YOUR MESSAGES. YOUR BUSINESS.

Privacy, in plain English.

Policy version: September 17, 2026

Message filtering happens on your iPhone. Reporting a message is a separate choice.

Who operates BaitBlock?

Scaler LLC operates BaitBlock. You can contact us through the support form.

When your phone filters a text

iOS supplies eligible unknown-sender messages to BaitBlock’s on-device filter. The message and available sender information are processed locally for classification. BaitBlock does not upload your inbox, contacts or automatically filtered messages. The filter does not handle iMessage.

Your preferences, report receipts and cosmetic reward progress are stored on your device. Removing the app normally removes this local app data; device backups may preserve it under your Apple settings.

Optional emails about our next apps

If you choose “Keep me posted,” Scaler LLC collects your email address to send occasional announcements about scam trends, new apps and product updates. This is optional: filtering remains free without an email. We store your address, signup source (app or website), consent wording version, signup date and confirmation date. We don’t connect your email to SMS reports or your inbox.

We send a confirmation email before activating announcements. Unconfirmed signups expire after seven days, with up to 24 hours for daily cleanup. Confirmed signup records stay until you unsubscribe. The app remembers locally that you submitted successfully, so it stops asking; that flag is not proof that your address is still subscribed.

Remove your email here, or open “Email preferences” in the app’s About screen. Enter your address and open the private removal link sent to that inbox. The link expires after 24 hours. Removal deletes your address and consent record from our active subscriber database; your filter and unlocked fish are unaffected. It does not remove separate support requests or SMS reports. For those, contact support. Provider delivery logs and backups follow their separate retention settings.

Resend processes recipient addresses and email content to deliver confirmation, removal and product emails. We do not sell our email list. Our own email templates contain no tracking pixels. We use your consent for product announcements; you can withdraw it anytime. We also retain temporary keyed email-address hashes for abuse prevention until their rate-limit window expires and daily cleanup runs.

When you choose to report

We receive the text you submit, an optional sender number, your chosen category and a random report receipt ID. We store a content hash to handle retries. Remove personal names, account numbers, passwords and verification codes before submitting. A submitted text may still contain personal information about you or someone else.

We use reports to review unwanted financing patterns, operate the reporting service, and prepare reviewed examples for improving future versions of the filter. Reports are not automatically made public, forwarded to a carrier, or incorporated into a model.

90 days for raw reports

Raw reports are retained for up to 90 days. A daily deletion job removes expired text, sender information and receipt records, so deletion may complete within 24 hours after that period. Requests to delete a report earlier can be made through support; include your receipt when possible.

Before a raw report expires, we may create a separately reviewed, de-identified training example. This is intended to preserve the financing pattern while removing names, contact details and other identifying information. Tokenization by itself does not anonymize a message. Examples that have not passed review are not retained as training data.

Reviewed de-identified examples may be retained while useful for filter development. Training changes model parameters; it is not an archive of submitted messages. Model training and releases require separate evaluation, and we do not guarantee that every report will be used. If an example cannot be linked back to you after de-identification, we may be unable to identify it for an individual deletion request. Applicable privacy rights still apply.

What appears on the Wall?

Only separately approved summaries, descriptive titles, masked or approved sender identifiers and report counts appear publicly. A report is not proof of fraud. Numbers can be spoofed. To flag inaccurate, inappropriate or identifying content, use Wall correction or removal.

Support and service protection

If you contact support, we store your email, topic and message for up to 90 days, with the same daily deletion window. We use this information to reply and resolve your request.

The service uses a keyed hash of your network address to rate-limit submissions. Temporary rate-limit counters expire after their short enforcement window and are removed by the daily job. Hashes associated with reports are removed with those reports. An abuse-blocked client hash may remain until the block is reviewed and lifted. We do not put message text in application logs.

Service providers and international processing

Our service providers include Neon for database storage and Vercel for website hosting, and Resend for email delivery. Database information is stored in the United States. These providers process the information needed to operate and secure the service. Access is limited to authorized operators and service providers. Hosting logs and backup copies follow the providers’ retention settings.

We do not sell reports, use them for advertising, or include advertising trackers in this site. We do not use analytics cookies or advertising identifiers. Network requests necessarily expose technical connection information to hosting providers.

Your choices and rights

You can use the on-device filter without submitting reports. You can disable filtering in iPhone Settings and change the financing preference in the app. Depending on your location, you may have rights to access, correct, delete or restrict use of your personal information, object to processing, withdraw applicable consent, and complain to a supervisory authority. Submitting a report does not waive these rights.

Use support to exercise a right. We may request proportionate information to find the record or verify a request, but never your password or bank details.

Changes to this policy

We will update the date when this policy changes and provide additional notice or obtain consent where required for material changes to how reports are used.