Privacy Policy

Bewary is a scam-intelligence API. We collect the minimum we need to answer your calls, run your account and bill you. We never sell your data, and we never hand one customer's data to another.

Who we are

Bewary is a product of Reply200 Inc. ("Bewary", "we", "us"). This policy covers the Bewary website (bewary.app) and its free tools, the Bewary API (api.bewary.app), the MCP server, the command-line tool, bulk files and watches. Write to privacy@bewary.app with any question.

What we collect, and why

Lookups

A lookup of a link, domain, IP address, phone number, short code, email address, wallet, IBAN, app or payment handle, from the API, the MCP server or a free checker on the website, is answered from our own data and from threat-intelligence, registry and telecom data services, and cached for up to a week so the next caller gets it at once. A lookup keeps no record of who asked. It can add the value itself to Bewary's data about it: a looked-up domain is queued for its web-archive history, and a looked-up app is recorded as seen on its store. A payment handle is checked by reading the service's public profile page for whether it exists and is active. Nothing else on that page, such as a name or photo, is kept or returned. The QR code checker reads the code in your browser: the photo is never uploaded, only the link in it is looked up.

Your account and keys

An account is the email address you sign in with. Sign-in is passwordless: we email you a one-time link. A key is shown once and stored only as a hash, so we cannot read it back. For each call with a key we log the time, the endpoint, the key, the credits charged and the result status, and your account page shows your recent calls. That log is kept for 13 months, so a year of usage can be checked against your bill.

The website's free checkers

The free checkers on this website call the API without a key. Their daily allowance is counted per IP address, against a hash of the address rather than the address itself. The count is deleted after two days, and the log of those calls after 30 days.

Watches, events and webhooks

A watch stores the domain, phone number, wallet or brand you asked us to watch and the event types you chose. Events are kept for 13 months, like the call log, so you can read them back. A webhook endpoint stores the address you gave and its signing secret. A finished delivery is kept for 30 days, and a watch or endpoint you delete is removed 30 days later.

Backtests

A list you upload for a backtest is kept only until its report is written, and the report for 7 days after it is ready.

Payment data

Credit packs and auto top-ups are paid through Stripe. Card numbers go directly to Stripe and are never seen or stored by us. We keep your Stripe customer reference, your purchase history and, if you save a card for auto top-up, its brand and last four digits so your account page can show which card will be charged.

Website analytics and security

On the website, Google Analytics measures usage with consent-aware settings. If you accept optional tracking, Meta and TikTok may also receive page and conversion events. You can accept or reject optional tracking when first asked and change that choice at any time through Analytics choices. Rejecting it does not limit anything. The free tools use a bot check, and your IP address is used for rate limiting and abuse prevention.

Your users' data

When your product sends us a link, number, address or account detail that came from one of your users, it passes through us. You must have the right to send it, and you should tell your users that a third-party service checks it. A lookup keeps nothing about who asked, and we never return one customer's lookups to another. If you need a data processing agreement, write to privacy@bewary.app.

Data Bewary collects about scams

What we sell is data about scam infrastructure: domains, links, IP addresses, phone numbers, short codes, wallets, IBANs, apps and payment handles, with the evidence behind each verdict. It comes from public registries and lists, government and industry scam lists, certificate logs, our own reads of suspect web pages (the words on a page are deleted after 90 days, the facts drawn from it stay as the site's history) and our own trap phone lines. Calls to those trap lines are answered and recorded for up to 30 seconds. The recording is transcribed by OpenAI's Whisper API and then deleted, from our phone provider too. The transcript is kept for up to 12 months, and the facts drawn from it, such as the callback number a pitch asks for, can go on our lists.

Who processes data for us

We share the minimum necessary data with a small set of providers, each only for its job. We name the ones that touch what you send us or what you pay and describe the rest by category:

• Speech to text: OpenAI's Whisper API transcribes recordings from our trap lines.
• Payments: Stripe, for credit packs and auto top-ups.
• Data services for lookups: threat-intelligence, registry, telecom and breach data services.
• Email delivery: sign-in links and the low-balance email you can turn on.
• Analytics: Google Analytics, and Meta and TikTok only if you accept optional tracking.
• Security and hosting: bot protection, telephony for our trap lines, and running the service on secured servers.

Every provider is bound to use the data only to perform its service for us, to protect it to the same or an equal standard as this policy, and never to sell it.

What we never do

• We never sell or rent your personal data, your account, your keys or what you and your users send us.
• We never return one customer's lookups, watches or calls to another.
• We never return a person's name for a phone number, an IBAN or a payment handle.
• We never put secret keys or vendor credentials in code that runs on your side. Every sensitive call runs on our servers.

How long we keep things

• Records of the message checks retired on October 30, 2026 (a hash, a redacted excerpt, the indicators found and the verdict, linked to no key, account or device): they are deleted after 90 days.
• Wallets and payment handles found in those checks that came out as a scam or suspicious: kept as scam indicators, with nothing about who sent or checked the message, and deleted 12 months after they were last seen.
• API call logs: 13 months, or 30 days for calls made without a key.
• Events: 13 months. Webhook deliveries: 30 days. Deleted watches and endpoints: 30 days after deletion.
• Backtest uploads: until the report is written. Reports: 7 days.
• Trap-line recordings: deleted once transcribed. Transcripts: 12 months.
• Your account: while it is active. You can delete it at any time from your account page or by emailing us, and we will remove your personal data except records we must keep, such as billing history for tax purposes.

Your rights

Wherever you live, you can ask us to show you the data we hold about you, correct it, delete it, or send you a copy. If you are in the EU or UK, you have these rights under the GDPR. If you are in California, you have them under the CCPA and CPRA, including the right to know and to delete. To exercise any right, email privacy@bewary.app and we will respond within the time the law allows.

Children

Bewary is a service for businesses and developers. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has used Bewary, contact us and we will delete the data.

International transfers

We and our providers may process data in countries other than yours, including the United States. Where required, we rely on recognized safeguards such as the Standard Contractual Clauses to protect your data in transit and at rest.

Security

We encrypt data in transit with TLS, store keys only as hashes, keep every secret on our servers, and limit access to the people who need it. Suspect web pages are read on a separate server that holds no customer data.

Changes to this policy

If we make a material change, we will update the date above and notify account holders by email. Continuing to use Bewary after a change means you accept the updated policy.

Contact

Questions, requests, or concerns: privacy@bewary.app. Reply200 Inc., the maker of Bewary.