MailShield Guardian — Privacy Policy
MailShield Guardian is built by Glippin Toys, LLC. We respect your privacy. This policy covers the App's core scanning features and its community social features (Scam Radar, Community Feed, Confession Booth, comments, reactions, and badges).
Summary
- No MailShield account or password needed to use the app. MailShield signs you in anonymously.
- Suspicious content you submit (photos of mail, pasted texts, emails, phone numbers) is processed for AI analysis. A short, encrypted excerpt (not the full content) is saved to your private scan history until you delete your account.
- Scam fingerprints — the links, phone numbers and sender names found in high-risk or suspicious scans — are saved, unencrypted, to a shared scam-pattern list that other signed-in MailShield users’ apps can read, so they can be warned about the same threat. They are kept indefinitely and are not removed when you delete your account.
- Auto-Protect is optional. If you connect a mailbox, MailShield checks it for new mail from your phone and sends each message’s sender, subject and as much of the message text as the app can read to our servers and to our AI provider to check it for fraud. It flags messages it rates as threats; it deletes mail only if you turn on Auto-Delete. See Connecting a mailbox.
- Community features are optional and anonymous. Posts, comments, and reactions are never shown with your name or email.
- Pro and Family plans include a 7-day free trial for eligible new subscribers — see Billing below.
- No advertising. No third-party ad trackers.
What we collect
| Data | Why | Retention |
|---|---|---|
| Anonymous user ID (a random ID assigned at first launch, not linked to your name; if you connect a mailbox for Auto-Protect, that mailbox address is stored with it) | Tie scans, premium status, family to one identifier | Until account deleted |
| Scan result (verdict + summary) | Your scan history | Until you delete your account |
| Encrypted excerpt of scanned content (up to ~500 characters, AES-256 field-level encryption) | Let you review the original text behind a past scan result | Until you delete your account |
| Mailbox address (Auto-Protect only) | Connect scans and flags to the mailbox you chose; stored with your anonymous ID | Until you delete your account |
| Trusted contacts (senders you mark as trusted) | So they are not flagged in later scans; saved to your account on our servers | Server copy kept until you remove the contact (Settings → Trusted Contacts) or delete your account |
| Scam fingerprint (links, phone numbers and sender names found in high-risk or suspicious scans, saved unencrypted) | Shared scam-pattern list that other signed-in MailShield users’ apps can read | Indefinitely; not removed when you delete your account |
| ZIP code (community features only) | Local threat display, Weekly Area Digest — not a precise address or GPS location | Until you delete or leave community features |
| Community report / Confession Booth post text | Community Feed (BlockBrief) and Confession Booth | Until removed by moderation or account deletion |
| Comments and reactions | Community discussion on reports | Until you delete them or your account |
| Gamification stats and badges | Fraud Resilience Score, Community Defender Badges | Until account deleted |
| Phone number you look up (Pro "Who's Calling") | Sent to our caller-ID provider (Twilio) for name/line-type lookup | Cached 90 days, shared across users, not tied to your account |
| Push token (optional) | Send local scam alerts and community notifications you opt into | Until you uninstall |
| Crash reports | Diagnose bugs | 90 days |
Retention. A short, encrypted excerpt of each scan (including text read from a mail photo) is kept in your private scan history, alongside scan metadata (risk level, category, timestamp). We do not delete these on a schedule; they are kept until you delete your account in Settings → Delete Account. Links, phone numbers and sender names saved to the shared scam-pattern list are kept indefinitely and are not removed when you delete your account. Mailbox passwords and sign-in tokens stay on your device until you remove the account in Auto-Protect. Trusted contacts can be deleted at any time from Settings → Trusted Contacts. You may request deletion of any server-side data by contacting us.
What we never collect
- Names, phone numbers (yours), mailing addresses
- Precise GPS or device location (community features use a user-entered ZIP code only)
- Audio or microphone data. The Voicemail Scanner works from a voicemail transcript you paste, or a screenshot you upload; MailShield does not record audio or access your microphone.
- Anything from advertising or tracking SDKs
Connecting a mailbox (Auto-Protect, optional)
Auto-Protect works only on a mailbox you connect: Gmail, Outlook, or another IMAP account such as Yahoo, iCloud or AOL. Everything in this section applies only if you connect one.
- Email content. MailShield checks the mailbox for new mail from your phone and sends each new message’s sender, subject and as much of the message text as the app can read (long messages are cut off) to our servers and to our AI provider (Anthropic) to check it for fraud. The first 300 characters of each scanned message, which include the sender and subject, are saved to your scan history, encrypted with a key held on our servers. Authorized Glippin staff may decrypt excerpts to check and improve detection accuracy. Full message bodies are not kept on our servers.
- Mailbox sign-in details. The app password you enter for Yahoo, iCloud, AOL or another IMAP account, and the Microsoft sign-in token for Outlook, are stored only on your device, in the iOS Keychain (on Android, encrypted storage), and are set not to sync to other devices. In the current versions of MailShield, a cached Google access token for Gmail is stored on your device the same way. Removing a Gmail or IMAP account in Auto-Protect deletes its saved password or token from your device. Deleting your MailShield account does not remove mailbox sign-ins from your device, so remove each mailbox in Auto-Protect first. The address of each mailbox you connect is stored on our servers with your anonymous ID.
