Privacy policy

Introduction

Timbrespark Studios ("we," "us," or "our") operates the Scamhound email scam detection service (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect information when you use our Service.

We are committed to protecting your privacy and handling your data responsibly. This policy is designed to be transparent about our practices and help you understand your rights.

Information we collect

Information you provide directly

Account information:

• Email address
• Name (optional)
• Password (encrypted)
• Payment information (processed securely through Stripe; we do not store full credit card details)

Email content you forward:
When you forward an email to our analysis service, we collect:

• The sender's email address and name
• The email subject line
• The email body (HTML and plain text)
• Email headers and metadata
• Attachments (file names and types, not content unless necessary for analysis)
• The date and time you forwarded the email

Information collected automatically

Usage information:

• IP address (anonymised for analysis)
• Browser type and version
• Device type
• Service usage patterns
• Analysis request timestamps

Cookies and tracking: We use essential cookies for authentication and session management, security and fraud prevention, and service functionality. We do not use advertising or third-party tracking cookies.

Information from third parties

We receive confirmation of successful payments from Stripe, but we do not receive or store your full credit card information. When emails are forwarded to our service, we receive the email content through Mailgun's infrastructure.

How we use your information

Primary service functions

• Scam detection: Analyse forwarded emails using AI to detect phishing, fraud, and scams
• Response delivery: Send you analysis results and recommendations via email
• Account management: Create and maintain your account, process subscriptions
• Usage tracking: Monitor your tier limits (anonymous/free/paid) and usage

Service improvement

• Model training: Improve our scam detection AI by analysing patterns in emails (with personally identifiable information removed)
• Quality assurance: Review uncertain or flagged emails to improve accuracy
• Analytics: Understand how users interact with our service to improve features

Legal and safety

• Fraud reporting: Report confirmed scams to relevant authorities (IC3, UK SERS)
• Legal compliance: Comply with applicable laws and regulations
• Security: Protect against fraud, abuse, and security threats

Data retention

We believe in collecting only what we need and keeping it only as long as necessary.

What we remove before training

Before using email content to improve our AI models, we automatically strip all personally identifiable information (PII):

• Recipient names and email addresses
• Credit card numbers
• Social security numbers
• Phone numbers, physical addresses, account numbers
• Any other personal identifiers

We retain only sender domain patterns, email structure and formatting, link domains (not full URLs with tracking), and content patterns indicative of scams.

Retention periods

How we share your information

We do not sell, rent, or trade your personal information. We share information only in the following limited circumstances.

Service providers

We share data with trusted third parties who help us operate our service:

• Mailgun: Email sending and receiving infrastructure
• Anthropic: AI analysis via Claude API (email content only, no personal data)
• Stripe: Payment processing
• Hosting provider: Server infrastructure (data encrypted at rest)

All service providers are contractually obligated to protect your data and use it only for providing services to us.

Legal authorities

We report confirmed high-confidence scams (>80% confidence) to the FBI Internet Crime Complaint Center (IC3) for US users, and the UK Suspicious Email Reporting Service (SERS) for UK users. All PII is removed before reporting. We also comply with valid legal requests when required by law.

Business transfers

In the event of a merger, acquisition, or sale of assets, user information may be transferred to the acquiring entity. We will notify you of any such change and your options.

Your rights and choices

Access and portability

• View your data: Access all your forwarded email history through your dashboard
• Export your data: Download your analysis history in CSV format

Correction and deletion

• Update account: Change your email, name, or password at any time
• Delete analysis: Remove individual email analyses from your history
• Delete account: Request complete account deletion, which will delete all your personal information within 30 days, remove your email analysis history, cancel any active subscriptions, and anonymise any data used for model training

Marketing and communications

• Control which emails you receive via your account settings
• Unsubscribe from marketing emails via the link in any email
• We will still send account-related emails (analysis results, security alerts, billing)

We do not sell personal information and never have.

Regional privacy rights

European Economic Area users (GDPR)

If you are located in the EEA, you have additional rights under the General Data Protection Regulation:

• Right to access a copy of your personal data
• Right to rectification of inaccurate personal data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability in a machine-readable format
• Right to object to processing based on legitimate interests
• Right to withdraw consent at any time
• Right to lodge a complaint with your local data protection authority

Legal basis for processing: We process your data based on contract performance (to provide our service), legitimate interests (to improve our service and prevent fraud), your consent (where given), and legal obligation (to comply with applicable laws).

Data transfers: Your data may be transferred to and processed in the United States. We ensure appropriate safeguards through Standard Contractual Clauses (SCCs) approved by the European Commission.

California residents (CCPA/CPRA)

California residents have rights under the California Consumer Privacy Act and California Privacy Rights Act, including: right to know, right to delete, right to opt-out of sale (we don't sell), right to non-discrimination, right to correct, and right to limit use of sensitive personal information.

UK users

UK users have rights under UK GDPR similar to EEA users. Our UK representative can be contacted at privacy@timbresparkstudios.com.

Data security

We implement industry-standard security measures to protect your information.

Technical safeguards

• Encryption in transit: all data transmitted using TLS 1.3
• Encryption at rest: all stored data encrypted using AES-256
• Password security: passwords hashed using bcrypt
• Secure APIs: API keys rotated regularly and stored securely
• Rate limiting: protection against brute force attacks

Breach notification

In the unlikely event of a data breach affecting your personal information, we will notify you within 72 hours of discovery, inform relevant authorities as required by law, and provide guidance on protective measures you can take.

Children's privacy

Scamhound is not intended for users under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly. If you believe a child under 18 has provided us with personal information, please contact us at privacy@timbresparkstudios.com.

International data transfers

Scamhound is based in the United States. If you access our Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries. We ensure appropriate safeguards are in place for such transfers, including Standard Contractual Clauses for EEA transfers, adequacy decisions where applicable, and your explicit consent where required.

Third-party links

Our Service may contain links to third-party websites and services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before providing any information.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will update the "Last Updated" date at the top and notify you via email or a prominent notice on our website. Continued use of the Service after changes constitutes acceptance.

Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices:

• General inquiries: privacy@timbresparkstudios.com
• Data protection officer: privacy@timbresparkstudios.com
• GDPR inquiries (EEA): privacy@timbresparkstudios.com
• CCPA inquiries (California): privacy@timbresparkstudios.com
• UK GDPR inquiries: privacy@timbresparkstudios.com

We aim to respond to all privacy requests within 30 days (or sooner as required by applicable law).

Company information:
Timbrespark Studios
1675 Route 228 #1075
Cranberry Township, PA 16066
United States