using AWS KMS and are deleted within 30 days of the account being closed or monitoring being revoked.

Analysis Results

When an email is flagged as suspicious or dangerous, we store:

• Sender address and subject line
• Email body text (for Trusted Contact review)
• AI-generated analysis: verdict, risk score, red flags, summary, and recommendation
• Review status and Trusted Contact decisions

Website Visits (owlguardian.net)

When you visit owlguardian.net, we use Google Analytics to understand how many people visit the site, which pages they view, and how many go on to the App Store. Google Analytics uses cookies and collects standard information about your visit, such as the pages you view, your approximate location (city or region), your device and browser type, and how you arrived at the site. We have turned off Google's advertising features (Google signals and ad personalization) for this site, so this information is not used to show you ads.

This website data is kept separate from the OwlGuardian service. It is not linked to your OwlGuardian account, and no email content, Gmail data, Call My Owl images, or phone numbers are ever sent to Google Analytics. The OwlGuardian app itself does not use Google Analytics.

You can opt out by installing the Google Analytics opt-out browser add-on or by blocking cookies in your browser. Google describes how it uses this data in How Google uses information from sites or apps that use our services.

2. How We Use Your Data

• Scam detection — Email content, and any photo or screenshot you submit through Call My Owl, is sent to OpenAI's API for automated analysis to determine if it is safe, suspicious, or dangerous. OpenAI processes this data under their API data usage policy, which states that API inputs and outputs are not used to train their models.
• Email quarantine and restoration — For Gmail, we modify labels to move dangerous emails out of the inbox. For Yahoo/AOL (when available), we move emails to a dedicated IMAP quarantine folder. In both cases, emails are restored when a Trusted Contact confirms they are safe.
• Trusted Contact alerts — When a threat is detected, we send an email notification to the designated Trusted Contact containing the sender, subject, risk assessment, and a link to review the email.
• Review dashboard — Trusted Contacts can view all flagged emails for an account through a web-based dashboard.
• SMS communications — See Section 3 below.
• Subscription management — We use subscription status to turn protection on and off, and to make sure nobody is asked to subscribe for an account that is already covered.

We do not use your data for advertising, marketing, profiling, or any purpose unrelated to protecting you from scams.

3. SMS Communications

OwlGuardian sends SMS (text) messages for account verification and security notifications. This section describes our SMS practices.

Types of SMS we send

• Verification codes — A one-time code sent during setup to confirm that a phone number belongs to the person being protected or to their Trusted Contact. We send these to mobile numbers in the United States, Canada, the United Kingdom, Australia, New Zealand and Israel.
• Account notifications — Messages about your account, such as confirmation that protection has started or that an invitation was cancelled. Sent only to US numbers, and only if you checked the consent box.
• Opt-out confirmations — Confirmation that you have opted out after replying STOP.

All OwlGuardian SMS messages are transactional and related to your account. We do not send marketing or promotional text messages.

Opt-in

Each person gives text-message consent for their own phone number, on the screen where they enter it during setup — in the OwlGuardian iOS app or on our website. Next to an optional checkbox, unchecked by default, they see:

"I agree to receive text messages from OwlGuardian for phone verification, security alerts, and account notifications. Message and data rates may apply. Reply STOP to opt out, HELP for help. Message frequency varies (typically 1–4 per month). OwlGuardian does not share consent or phone-number data with third parties."

Tapping "Send code" asks us to send one verification code, and we send that single text whether or not the box is checked. We send any other text message only to people who checked the box. We keep a record of whether the box was checked, when, and the exact wording shown.

Opt-out and support

You can stop receiving SMS messages at any time by replying STOP to any OwlGuardian text message. You may also reply HELP for assistance or email support@owlguardian.net.

Replying STOP immediately ends all SMS communications to that number and terminates any active monitoring of the associated email account. Your Trusted Contact is notified that monitoring has been revoked.

Message frequency and rates

Message frequency varies based on account activity; typical volume is 1–4 messages per month. Message and data rates may apply depending on your mobile carrier plan. OwlGuardian does not charge for SMS; any charges are assessed by your carrier.

