ScanHawk^™

Terms of Service Acceptable Use Policy Privacy Policy

Privacy Policy

Version 2.3.0 · Effective August 19, 2026 · Last updated September 13, 2026 · Replaces the version dated July 23, 2026

1. Who we are

ScanHawk is a product of TwentyPin, Inc., 2750 FM 1463 Road, Suite 150-70, Katy, TX 77494, which is the controller of the personal data described here. Contact us at privacy@twentypin.com.

2. What this policy covers

This policy covers every ScanHawk surface: the iOS and Android app, the installable web app (PWA), the browser extension, the Microsoft Outlook add-in, the scanhawk.io website, and the ScanHawk engine and API. Where a surface behaves differently, we say so.

3. What we collect

3.1 The contents of what you check

When you scan a QR code or check a link, we receive the decoded text — in almost every case a URL. We also receive a short context label (for example generic, email, or parking_meter) describing where the code was found.

A URL can itself contain personal information — a name in a path, an email address in a query string, or a single-use token in a password-reset or document-sharing link. We do not seek that information, but we necessarily receive whatever the URL contains. Our Acceptable Use Policy asks you not to submit links carrying other people’s secrets.

Some codes are themselves a credential. The QR code that enrols an authenticator app (an otpauth:// or otpauth-migration:// link) carries the shared secret for your two-factor codes in clear text. Keeping one would not be a log entry; it would be a standing compromise of that account, and one that survives a password change. So we strip the secret out of these payloads on arrival — before the check is written to our logs, before the result is returned to you, and before anything reaches our threat feed. What is kept is the harmless part that makes the record reviewable: the scheme, the issuer, the account label, and the algorithm. We necessarily receive the code in order to check it; we simply do not keep the secret in it.

3.2 Your installation identifier

On first launch the app generates a random identifier (a version-4 UUID) and stores it on your device. It is not derived from your device, your hardware, your advertising ID, or you; it does not follow you across apps; and reinstalling the app produces a new one. We use it for exactly two things: attaching your acceptance of our terms to something, and applying rate limits fairly so one installation cannot exhaust the service for everyone.

The browser extension uses an equivalent anonymous install token, which it requests from our worker automatically on first run.

3.3 Your record of acceptance

When you accept the Terms of Service and Acceptable Use Policy, we store a consent record containing your installation identifier, the version number and a SHA-256 hash of each document you were shown, the fact that you scrolled to the end before agreeing, the time you accepted, and the app version, platform, and locale. The document hash is what lets us show precisely which text you agreed to, rather than merely which version number.

3.4 Your contact details — optional

You may give us an email address, a phone number, or both, to hear from us about ScanHawk. This is optional and is never required to use ScanHawk. It is a separate choice from accepting the terms: declining changes nothing about your access. There are two places you can do this: the product-news signup on our launch page, and the Tell me more about… form on our home page.

The home-page form also asks which topics you want to hear about (the app, the Microsoft 365 add-in and browser extension, the API, pricing, or all of them) and, if you tick Something else, lets you type a short note. We keep only what you entered: the contact details you gave, the boxes you ticked, and the note. We do not record which device or browser you used, and we do not combine this with any scan you have run.

We use these details for one thing: to send you the information you asked for, about the topics you ticked. We do not sell or share them. Every email carries an unsubscribe link, and you can also unsubscribe or ask us to delete your details by emailing us (§10). We do not currently send text messages. If we start, a message will only go to a number given on that form, we will name the messaging provider in §7 before the first message is sent, standard message and data rates may apply, and replying STOP to any text ends them.

The note is free text you typed, so we treat it as untrusted: it is stored as plain text, read by a person, never displayed as a web page, and never used to make an automated decision about you. Please do not put passwords, account numbers, or anyone else's personal details in it.

3.5 Operational logs

We log each check — the submitted text (redacted as described in §3.1), the resolved destination, the resulting verdict and risk score, the context label, the signals and redirect chain behind the verdict, and the time — to operate the service, cache results, detect abuse, and strengthen our threat feed. These records carry no installation identifier. They are not linked to you or to your installation, and we cannot work backwards from one to the other. Each check does record which credential submitted it: for the app, the extension, and the add-in that is one of our own service keys, so it tells us which route the check took through our infrastructure — not who you are. If you call the engine under your own API key, the check is recorded against your account so that we can support and bill it.

Separately, we keep a daily count of how many checks each installation has made, so that the rate limit described in §3.2 can work. That counter holds only the installation identifier, the date, and a number — never the text you checked or the verdict you were given.

We also record standard server logs, including IP address, for security and rate limiting.