- Actions in your mailbox. MailShield flags messages it rates as threats. It deletes messages only if you turn on Auto-Delete, which is off until you turn it on. Because scan results can be wrong, Auto-Delete may remove a legitimate message. What a deletion does depends on the provider: see the entries for Google, other email providers and Microsoft below.
Community features
Scam Radar, the Community Feed (BlockBrief), and Confession Booth let you see and share scam activity in your area. Posts, comments, and reactions are always anonymous — displayed with no name, email, or account identifier, only an internal ID never shown publicly. All community content passes automated profanity filtering and PII redaction; reports that draw 3 or more user flags are marked for internal review, and 5 or more hides the report from the public feed pending manual review.
Billing and free trial
Pro and Family subscriptions include a 7-day free trial for eligible new subscribers. Your payment method is not charged during the trial; it is billed automatically for the plan price shown at signup when the trial ends, unless you cancel before then. Manage or cancel anytime in your App Store or Google Play account settings.
The fingerprint engine collective
The asset that makes MailShield smarter than a single AI scan is the proprietary scam fingerprint database that every user contributes to. When you scan a suspicious item, MailShield extracts a fingerprint — the scam signature (phone number, sender pattern, URL, claim DNA) — and adds it to the shared collective. Future users who encounter that fingerprint get a faster, more confident verdict.
AI models in MailShield learn from the aggregated fingerprint collective, not from your individual scans. The verdict you see is the collective intelligence of every prior contributor.
Fingerprints are not encrypted. When a scan is rated high-risk or suspicious, the links, phone numbers and sender names found in it are saved, unencrypted, to a shared scam-pattern list that other signed-in MailShield users’ apps can read, so they can be warned about the same threat.
When you delete your account, your scan history is removed. Past fingerprints contributed to the collective remain in the shared dataset, including the links, phone numbers and sender names saved with them.
Third parties
- Firebase — backend, authentication, community data storage
- Google Cloud Vision — OCR for mail photos (in-flight only)
- Google Vertex AI — receives the scan type and the first 400 characters of the scanned text and, for scans rated high-risk and scans you mark as a false alarm, a short summary written by our analysis (the scan type, category, risk level, the organization it appears to imitate, and up to five reasons), to generate numeric “embeddings” that power similar-threat matching. That summary is also stored, unencrypted and with your anonymous ID, in a database the app cannot read, and may be shown to our AI provider as an example when other users' scans are analyzed.
- Anthropic (Claude) — scam analysis, including the text of new messages from a mailbox you connect for Auto-Protect (paid API, no training on customer data)
- Google (Gmail) — used only if you connect a Gmail account for Auto-Protect. In the current versions of MailShield, Gmail connects with Google sign-in: MailShield asks Google for permission to read and modify your Gmail (Google’s gmail.modify permission), reads new messages to scan them, adds a “MailShield-Flagged” label to threats, and moves a message to Trash only if you turn on Auto-Delete. You can remove that access by disconnecting Gmail in Auto-Protect, or at myaccount.google.com/permissions. In a coming update, Gmail will instead connect over IMAP (imap.gmail.com) with a Google app password you create, which needs 2-Step Verification on your Google Account: MailShield will sign in with that app password, read new messages to scan them, flag threats, and delete mail only if you turn on Auto-Delete. If you connected Gmail with Google sign-in, that update removes the saved Google sign-in from your phone and asks you to reconnect with an app password. Google’s privacy policy
- Other email providers (Yahoo, iCloud, AOL or another IMAP service) — used only if you connect that account for Auto-Protect. MailShield signs in with an app password you create, reads incoming messages to scan them, flags threats, and deletes mail only if you turn on Auto-Delete; deleted mail is removed from the server permanently. Your provider’s own privacy policy applies.
- Microsoft (Outlook, Microsoft Graph) — used only if you connect an Outlook account for Auto-Protect. MailShield reads incoming messages through Microsoft Graph to scan them, flags threats, and moves mail to Deleted Items only if you turn on Auto-Delete. Microsoft’s privacy policy
- Firebase Crashlytics (Google) — crash reports and diagnostic data used to fix bugs. Firebase privacy
- Link and domain checks — to check links found in a scan, our servers may request the linked page (headers only) and look up the domain’s registration at rdap.org.
- Twilio — caller-name lookup for the Pro "Who's Calling" feature (only when you use it)
- RevenueCat — subscription processing
Your rights
- Delete account: Settings → Delete Account (includes community posts, comments, reactions, and gamification data). It does not remove mailbox sign-ins stored on your device, so remove each mailbox in Auto-Protect first.
- Stop mailbox access: remove the account in Auto-Protect. For Gmail connected with Google sign-in, you can also remove MailShield’s access at myaccount.google.com/permissions. For an app password (Yahoo, iCloud, AOL, other IMAP, and Gmail once that update ships), delete the app password at your mail provider (for Gmail: myaccount.google.com/apppasswords). For Outlook, you can revoke access from your Microsoft account security settings.
- Request your data: email support@glippintoys.com. Because we do not ask for your name, requests must include your anonymous user ID, which can be found in the app settings.
- California residents (CCPA) and EEA residents (GDPR) have the right to know, correct, delete, and object to processing of their data; we do not sell personal information. Contact us to exercise these rights.
Children
MailShield Guardian is not designed for or marketed to children under 13, and community features are not available to users under 13.