Privacy Policy

The service is run by OWLY SECURITY LTD, company number 517425484 (formerly שומר). We are responsible for the information collected through it.

We collect only what we need to detect scams and alert the family:

• Account details: name, phone number, language, form of address (male or female, as you chose), and email if you gave it at sign-up or signed up with Google.
• A password, if you set one in the Android app or in your personal area. It is stored only as a one-way hash, which can't be turned back into the password.
• The contacts you chose: name, phone number and relationship, up to three.
• What you send Owly to check: forwarded messages, screenshots, voice notes and call recordings, and their transcripts.
• If you connected a Gmail inbox: Owly reads new mail to check it for scams. Mail that looks safe is not stored. Suspicious mail is kept as evidence.
• A family code word, if you set one. It is stored encrypted and is never sent to anyone.
• Answers to the short setup questionnaire, to tune the level of protection.
• A phone call, only if you chose to add Owly's phone line to it (see the next section).
• Technical information from the Android app, as described in the next section.

The app is called Owly Security on Google Play and shows as "Owly" on the phone. It watches for a few moments on the phone that scammers exploit, and reports them to Owly. It does nothing until you accept the disclosure screen it opens with, and while it runs a persistent "Owly is on" notification is shown. What is sent to Owly:

• The number of an incoming call you answered from a number not saved in your contacts, including WhatsApp calls, and how long it lasts.
• That an SMS with a code arrived, and from whom (for example your bank). Only the sender, never the code or the message text.
• That a remote-access app was installed, or that a banking, payment or remote-access app was opened during such a call.
• Calls with saved contacts send nothing. The app never blocks a call.
• Checking a call, only if you choose it: during a call from a number that isn't saved, the app can offer to add Owly's phone line to the call. Only if you dial the line and tap Merge does Owly hear the call, what both sides say, for up to 5 minutes. A telephony provider carries the sound, and it is turned into text as the call goes on, to look for known scam scripts. We don't store the sound. If nothing is found, nothing is kept. If a scam script is found, you and your contacts are alerted and the text up to that moment is kept as evidence. The line says nothing in the call. WhatsApp calls can't be checked this way.
• The permissions the app asks for (call screening, call state, contacts, notification access and usage access) are used only for these purposes. Contacts are checked on the phone only, to tell whether a number is saved, and the list is never sent. If you pick someone from it as a trusted contact, only that person's name and number are sent.
• Which permissions are on and the protection level, so Owly knows what it can see. Nothing about what you do on the phone.
• You can stop at any time on the app's screen ("Stop and withdraw consent"): nothing more is sent, and anything waiting to be sent is deleted. To also disconnect the device from your account or delete what was already sent, contact us.

• The content of SMS messages, the code itself, your contact list or your location. We hear a phone call only if you added Owly's line to it, as described above, and we don't store its sound.
• Any information about health, memory or cognition. We also don't analyse how you speak or write, only what was said or written.
• The password of the sign-up site, if you chose one there. It stays with the site and never reaches us.
• WhatsApp messages you didn't send to Owly. We only see what is sent to us.

• To detect scams and explain to you what we found.
• To alert the contacts you chose when something looks like a scam, and to send them a weekly summary.
• To produce, at your request, a PDF report of an incident, for example to give to your bank or the police.
• To improve Owly's own detection.
• What you send to be checked (a message, an image or a recording, including any details in it) is also kept to teach Owly to spot scams. The screen where you joined, in WhatsApp or on the website, says so. Your protection works the same without it: you can cancel at any time by writing "stop learning" to Owly, and what was kept for it is deleted. It is also deleted with your account. From a check of a number that called you, only what was said and the kind of line are kept, never the number. Gmail messages and calls on the line you can add to a call are not included.
• On the website's check page, even without signing up: what you send to be checked (a message, an image or a recording) is also kept to teach Owly to spot scams. The page points to this policy, and it offers no other choice. Phone numbers, emails, ID and card numbers are removed from the text automatically, but other details, and everything in an image or a recording, stay. We delete the content after a year. You can't ask us to delete a particular check, because we wouldn't know who sent it. Images and recordings also pass through our website's provider.
• Information is used only for what is listed here: to protect you and to improve Owly. For nothing else.

The contacts you chose, only after you approved each of them: they receive alerts with the reason and the details needed to act on them. They don't receive your messages, emails or calls, or your questionnaire answers.

Service providers working for us, only to run the service:

• Meta (WhatsApp Business): sending and receiving messages.
• Microsoft Azure: servers, storage and voice processing. The servers are in the United States.
• Google (Firebase Cloud Messaging): wakes a contact's app when there is an alert. Only an identifier of the phone and of the alert passes through it, not what happened.
• An AI model provider, through Microsoft Azure: analysing the content sent for checking. The model has no access to anything other than the content being checked.
• Google: the Gmail connection (if you chose it), checking suspicious links, and reading Owly's messages aloud.
• A phone-number reputation service: checking numbers that aren't the family's.
• A telephony provider: running the phone line you can add to a call and carrying that call's sound, if you chose to check a call.
• Website and SMS providers: running the sign-up site and sending the SMS code that verifies your phone number.
• We disclose information to authorities only when the law requires it.

If you connect Gmail, Owly gets read-only access (gmail.readonly). It doesn't send, delete or change mail, and doesn't read sent mail or drafts.

If you sign in to Owly with Google, Owly gets only your account ID and email address from Google (openid, email), and no access to your mail. When you sign up with Google, Owly also gets your name (profile), only to fill in the name fields of the signup form. Only a keyed hash (HMAC) of the ID is kept, to recognize you the next time you sign in. You can disconnect it on the "Sign-in password" page or write "remove password" to Owly.

Owly's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. It is used only to check for scams and alert the family; it is not used for advertising, not sold, and not used to train general-purpose AI models.

You can disconnect at any time: write "disconnect email" to Owly. Access is revoked at Google, and whatever wasn't kept as evidence is deleted.

• WhatsApp messages as received: 90 days.
• Details of a sign-up that wasn't completed: 7 days. Records of SMS phone verification: 2 days.
• Alerts, evidence and reports: while the account is active, so an incident can be revisited. They are deleted when the account is deleted. Evidence is locked against changes for 31 days from when it was stored, and deleted when the lock ends.
• Backups: 7 days. System logs: 30 days.

Under Israel's Privacy Protection Law, you can ask to see, correct or delete your information.

• Deleting your account: send a request by email or to Owly on WhatsApp. We will delete the account and all information linked to it within 30 days, including disconnecting Gmail. A technical record of evidence fingerprints, with no identifying details, remains.
• Deleting data from the Android app (Owly Security on Google Play): tap "Stop and withdraw consent" on the app's screen. Nothing more is sent, and anything waiting to be sent is deleted from the phone. To also delete what was already sent, or the whole account, send a request as described above.
• Removing a contact: write "remove" and the contact's name to Owly.
• Withdrawing consent: disconnect email, stop learning, and stop the Android app, at any time.

All communication is encrypted (HTTPS). Phone numbers, emails, Gmail access and the code word are stored encrypted or as one-way hashes. Passwords are stored as hashes only. Access to information is limited to the team that runs the service.

The service is for people aged 18 and over.

If we change this policy materially, we will let you know on WhatsApp before the change takes effect. The date above shows the latest update.