3.6 Reports you choose to submit

If you report a code or link, the URL and your reported verdict are added to our community threat feed to protect other users. Threat feed entries are indicators about destinations and are not linked to your identity.

3.7 App update checks

The app can receive fixes to its own software without waiting for an app-store release. Because ScanHawk’s job is to be right about a link, we want a wrong answer to be fixable in minutes rather than in the days an app-store review takes.

The check runs only after you check a code or link and we reach our service — never when you open the app, and never before you have asked for anything. If you are offline, or the app answered you without the network, no update request is made. It runs at most once each time you open the app, and it never interrupts a result you are reading: anything downloaded is applied the next time the app starts.

The request goes to Expo (650 Industries, Inc.), which hosts our software updates. It carries no scanned content, no URL you checked, and no verdict. It carries which platform you are on, which version of the app you are running, and a separate random identifier generated by the update service and stored on your device. That identifier is not the installation identifier described in §3.2, is not shared with us for any other purpose, and like the one in §3.2 it is not derived from you or your hardware and does not follow you across apps. Expo processes it to serve the correct update and to operate the service. It is not analytics, and we do not receive a profile, an audience, or any behavioural data from it.

3.8 The website

scanhawk.io is a static site. It sets no cookies, runs no analytics, and loads no third-party scripts or fonts — everything it serves is first-party. Our host records standard access logs.

3.9 When you contact us

If you email one of the addresses in §15 — or info@, hr@, or abuse@ at twentypin.com — we receive whatever you send: your name and email address, your message, and any attachments. It is kept in our company mailbox and used to answer you.

We are a small company, so we use an AI assistant (Anthropic's Claude, §7) to help us sort incoming mail and draft replies. A person reads every message, and a person reviews every reply before it is sent. The assistant sees the subject and the text of your message with your email address removed; it does not see your address or your attachments, and it does not send anything. If we ever let it send routine replies on its own, we will say so here first. The assistant makes no decision about you: it suggests, and a person decides.

Three kinds of message are handled with extra care. Messages to hr@ are never evaluated, summarised, or ranked by the assistant — it only tells us a message has arrived, and a person reads it in full. Messages to security@ are handled under our vulnerability-disclosure process, by a person. Messages to privacy@ are treated as requests under §10 from the moment they arrive.

We keep a short working record of each message — what kind of message it was, the draft the assistant proposed, and whether we sent it as-is or changed it — so we can check the assistant's work. That record holds your domain and a one-way hash of your address, not the address itself, and is deleted after 90 days.

4. What the app accesses on your device

Camera. ScanHawk uses your camera for one purpose: to read QR codes. The camera image is decoded on your device — the image itself is never transmitted or stored. Only the decoded text leaves your device.

Local storage. Your installation identifier, a copy of your consent record, and your recent scan history are stored on your device. Scan history stays on the device; we do not upload it.

We request no other device permissions — no location, no contacts, no photo library, no microphone.

5. The extension, add-in, and web app

Browser extension. Only URLs leave your browser — never page content, form data, or what you type. Hovering a link shows a small shield chip; that is an affordance, and a scan happens only when you click it or use the context menu. Verdicts are cached in the extension’s local storage.

Outlook add-in. The add-in reads the open message inside your mail client and extracts link pairs — the destination (href) and the visible text the link displays. Only those pairs and a context label are transmitted to us. The message body, subject, sender, recipients, and attachments are not sent to our servers. We need the visible display text because the mismatch between what a link says and where it goes is one of the strongest phishing signals there is — which does mean that fragment of the message’s text reaches us.

Installable web app. The PWA behaves like the mobile app and stores the same items in your browser’s local storage.

6. Why we process it (legal bases)

For people in the UK, the EEA, and other regions with equivalent law, our legal bases under the GDPR are:

• Contract (Art. 6(1)(b)) — processing the text you submit in order to return a verdict, which is the service you asked for.
• Legitimate interests (Art. 6(1)(f)) — securing the service, preventing abuse, applying rate limits, maintaining the threat feed, improving detection, and answering the messages you send us (§3.9). We balance these against your rights and use the least identifying data that works, which is why the installation identifier is random rather than device-derived.
• Legal obligation (Art. 6(1)(c)) — retaining the consent record as evidence of the agreement between us, and responding to lawful requests.
• Consent (Art. 6(1)(a)) — the optional email address, and only that. You may withdraw it at any time without affecting your use of ScanHawk.

