Privacy Policy

1. Information we collect

• Story submissions: we collect the pseudonym, location, and story text you provide. We do not ask for or store your name during submission. An email is only stored if you choose to give one so we can tell you when your story is reviewed, and it is deleted straight after.
• Newsletter: if you explicitly sign up for our newsletter, we collect your email address via a double opt-in process to confirm your consent.
• Correspondence: if you email hello@shieldmate.io or use our contact form, we use your email address only to respond. We do not use these addresses for marketing.

2. How we handle stories

• Moderation: our team (moderators and experts) will see your raw submission. All team members are bound by confidentiality agreements with Spell Shield Pty Ltd.
• PII removal: we have a strict policy to remove names, specific addresses, and other identifying details before a story is published.
• Retention: we store the original version of submissions for a limited period to allow for moderation and verification of edits. After that, raw versions are deleted, and only the edited, de-identified version remains in our archive.
• Evidence files: if you attach a screenshot or document, you may optionally tick a box allowing us to keep it to test our scam-checking tools. That choice is entirely yours, it has no bearing on whether your story is published, and the box is never ticked for you. If you do not tick it, the file is used only for moderation and then deleted with the rest of the raw submission. Files kept under that consent are never published, never shared with anyone else, and have identifying details removed first.

3. The message checker

When you use our checker at /check, you paste or upload a message so that we can examine it. This is what happens to it.

• We do not store it. The message is held in memory only for as long as the check takes, then discarded. It is not written to our database, not saved to a file, and not recorded in our logs. If the check fails, we log that a failure occurred and nothing about its contents.
• There is no record to request or delete, because none is kept. This also means we cannot retrieve a result for you afterwards.
• Links are sent to Google Safe Browsing. To tell you whether a link is already known to be dangerous, we send that link to Google. This is governed by Google’s privacy policy. If you would rather not disclose a link, do not paste it.
• Domain registration is looked up publicly. We query public domain registry records to see how old a linked website is. Only the domain name is sent, never the full link or the message.
• What we count. We keep aggregate totals only: how many checks were run, which kind of input was used, and which kinds of concern were raised. These are counters with no identifier attached, no message content, and nothing that could single you out.
• Rate limiting. As with our other forms, we store a salted one-way hash of your IP address to enforce usage limits. The address itself is never stored.

Please do not paste more than you need to. If a message contains your account numbers or identity documents, remove them first. We cannot lose what we never received.

4. Technical data

• Hosting: our site is hosted on Vercel, which may log your IP address and browser metadata for security and performance.
• Bot protection: we use Vercel BotID to prevent spam and automated abuse. It is used only to tell humans from bots on our forms.
• Analytics: we use Vercel Web Analytics to understand aggregate traffic. It is fully cookieless, collects no personal identifiers (no IP addresses, no fingerprints), and does not track individuals across sessions, so no cookie consent is required. We exclude our story-submission page from analytics to further protect the privacy of people sharing their experiences. We do not use Google Analytics or any other tracking service.
• Database: our database (Supabase) is located in Australia.
• Voluntary support: if you choose to support us via our Partnership page, your payment information is collected and processed entirely by Stripe. We do not receive or store your payment details.

5. Data sharing

We do not sell or trade your data. We only disclose information if:

• Legal requirement: we are compelled by a court order or Australian law.
• Safety: a submission describes an immediate threat to life or a serious crime, in which case we may notify relevant authorities.

6. Your rights

Under the Australian Privacy Principles, you have rights regarding your data. However, because story submissions are not linked to accounts or emails, we generally cannot identify which story belongs to you.

• To unsubscribe from our newsletter, use the “Unsubscribe” link in any email.
• For redaction requests regarding published stories, contact us at hello@shieldmate.io.

7. International users

While we are based in South Australia, we aim to respect global privacy standards. By using this site, you acknowledge that your data is stored in Australia and governed by Australian law.

8. Contact us

Email: hello@shieldmate.io

Company: Spell Shield Pty Ltd