Privacy policy
Draft of October 21, 2026
This policy is a draft under legal review and may change before Upstander launches. It describes how the app works today.
Who we are
Upstander is an app and website that helps people check for scams, report them, recover after a loss and warn others. It is made by Porchlit, LLC, a Missouri company ("we", "us").
Questions about privacy: privacy@upstander.app.
The short version
•
Checking a message, number or link works without an account. We do not store what you check.
•
We never sell your personal information.
•
Reports are anonymous to the public. Counts are shown only once at least 5 people have reported the same thing.
•
Partners and sponsors see only totals, never your reports.
•
You can delete your account at any time in the app or on the website.
When you check something
The text, phone number, email or link you check is used to answer you and is not stored. Phone numbers, emails, payment IDs and links are turned into one-way hashes to look up reports. Personal details in a message are removed before any automated review.
For messages, we may ask an AI service (Anthropic's Claude) for a second look. It receives the message with personal details already removed, and we use it only to answer you. We keep a count of checks and their result (for example "likely scam"), without the content.
What we collect
Only what the feature you use needs:
•
Your email address, if you sign in with email or with Google or Apple. We use it to sign you in and, only if you ask for them, to send the weekly email and alerts.
•
Your phone number, if you verify it to report scams. It goes to our text-message provider once to send the code. We keep only a scrambled, one-way version (a "hash"), never the number itself.
•
Your approximate area (about 5 km, never your exact location), for neighborhood alerts and the Watch feed, and the US area code you save if you turn on scam-spike alerts.
•
What you choose to write or save: scam reports, Heads Ups to your circles, stories you agree to share, and the reference numbers you save on your own recovery case.
•
Screenshots you attach to a report. Names and numbers are blurred on your phone before upload, and we scan again on our servers and reject anything that still shows personal details.
•
An account number we create, to keep your points, reports and settings together.
•
A record of the one-time Supporter purchase, if you make it (processed by Apple, Google or Stripe through RevenueCat). We never see your card details.
•
How the app is used: anonymous events such as "a check was completed" (no text you typed), and, on your account, which days you used it and which parts (check, learn, report, recover, share), so we can credit referrals and suggest a next step.
•
Crash reports, with personal details removed before they leave the app.
•
If ads are shown and you agree to personalized ads, ad interactions handled by Google AdMob. Ads never appear on check, report or recovery screens, or within 72 hours of a loss report.
•
Your device advertising identifier, only if you allow tracking in your phone settings (on iPhone, through the "Allow Tracking" prompt).
What we do not collect
•
Your contacts or address book. Trusted contacts are invited by a link you send.
•
Your precise location.
•
Audio. Voice input uses your phone's own speech recognition; only the text reaches us.
•
Bank or card numbers, government IDs, health information or browsing history.
How we use it
•
To run the app: answer checks, take reports, send the alerts you asked for, and keep your recovery case.
•
To keep the community safe: review reports and posts, and stop abuse and spam.
•
To improve Upstander: understand which features help, using the usage data above.
•
To show totals to the public, partners and sponsors, never individual people or reports, and nothing under 5 people.
•
With your consent, to show ads (see above) and to turn a story you share into a lesson.
Who we share it with
We do not sell personal information. We share it only to run Upstander:
•
People you choose: Heads Ups and Watch posts go to the audience you pick (a circle, neighbors or everyone), without your name. If you add trusted contacts, they get a short alert when you report losing money, never the details.
•
Hosting and databases: Google Cloud and Supabase (in the United States).
•
Sign-in: Google and Apple, if you choose them.
•
Text-message codes: our SMS provider, when phone verification is on.
•
Email: our email provider, for emails you asked for.
•
Notifications: Expo, Apple and Google, to deliver push notifications.
•
AI review: Anthropic, for messages with personal details removed.
•
Crash reports and product analytics: Sentry and PostHog, with personal details removed.
•
Purchases: RevenueCat, Stripe, Apple and Google.
•
Ads: Google AdMob, only as described above.
•
Domain and network services: Cloudflare.
Legal requests
We may disclose information if the law requires it, or to protect people from harm or fraud.
How long we keep it, and deleting your account
We keep your information while you have an account. Delete your account in the app (Account, then Delete account) or on the website (/account). Sign-in stops at once, and we erase your account data 30 days later.
Some things stay after erasure: reports stay as anonymous counts, no longer linked to you, so they keep warning others; purchase records stay as long as tax law requires.
Your choices and rights
You can see and change most of your information in the app. Depending on where you live, you may also have the right to access, correct, delete or get a copy of your information, and to withdraw consent. Email privacy@upstander.app and we will respond within the time the law requires.
You can turn off alerts, emails, personalized ads and story sharing at any time in the app or your phone settings.
Security
Everything is encrypted in transit. Identifiers are stored as one-way hashes, access is limited to the people who need it, and we never put personal details in our logs. No system is perfectly secure, so please tell us at once if you notice a problem.
Children
Upstander is made for adults. We do not knowingly collect personal information from children under 13. If you believe a child has given us information, contact us and we will delete it.
Where your information is stored
We store information in the United States, including for people who use Upstander in India.
Changes to this policy
If we change this policy in a way that matters, we will tell you in the app before the change takes effect.