Privacy Policy

    Effective Date: September 28, 2026

    Darwin Labs Inc. ("Darwin Labs," "we," "us," or "our") operates the website darwinsecurity.ai, the Darwin mobile apps for iOS and Android, and related services (collectively, the "Services"). This Privacy Policy explains what information we collect, why we collect it, who we share it with, and the choices you have.

    Darwin protects you by looking at communications you choose to show it. That means we handle sensitive information, and we try to collect only what a feature needs. We do not sell your personal information. We never share the messages, calls, emails, or contacts Darwin checks with advertisers.

    By using our Services, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use our Services.

    1. Information We Collect and Why

    1.1 Information You Provide

    • Account details, such as your name, email address, phone number, and profile picture. If you sign in with Apple or Google, we receive the account identifier and basic profile details that provider shares with us. We use this to create and secure your account and to contact you about the Services.
    • Family details, such as the members of your Darwin family and their role (guardian or protected member). We use this to share alerts within your family and to manage your subscription.
    • Things you ask us to check, such as links, images, audio, files, screenshots, and messages you submit to the Ask Darwin chat or to the link checker and AI-content checker on our website. This can include sender details such as phone numbers and email addresses, and payment requests or transaction details. We use this to analyze the content, give you an answer, and keep your chat history. Do not submit full payment-card numbers.
    • Support messages and feedback you send us. We use this to help you and improve the Services.
    • Testimonials, meaning the comment and first name you give us when you tell us that a check helped. If you allow us to share it, we may show your comment and first name on our website, in app stores, and in our ads. You can ask us to stop using it at any time by contacting us.

    1.2 Information From Protection Features You Turn On

    Several Darwin features work only if you give the app access to your communications. Each one is optional, and you can turn it off at any time. When a feature is on, we collect the following and use it to detect scams, alert you, and let you review what was flagged:

    • Text message protection. If you enable SMS filtering, incoming messages from senders who are not in your contacts are sent to our servers and analyzed for scams. On Android, the message is linked to your account, and we keep the message, the verdict, and the alert so that flagged messages can be reviewed. On iPhone, Apple sends us the message without telling us who received it, so it is not linked to you or your account. We only tell your phone whether to move it to junk, and we do not keep the message or create an alert.
    • Email protection. If you connect a Gmail account, we access your mailbox through Google's API and process and store the emails we analyze so that we can detect scams and show you alerts. See "Google User Data" below.
    • Social media protection. If you connect an Instagram or TikTok account, you sign in to that account inside the app and authorize Darwin to access it. We use that access to read your direct messages and analyze them for scams, and we keep the messages we analyze, the verdict, and the alert.
    • Call Guard. If you turn on Call Guard, calls you forward to your Darwin number are handled by an automated AI assistant, which screens callers who are not in your contacts. For each call we collect the caller's phone number, call details, an audio recording of the call, a transcript, and an AI-generated summary and risk assessment. Recording and transcription continue after the call is connected to you, so the recording can include your own voice and the voice of the caller. We also store your phone number and mobile carrier.
    • Contacts. If you grant contacts access, we upload the names and phone numbers in your address book so that people you know are not screened or flagged. You can also mark callers and senders as safe or blocked.
    • Ask Darwin. Messages, images, links, and files you send to the Ask Darwin chat are stored so that we can analyze them and keep your conversation history.
    • Device information. We collect device details and push notification tokens so that we can deliver alerts and incoming call notifications.

    Communications involve other people. Calls, texts, emails, direct messages, and contacts that you expose to Darwin include personal information about the people who contact you. You are responsible for having the right to share that information with us.

    1.3 Google User Data

    If you connect a Google account, Darwin's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Gmail data only to provide the scam-detection and alerting features you see in the app. We do not use it for advertising, we do not sell it, we do not use it to train generalized AI models, and we do not let people read it except with your consent, for security purposes, to comply with law, or where the data has been aggregated and anonymized. You can disconnect Gmail at any time in the app or in your Google account settings.

    1.4 Rescue Case Data

    If you use Darwin Rescue, we collect the information you provide about your loss. This may include your description of what happened, communications with suspected scammers, transaction records, details about the accounts involved in your dispute (such as institution name, the last four digits of an account or card, and transaction amounts and dates), and supporting documents you upload. Do not submit full payment-card numbers as case evidence; payment for the Rescue fee is collected separately through our payment processor.

    1.5 Payment Information

    Subscriptions bought in the mobile apps are processed by Apple or Google through your App Store or Google Play account. Subscriptions bought on the web and Rescue fees are processed by Stripe. Your full card number goes to the processor, not to us; we receive confirmation of payment, your subscription status, and limited billing details.

    1.6 Information Collected Automatically

    • Device and log data, such as IP address, approximate location derived from IP, device type, operating system, app version, and timestamps. We use this to run and secure the Services and to detect abuse.
    • Usage data, such as features used and actions taken. We use this to understand and improve the Services.
    • Analytics and diagnostics. We use Google Analytics (Google LLC) and similar tools to measure how people use the Services and which of our own ads lead to signups, and monitoring tools to collect crash reports and performance data. See Google's Privacy Policy.
    • Advertising measurement. We use tools from advertising partners such as Meta and Google to measure how well our own ads perform. These tools receive limited information about your device and app activity. They never receive the content Darwin checks.

