Privacy Policy

Last updated: May 30, 2026

1. Overview

LinkWard ("we," "our," or "us") is a mobile application that analyzes URLs and email text to identify potential phishing threats. This Privacy Policy explains what information we collect, how we use it, and your rights.

2. Information We Collect

Content You Submit for Analysis

When you use LinkWard to analyze a URL or email text, that content is transmitted over HTTPS to our backend and forwarded to the Claude API (operated by Anthropic, PBC) to perform the analysis. We do not retain the content of your submissions after the analysis completes. Job records used to return your result are short-lived and expire automatically.

To reduce cost and latency, our backend may cache the analysis verdict for a short period. The cache is keyed by a one-way cryptographic hash (SHA-256) of your normalized submission — the key cannot be used to reconstruct the original content. The cached value is AI-generated text that may reference the URL or domain you submitted. Cache entries are not linked to your account or device identifier and expire automatically after a short period.

Device Identifier (to enforce free-scan limits without an account)

Because LinkWard does not require an account, we need a way to apply the free scan allowance fairly per device. When you scan without signing in, the App generates a random identifier stored privately on your device and sends it with each analysis request. Our backend stores only a one-way SHA-256 hash of this identifier alongside your scan count, never the identifier itself. It is not an advertising identifier, is not linked to your name, email, or Apple ID, and is not used for tracking or profiling. Signing in supersedes it: your allowance then follows your account.

Account Information (only if you choose to sign in)

LinkWard does not require an account to analyze content. If you choose to Sign in with Apple (for example, to subscribe to LinkWard Pro or to track your monthly scan allowance), we create a minimal server-side record containing:

• a pseudonymous identifier provided by Apple (not your name or email),
• your subscription tier (free or paid),
• your monthly scan count and reset date (used solely to enforce usage limits).

We do not receive or store your name. We use Apple's "Hide My Email" relay where applicable and do not build an advertising or behavioral profile from your activity.

Purchase Information

Subscriptions (LinkWard Pro) and one-time scan packs are processed by Apple (App Store) or Google (Google Play) and managed through RevenueCat, Inc., our subscription infrastructure provider. We receive purchase and subscription status (e.g., active tier, renewal or expiration) from RevenueCat to unlock paid features. We do not receive or store your payment-card details. Those are handled entirely by the app store.

Information We Do Not Collect

• We do not track your location.
• We do not use advertising networks or analytics SDKs.
• We do not sell or share your data with third parties for marketing.

3. How We Use Your Information

• Submitted content is used solely to perform the phishing risk analysis you requested and to return the result to you.
• Account information is used only to enforce your scan allowance and unlock the subscription tier you purchased.
• Purchase status is used only to grant or revoke access to paid features.

We do not use any of this information for advertising, profiling, or any purpose beyond operating the App as described.

4. Third-Party Services

We do not use any other third-party data processors.

5. How We Share Information

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising or any commercial purpose.

We may disclose information in the following limited circumstances:

• Legal compliance: If required by applicable law, subpoena, court order, or other legal process, or if we reasonably believe disclosure is necessary to protect the rights, property, or safety of LinkWard, our users, or the public.
• Business transfer: If LinkWard is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information is subject to a materially different privacy policy.

6. Where Your Information Is Processed

LinkWard is operated in the United States. Content you submit for analysis is received by our backend infrastructure hosted on Amazon Web Services (AWS) in the US West (Oregon) region. From there:

• For URL submissions, a cryptographic hash prefix (not the raw URL) is sent to Google Safe Browsing (US-based) to check against known threat lists.
• If the URL is not flagged by Google Safe Browsing, the content is forwarded to Anthropic's API (US-based) for phishing analysis. Content matched by Google Safe Browsing is short-circuited and never reaches Anthropic.

Subscription and purchase data is managed by RevenueCat, Inc., a US-based company.

If you are located in the European Economic Area (EEA), the United Kingdom (UK), or another jurisdiction outside the United States, your information will be transferred to and processed in the United States. We rely on appropriate safeguards for such transfers as required by applicable law.

7. Data Retention

• Submitted content: not persistently stored; job records expire automatically (short TTL).
• Verdict cache: a hash of the submission (the cache lookup key) and its AI-generated verdict are retained for a short period, then expire automatically. Cache entries are not linked to any user account or device identifier.
• Account record (if you sign in): contains only the pseudonymous identifier, tier, and scan-count fields described above. A free account is deleted automatically about 30 days after your last sign-in. While you hold an active subscription or unused scan credits, your record is kept for as long as that access lasts; you can also delete it any time from Settings.
• Anonymous device record (if you don't sign in): the hashed device identifier and its scan count expire automatically about 30 days after your last scan.

8. Children's Privacy

LinkWard is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has submitted information through our app, contact us at the address below and we will take steps to delete it.

9. Security

Analysis requests are transmitted over HTTPS to our backend and to Anthropic's API. We do not store API keys on your device beyond the session token required to operate the App. Our backend enforces authentication, rate limiting, and per-user usage limits.

10. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate or incomplete information.
• Deletion: You can delete all personal data we hold about you directly in the app: Settings › Account › Delete account. This immediately and permanently erases your account record (pseudonymous identifier, subscription tier, and scan count) from our servers — no email or support request required. Analysis verdict cache entries are keyed by a hash of submitted content and are not linked to any user account; they are not personal data and expire automatically regardless of account status.
• Portability: Request a copy of your information in a portable, machine-readable format.
• Objection: Object to our processing of your personal information where we rely on legitimate interests.
• Withdraw Consent: Where we process your information based on consent, you may withdraw that consent at any time.

You may stop using LinkWard at any time. Uninstalling the App removes any locally stored data (such as your on-device scan-credit balance). Note that your subscription purchase history is retained by Apple and our payments processor (RevenueCat) as required for billing, tax, and legal purposes, independently of your LinkWard account.

EU/EEA/UK users: If you are located in the EU, EEA, or UK, you have the right to lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact us at the address below.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with additional rights regarding your personal information.

Categories of Personal Information We Collect

• Identifiers: pseudonymous user identifier (provided by Apple or Google), hashed device identifier.
• Usage data: scan count, subscription tier, and analysis verdicts (cached for a short period; entries are not linked to your account or device).

No Sale or Sharing

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. We have not sold or shared personal information about consumers we know are under 16 years of age.

Your California Rights

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you.
• Right to Access: You may request a copy of your personal information.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Data Portability: You may request your personal information in a portable, machine-readable format.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.

Shine the Light (Cal. Civ. Code § 1798.83)

California residents may request information about any disclosure of personal information to third parties for their direct marketing purposes during the preceding calendar year. We do not share personal information with third parties for direct marketing purposes.

To submit a request, contact us at the address below.

12. Do Not Track / Global Privacy Control

LinkWard does not track users for advertising or behavioral profiling. We honor Do Not Track (DNT) and Global Privacy Control (GPC) signals. Because we do not sell personal information or share it for cross-context behavioral advertising, these signals are effectively honored by the design of our App.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top. Continued use of LinkWard after changes are posted constitutes your acceptance of the revised policy.

14. Contact

If you have questions about this Privacy Policy, contact us at:

Email: linkward-support@wizacorn.com