Protection without surveillance.
NoScam2u is an anti-scam safety product for Malaysia. This policy describes the Android beta, protected test number, website and support services.
What we process
- If a live call beta is enabled, Twilio routes call audio and provides ConversationRelay. The gateway receives caller number, call state and transcript turns so it can screen the call. Provider configuration must be reviewed before any change.
- The gateway keeps live transcript text and risk evidence in process memory and does not write call recordings or transcripts to Firestore. Firestore stores limited call-control metadata (call reference, account UID, masked caller number, language, status and expiry) so the call can be controlled across service restarts. Firebase Cloud Messaging registration tokens are stored for the signed-in account until removed.
- The Android app uses Firebase Authentication and Firebase Cloud Messaging only in builds configured for a test project. Test account details are held by Firebase.
- Risk signals, the action you chose and technical error information may be processed while providing the service.
- Website beta interest details are sent to the configured signup service only when that integration is enabled.
What we do not do
- NoScam2u does not create or store a call-audio recording in the current gateway.
- We do not sell phone numbers, transcripts or family information.
- The AI is instructed not to request or repeat OTPs, passwords, identity numbers or banking details. Callers may still say sensitive information; do not disclose it.
- We do not claim affiliation with NSRC, PDRM, banks or telecom operators.
Retention and provider processing
Live transcript text and risk evidence are held only in gateway memory and expire 30 minutes after a session starts; while the service is running, cleanup runs about once a minute. Firestore call metadata also has a 30-minute expiry and is actively purged by the gateway, with Firestore TTL as a backup; Firestore TTL deletion is asynchronous and typically completes within 24 hours after expiry, but that timing is not guaranteed. FCM registration tokens are removed when a sign-out request reaches the gateway, the account is deleted, or the provider reports the token invalid; if the device cannot reach the gateway, the token may remain until account deletion or provider invalidation. This describes NoScam2u’s gateway only. For a configured live call, Twilio routes the audio and ConversationRelay sends caller speech for recognition and AI speech for synthesis through the configured speech provider. The gateway sends only language and locally detected risk-category labels—not raw caller transcript text—to OpenAI for reply generation. Each provider’s separate logs and retention controls apply. We have not enabled a production call integration or verified provider-side deletion settings; the current app build simulates calls.
Risk summaries are stored on your phone until you clear them. Website signup details, if the signup integration is enabled, are processed by the configured recipient.
Your choices
In a configured live beta, you can decline AI screening or end a call. You can remove locally saved results and delete a Firebase test account from Settings after signing in and re-entering your password. The current app build does not provide a live call service. AI output is an aid, not proof that a caller is safe or fraudulent.
Website beta and partnership registration
If you submit our interest form and consent, we store your name, email address, chosen interest, contact language, submission time and consent version in our private Supabase database. Vercel hosts the website and processes the submission. We use these details only to contact you about the beta or partnership you selected; registration does not guarantee an invitation or partnership. Signup details are retained until you withdraw consent or the relevant recruitment or partnership follow-up ends, then removed. To unsubscribe or request deletion, email [email protected]. The form does not send automatic emails.
Contact
Privacy requests: [email protected]. Beta test-account deletion requests can be made here.