Mobile information sharing

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors who directly support our messaging operations (such as our SMS delivery provider) is permitted in support of those operations. All other categories of personal information exclude text messaging originator opt-in data and consent — this information will not be shared with any third parties.

We do not sell, rent, or trade phone numbers or SMS opt-in data to any third party. Phone numbers and SMS consent are used solely for operating the OwlGuardian service.

4. Data Sharing

We share data only in these limited circumstances:

• Trusted Contact — The person you designate receives email alerts containing the sender address, subject line, AI-generated risk assessment and summary, and a link to review the flagged email (including its body text). The Trusted Contact does not receive access to your entire inbox — only emails flagged as suspicious or dangerous. If you use Call My Owl and tap "Send to Trusted Contact," they also receive that image and its analysis by email.
• Between a Protected User and their Trusted Contact, about the subscription — So that nobody is charged twice, we tell the Protected User when their Trusted Contact is the subscriber (by first name or email address), and we tell the Trusted Contact whether the Protected User's account is already covered and until when. If a Trusted Contact who subscribed is replaced, we tell the Protected User that the previous Trusted Contact was the subscriber and when that coverage ends. We do not share prices paid, payment details, or Apple account information with either person.
• OpenAI — Email content and Call My Owl images are sent to OpenAI's API for scam analysis. OpenAI processes this data under their API terms and does not use API data to train models.
• Amazon Web Services (AWS) — Our infrastructure runs on AWS. Data is encrypted in transit and at rest using AWS Key Management Service (KMS).
• Google Analytics (website only) — Visits to owlguardian.net are measured with Google Analytics, as described under "Website Visits" above. This covers browsing the website only; no data from the OwlGuardian app or your email is shared with Google Analytics.

We do not sell, rent, or trade your personal data to any third party.

5. Data Storage and Security

• OAuth tokens are encrypted using AWS KMS before storage and are never stored in plaintext.
• Review items (flagged email analysis results) are stored in AWS DynamoDB with encryption at rest and are automatically deleted after 90 days via time-to-live (TTL) expiration.
• Email content is not permanently stored beyond the review item record. Full email content is only retained to allow Trusted Contacts to review flagged messages.
• All data transmission uses HTTPS/TLS encryption.
• Access to infrastructure is restricted and secured with IAM policies.

6. Data Retention and Deletion

• Review items are automatically deleted 90 days after creation.
• Account data is retained while your account is active.
• You can request deletion of all your data at any time by contacting us at privacy@owlguardian.net. Upon request, we will delete your account, stored tokens, and all associated review items.
• You can revoke OwlGuardian's access at any time through your provider's account settings: Google Account permissions, or Yahoo Connected Apps (when available).

7. Google API Services User Data Policy Compliance

OwlGuardian's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only use Gmail data for the purpose of providing email security protection as described in this policy.
• We do not use Gmail data for serving advertisements.
• We do not allow humans to read your email data unless you have given affirmative consent for specific messages (via the Trusted Contact review feature), it is necessary for security purposes, or it is required by law.
• We do not transfer Gmail data to third parties except as described in this policy (OpenAI for analysis, Trusted Contact for review).

8. Yahoo/AOL Data Policy Compliance (When Available)

OwlGuardian's use of Yahoo and AOL user data adheres to Yahoo's Developer Network Terms of Use and applicable data access policies.

Specifically:

• We only use Yahoo/AOL mail data for the purpose of providing email security protection as described in this policy.
• We do not use Yahoo/AOL data for advertising, user targeting, or monetization of any kind.
• We do not allow humans to read your email data unless you have given affirmative consent for specific messages (via the Trusted Contact review feature), it is necessary for security purposes, or it is required by law.
• We do not transfer Yahoo/AOL data to third parties except as described in this policy (OpenAI for analysis, Trusted Contact for review).
• We access only IMAP mail data. We do not access contacts (CardDav) or calendar (CalDav) data.

9. Children's Privacy

OwlGuardian is not directed at children under 13. We do not knowingly collect personal information from children under 13.

10. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date. Continued use of the app after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this privacy policy or your data, contact us at:

privacy@owlguardian.net