    2. Other Ways We Use Information

    In addition to the uses described above, we use the information we collect to:

    • Provide, maintain, secure, and improve the Services.
    • Send service messages, including security notices and policy changes.
    • Build and maintain lists and patterns of known scam links, phone numbers, senders, and schemes that help protect all Darwin users, including in aggregated or anonymized form.
    • Comply with law and protect the rights and safety of Darwin Labs, our users, and others.

    Darwin is a paid service, and subscription and Rescue fees are how we make money.

    3. Automated Analysis and AI

    Darwin uses automated systems, including artificial intelligence, to analyze the content described above, to power the Ask Darwin chat, and to run the Call Guard voice assistant. Some of this is done by third-party AI providers, such as OpenAI, acting as our service providers. The content being analyzed is sent to them for that purpose.

    We do not use your submitted data to train, fine-tune, or otherwise improve our AI or machine-learning models. Our models apply existing detection logic to your submissions to generate alerts at the time you submit them; your submissions are not added to a training corpus.

    No automated system is perfect. Alerts and analyses produced by the Services are informational and are not guarantees that a communication, link, counterparty, or transaction is safe or unsafe. False positives and false negatives can and do occur. You should always exercise your own judgment before sending money, sharing information, clicking links, or otherwise acting on a message or transaction.

    Our Terms of Service describe the limits of the Service in more detail.

    4. Family Sharing

    Darwin is built for families. If you join a Darwin family as a protected member, the guardians of that family can see the alerts Darwin raises for you, including the content of the flagged message, email, or call, and for flagged calls the recording, transcript, and summary. Guardians cannot see communications that Darwin did not flag. Guardians' own alerts are not shared with other guardians. The family owner manages billing and membership. You can leave a family at any time.

    5. How We Share Your Information

    We do not sell your personal information. We share it only as follows:

    • Service Providers: We share information with trusted third-party vendors who help us operate our Services, such as cloud hosting, AI analysis, telephony and messaging (Twilio), push notifications, sign-in, payments, email delivery, link analysis, analytics, and diagnostics. These providers are contractually required to protect your data.
    • Advertising Partners: We share limited device and app activity information with advertising partners such as Meta and Google to measure our own ads.
    • Your Family: If you are a protected member of a Darwin family, your alerts and the flagged content behind them are shared with the guardians of that family, as described in Section 4.
    • Callers: When Call Guard connects a call to you, or takes a message, the caller hears the AI assistant, which may tell them that you use a screening service and that the call may be recorded.
    • At Your Direction (Darwin Rescue): If you open a Rescue case, we share your case information with the parties needed to pursue your recovery — for example, your bank or credit union, the relevant card network, payment processors, and government agencies such as the CFPB or FTC. We share only what is needed to advance your case, and only in connection with the case you opened.
    • Public Scam Reports: We may publish the domain names of websites that Darwin found to be scams, along with how often they were checked and the warning signs we found. We never publish the full link you checked or anything that identifies you.
    • Threat Intelligence: We may share threat indicators with law enforcement, financial institutions, industry partners, and threat-intelligence networks to help protect the broader community. These indicators fall into two categories: (1) anonymized or aggregated patterns, such as scam URLs, malicious-domain reputation data, and recurring fraud patterns that do not identify any individual; and (2) scam-attribution identifiers tied to suspected bad actors — such as phone numbers, email addresses, and wallet addresses associated with reported fraud — which may be shared in identifiable form only when necessary to disrupt the threat or as legally required. We do not share personally identifiable information about Darwin users themselves through this channel without your consent or a legal requirement.
    • Legal Requirements: We may disclose information if required by law, court order, or governmental authority, or to protect the rights, property, or safety of Darwin Labs, our users, or others.
    • Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.
    • With Your Consent: We may share information in other ways if you have given us explicit consent.

    We do not share, sell, rent, or otherwise disclose your mobile phone number or SMS opt-in data to any third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties.

    6. SMS/Text Messaging

    We use SMS to deliver one-time passcodes, to let you access Darwin Security services by texting one of our registered program numbers, and to send notifications related to actions you initiate (including service messages). You can opt in by submitting your phone number through our verification flow on darwinsecurity.ai and affirmatively checking the SMS consent box at the time of submission, or by texting one of our registered program numbers. You can opt out at any time by replying STOP to any message; reply HELP or email support@darwinsecurity.ai for help. Message frequency varies based on your activity, and message and data rates may apply. We do not share mobile numbers or opt-in data with third parties or affiliates for marketing purposes. See our Terms of Service for the full SMS program terms.

    7. Data Retention

    We retain your personal information for as long as necessary to provide our Services and fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law. When your data is no longer needed, we securely delete or anonymize it.

    Account data — such as your name, email address, and login records — is retained for the life of your account. When you delete your account or ask us to delete your data, we delete or anonymize it within 30 days, except for the limited records we need for billing, disputes, and legal obligations, which we keep for up to 24 months, and the security and threat-detection data and Rescue case files described below.

