Controller
The controller is naSpotted spółka z ograniczoną odpowiedzialnością, al. Jana Pawła II 43A/37B, 01-001 Warszawa, Poland, KRS 0001255909, NIP 5273228667. For data matters write to kontakt@rescuno.com.
What we never store
- Passwords to Instagram, Facebook, TikTok or your email. The app has no password field.
- Two-factor codes, SMS codes or backup codes.
- Text you paste into Check. The check runs only on your phone and is never sent.
- Contacts, photos or location. The app does not ask for these permissions.
- Card details. Payments are handled by Apple or Google.
- Emails in your mailbox that are not about social media accounts (see Mail Guard).
If you still type something that looks like a password or a code into a message, the app removes it on the phone and the server repeats the check before saving.
What we process and when
- Account identifier. Created only at the first action that needs the server: a free assessment request, a chat message, connecting email, or a purchase.
- Free assessment request: account name, platform, notice text, sender addresses, report numbers, date, what was tried, answers to three questions and the email address we send the assessment to. Legal basis: steps taken at your request before a contract (Art. 6(1)(b) GDPR).
- Protected account: platform and account name (no password), dates of assignment and confirmation. Legal basis: performance of the contract.
- Chat with Guardian and a person (Protection): message text with passwords and codes removed. Legal basis: performance of the contract.
- Subscription status from RevenueCat: whether Protection is active and since when, the trial, paid months, the store transaction identifier (needed to extend Protection under the reply-time guarantee).
- Push token, if you allow notifications. A notification never contains case or email content.
- Language and time zone, to give reply times in your time.
Account hardening progress, ticked steps, first-launch answers, the evidence checklist, check history and reminders are stored only on your phone.
Mail Guard: email access
Mail Guard works only if you connect a mailbox yourself by signing in with Google (Gmail) or Microsoft (Outlook, Hotmail). We never see your email password.
- Scope: Google and Microsoft grant read access to the whole mailbox, as they offer nothing narrower. We first fetch only the header of a new message (sender and subject). We fetch the content only when the message is about a social media account: from Instagram, Facebook or Meta, or pretending to be them. Other messages are never opened or stored.
- What we store: sender, date, subject (codes removed), message type, verdict and the sender authentication result (DKIM, SPF, DMARC). Content is stored only for genuine notices from Meta, for your evidence file, with codes removed and links shortened to their domain.
- Access tokens are stored encrypted (AES-256-GCM) with the key outside the database. Tokens never reach the phone.
- Retention: verdicts with no evidence value are deleted after 30 days. Notices in the evidence file are kept until you disconnect the mailbox or delete your account. If Protection lapses, after 7 days we disconnect the mailbox and revoke access.
- Disconnecting: in the app (Mail Guard, "Disconnect") or in your Google or Microsoft account settings. Disconnecting deletes the token and the verdicts for that mailbox, and for Google we also revoke the grant.
- Breach alert: once a day the connected address is checked against the Have I Been Pwned breach database. Only the email address is sent.
- No AI: email content is never sent to an AI model. The assessment is rule-based.
RESCUNO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use email data for advertising, do not sell it and do not share it with people outside the RESCUNO team handling your case.
Legal basis: performance of the contract (Protection), on your explicit action (connecting the mailbox).
AI assistant
Guardian's chat replies are generated by Anthropic's Claude language model. The conversation, with passwords and codes removed, is sent to the model. Every AI reply is marked as AI in the app, and a person's reply is signed with a name. We do not use your conversations to train models.
Who at RESCUNO sees your data
A member of the RESCUNO team may read your case, chat and Mail Guard verdicts to help you. Every such access is recorded in an access log.
Who processes data for us
- Supabase: database, servers in the European Union (Frankfurt).
- Vercel: application server (API).
- Google (Gmail API, Pub/Sub) and Microsoft (Graph): access to the connected mailbox and new-mail notifications.
- Have I Been Pwned: checking the email address against breaches.
- Anthropic: the AI model answering in chat.
- Brevo: sending assessment and terms emails.
- RevenueCat: store subscription handling.
- Apple and Google: store, payments and notifications.
Some of these providers process data outside the European Economic Area. In that case the basis is the European Commission's standard contractual clauses or an adequacy decision.
The app has no ads or trackers, and we do not sell data.
How long
Account, case and chat data are kept until you delete your account. Mail Guard rules are in the section above. If you sign a contract with us for running a case, its documents are kept for the period required by tax law and the limitation period for claims.
Deleting your account
In the app, in the Me tab, choose "Delete account and data". We then disconnect your mailboxes (revoking Google access), and delete your account, cases, chat, email verdicts and push tokens. Only a record that the deletion happened remains, with no content. Deleting the account does not cancel a store subscription: do that in your Apple or Google subscription settings.
Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. You can complain to the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych). We make no decisions with legal effect about you solely by automated means: a person always gives the case assessment.