7. Who we share it with

To produce a verdict, the URL being checked may be shared with:

• Anthropic (Claude) — to reason about the destination and explain the risk in plain language. For a verdict we send the URL and page metadata, not information about you. If you email us (§3.9), we may also send the subject and text of your message, with your email address removed, so the assistant can help sort it and draft a reply for a person to review. Under our commercial terms with Anthropic, the data is not used to train their models.
• Threat-intelligence providers — Google Cloud Web Risk, VirusTotal, PhishTank, and URLhaus (operated by abuse.ch in Switzerland) — to return safety signals about the URL.

For verdicts, these providers receive only the URL and, where relevant, its resolved destination. They do not receive your installation identifier or your email address.

We also use infrastructure providers who process data on our instructions under written agreements: Supabase (database and edge functions), Fly.io (engine and worker hosting), Google Workspace (our company email, which holds any message you send us), Postmark (transactional and product-news email, only if you gave us an address), and Expo (650 Industries, Inc., which hosts the app software updates described in §3.7). Expo receives no URL you checked and no verdict — only what is needed to serve the right update, as set out in §3.7.

We may disclose data where required by law or where necessary to protect the rights, safety, or property of users or the public. If TwentyPin is involved in a merger, acquisition, or sale of assets, data may transfer as part of it; we will give notice before your data becomes subject to a different privacy policy.

8. How long we keep it

• Cached verdicts — expire automatically, typically within 24 hours.
• Check logs — retained no longer than 90 days, then deleted or anonymised.
• Consent records — retained while your installation is active and for up to six years afterwards, because their whole purpose is to evidence an agreement for as long as a claim about it could be brought.
• Optional contact details (email address, phone number, the topics you ticked, and any note) — until you unsubscribe or ask us to delete them, plus a suppression entry so we do not contact you again by mistake.
• Threat feed indicators — retained indefinitely as security data. They describe destinations, not people, and are not linked to you.
• Messages you send us (§3.9) — kept in our company mailbox for as long as needed to deal with them and to keep a record of what was said; the assistant's working record of a message is deleted after 90 days.
• Server access logs — retained up to 30 days.

9. What we do not do

• No accounts, names, passwords, or logins.
• No advertising, ad networks, or advertising identifiers.
• No third-party analytics or tracking SDKs.
• No selling or renting of personal data, and no “sharing” for cross-context behavioural advertising as those terms are defined under California law.
• No automated decision-making that produces legal or similarly significant effects about you. Verdicts are about links, not about people.

10. Your rights and choices

In the app. Under About → Privacy & data you can view your installation identifier and consent record, and erase everything we hold that is tied to it — identifier, consent record, and optional email — in one step. Deleting the app also removes the identifier from your device.

Depending on where you live, you may also have the right to access the personal data we hold about you, correct it, delete it, receive a portable copy, object to or restrict processing, withdraw consent, and — in California — to know what we collect and to opt out of sale or sharing (we do neither). We do not discriminate against you for exercising any of these rights.

To make a request, email privacy@twentypin.com. We will respond within the time the applicable law requires. Because we hold no name, account, or login, we usually cannot connect a request to your data unless you give us your installation identifier — you will find it in the app under About → Privacy & data. It locates your consent record and, if you gave us one, your email subscription. It cannot locate your check logs: as §3.5 explains, those carry no installation identifier, so there is nothing in them for us to find, return, or erase on request — they age out on the schedule in §8 instead. If you cannot supply the identifier, use the in-app erasure instead, which needs no verification.

If you are in the UK or the EEA and believe we have handled your data improperly, you may complain to your local supervisory authority, though we would appreciate the chance to put it right first.

11. Security

All traffic between the apps and our servers is encrypted in transit with TLS. Data at rest is encrypted by our hosting providers. Engine credentials are held server-side and never shipped in a client. Access to production data is limited to those who need it. No system is perfectly secure, but if a breach affects your data we will notify you and the relevant authorities as required by law.

To report a security issue, email security@twentypin.com.

12. International transfers

TwentyPin is based in the United States, and our infrastructure and processors are located in the United States and other countries. If you are in the UK or the EEA, your data is transferred outside your region. Where required, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) with our processors, together with technical measures including encryption in transit and at rest.

13. Children

ScanHawk is not directed to children under 13 and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, contact privacy@twentypin.com and we will delete it.

14. Changes to this policy

We may update this policy. The version number and date at the top of this page will change with it. If a change materially affects how we handle your data, we will present it in the app and ask you to acknowledge it before you continue — the same mechanism used for a material change to the Terms of Service.

15. Contact

TwentyPin, Inc. — 2750 FM 1463 Road, Suite 150-70, Katy, TX 77494
Privacy: privacy@twentypin.com
Security: security@twentypin.com
Support: support@twentypin.com