    Security and threat-detection data — including flagged URLs, reported scam indicators, malicious sender identifiers, and patterns derived from analyses — may be retained for a longer period than account data because it serves an ongoing protective function for all users. Where this data has been aggregated or anonymized so that it no longer identifies you, we may retain it indefinitely as part of our threat-intelligence corpus. Identifiable submissions are retained only for as long as needed to investigate the relevant threat, update our threat-intelligence databases, and protect other users, after which the data is anonymized or deleted. In most cases, identifiable submissions are anonymized or deleted within 36 months of collection. Retention periods are reviewed annually.

    Call Guard recordings, transcripts, and summaries, analyzed text and social media messages, connected email, Ask Darwin conversations, and contacts are retained while your account is active so that you can review them in the app. Turning a feature off or disconnecting an account stops new collection but does not delete what was already collected. When you delete your account, this data is removed from your account and from our database. Copies of stored files, such as call recordings and images you uploaded, can remain in our file storage and backups after that. Contact us if you want those copies removed.

    Is This AI submissions, meaning the links, text, and images you send to Is This AI on our website, are kept with Darwin's result as security and threat-detection data, even if you do not have an account.

    Rescue case files are retained for the duration of your case and for 24 months afterward to support follow-ups, appeals, disputes, and legal obligations, after which they are deleted or anonymized.

    Retention periods are determined by the sensitivity of the data, the purposes for which it was collected, applicable legal and regulatory obligations, and the protective value of the data to other users.

    8. Data Security

    We implement industry-standard technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS) and at rest, access controls, and regular security reviews.

    Despite our efforts, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

    While we implement strong security measures for our own systems, the scam-detection and alerting service itself is provided on an as-is basis and we cannot guarantee detection or prevention of every threat. Please review our Terms of Service — including Sections 3 and 10 — for the full disclaimers that apply to the Service.

    9. Your Choices and Rights

    Your choices. You can turn any protection feature off in the app, disconnect Gmail, Instagram, or TikTok in the app (and Gmail also in your Google account settings), revoke contacts, notification, or other permissions in your device settings, and leave a family at any time.

    You can limit ad tracking in your device settings.

    Depending on your location, you may have certain rights with respect to your personal information, including:

    • Right of Access: Request a copy of the personal information we hold about you.
    • Right to Rectification: Request correction of inaccurate or incomplete information.
    • Right to Erasure (GDPR) / Right to Delete (CCPA): Request deletion of your personal information, subject to certain exceptions.
    • Right to Restriction: Request that we limit the processing of your information in certain circumstances.
    • Right to Data Portability: Request a copy of your data in a machine-readable format.
    • Right to Object: Object to our processing of your information in certain circumstances.

    How to Submit a Data Deletion Request

    You can delete your account at any time in the app under Settings. If you are the owner of a family with other members, you will be asked to choose a new owner first. Deleting your account does not cancel a subscription bought through Apple or Google; cancel it in your App Store or Google Play account.

    You can also request deletion of your personal data by contacting us at support@darwinsecurity.ai with the subject line "Data Deletion Request".

    Please include your full name, email address associated with your account, and a description of the data you wish to have deleted.

    We will acknowledge your request within 5 business days and complete the deletion within 30 days. The same exceptions described in Section 7 (Data Retention) apply: limited billing, dispute, and legal records kept for up to 24 months, identifiable security or threat-detection data, and Rescue case files. We will confirm deletion in writing once completed, and will note any data retained under these exceptions.

    10. Cookies and Tracking Technologies

    We use cookies and similar technologies to maintain your session, understand how you use our Services, and improve your experience. You can control cookies through your browser settings; however, disabling certain cookies may affect the functionality of our Services.

    Do Not Track. Some web browsers transmit a "Do Not Track" (DNT) signal. There is currently no uniform industry standard for recognizing or honoring DNT signals, and the Services do not currently respond to them. You can control tracking preferences through your browser's cookie settings as described above.

    11. International Data Transfers

    Your data is stored in the United States. If you use the Services from outside the United States, your information will be transferred to and stored in the United States, where data protection laws may differ from those in your jurisdiction. By using the Services, you consent to this transfer.

    12. Children's Privacy

    Accounts are created by adults. A teen who is at least 13 years old may be added to a Darwin family as a protected member by their parent or legal guardian, who consents to our collecting and using the teen's information as described in this policy. A teen's alerts, and the flagged messages, emails, or calls behind them, are shared with the guardians of their family. A parent or legal guardian can ask us to review or delete a teen's information at any time by contacting us.

    The Services are not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has used the Services, please contact us and we will promptly delete their information.

    13. Third-Party Links

    Our Services may contain links to third-party websites or services. We are not responsible for their privacy practices, and we encourage you to review their privacy policies.

    14. Changes to This Privacy Policy

    We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" at the top of this page and, for material changes, notify you by email or through the Services.

    15. Contact Us

    If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

    Darwin Labs Inc.
    San Francisco, California
    Email: support@darwinsecurity.ai