ScanHawk

Terms of Service

Version 1.0.0 · Effective August 19, 2026 · Last updated August 19, 2026

The short version. ScanHawk tells you whether a link hidden in a QR code or an email looks dangerous. It is a warning tool, not a guarantee — a “Safe” verdict is an opinion produced by software, and you are still responsible for what you choose to open. Use it lawfully and do not abuse the service. We can suspend access that breaks the rules. There is no account and we do not ask for your name — an email address is optional. Disputes go to arbitration unless you opt out within 30 days. This summary is for convenience only and is not part of the agreement.

1. Agreement to these Terms

These Terms of Service (the “Terms”) are a binding contract between you and TwentyPin, Inc. (“TwentyPin”, “we”, “us”), governing your access to and use of ScanHawk — the mobile app, the web app, the browser extension, the Microsoft Outlook add-in, the scanhawk.io website, and the ScanHawk engine and API (together, the “Service”).

You accept these Terms by tapping “I Agree” in the app, or by otherwise using the Service. If you do not agree, do not use the Service.

Our Acceptable Use Policy and our Privacy Policy are incorporated into these Terms by reference and form part of this agreement. Where a separate written agreement covers your use of the API, that agreement controls to the extent of any conflict.

2. Eligibility and age

You must be at least 13 years old to use the Service. If you are under the age of majority where you live, you may use the Service only with the involvement and consent of a parent or legal guardian, who agrees to these Terms on your behalf and is responsible for your use. By accepting these Terms you represent that you have the legal capacity to enter into this contract and that you are not barred from using the Service under the laws of your jurisdiction.

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, contact us at support@twentypin.com and we will delete it.

3. Definitions

“Content” means any text, URL, image, or other material you submit to the Service, including the decoded contents of a scanned code.
“Verdict” means the risk assessment the Service returns for a submitted item — currently one of Safe, Suspicious, or Dangerous — together with any score, reason, or explanation accompanying it.
“Threat Feed” means our community database of URLs and indicators contributed by users and other sources.
“Installation Identifier” means the random identifier the app generates on first launch to record your acceptance of these Terms and to apply rate limits. See §5.

4. What the Service is — and is not

ScanHawk decodes a QR code, link, or message on your device, sends the decoded text to our engine, follows redirects to identify the true destination, evaluates that destination against threat-intelligence sources, our Threat Feed, and an AI model, and returns a Verdict to you before you open anything.

The Service is a decision aid. It is not antivirus software, not an endpoint protection product, not a managed security service, and not professional, legal, or financial advice. It does not open links for you, block navigation, remove malware, or protect a device that is already compromised. You remain solely responsible for deciding what to open, install, enter, pay, or trust.

5. Your installation and optional email

No account is required. ScanHawk does not ask for your name, and you do not register or log in. When you first open the app it generates a random installation identifier and stores it on your device. That identifier is used to record your acceptance of these Terms, to apply rate limits fairly, and for nothing else. It is not derived from your device, your hardware, or you, and it does not follow you across apps.

Record of acceptance. When you accept these Terms we store a consent record containing your installation identifier, the version and a cryptographic hash of each document you were shown, and the time you accepted. We keep that record for as long as it may be needed to evidence the agreement between us.

Optional email. You may choose to give us an email address to receive product news. This is entirely optional, is never required to use the Service, and is a separate choice from accepting these Terms — declining it changes nothing about your access. You can unsubscribe at any time using the link in any message we send, or by emailing support@twentypin.com.

Erasure. You may erase your installation identifier, your consent record, and any email address you gave us at any time from within the app (About → Privacy & data), or by emailing support@twentypin.com. Deleting the app also removes the identifier from your device. Anonymised or aggregated data, Threat Feed entries, and records we must keep for legal, security, or accounting reasons are not deleted — see the Privacy Policy.

6. No guarantee of detection

READ THIS SECTION. Threat detection is probabilistic and adversarial. Attackers actively work to evade tools like ScanHawk, and new scams appear faster than any system can catalogue them.

A Safe Verdict is not a promise that a destination is safe. It means our engine found no evidence of a threat at the moment it looked. False negatives will occur.
A Suspicious or Dangerous Verdict is not an accusation of wrongdoing against any person or business. False positives will occur.
A destination can change after we check it. A link that was harmless one minute can serve malware the next.
We do not warrant that the Service will detect any particular threat, or that it will be available, uninterrupted, timely, or error-free.

Do not rely on ScanHawk as your only safeguard. Keep your devices updated, use reputable security software, and apply your own judgement.

If you are a business deploying ScanHawk or the API as part of a security programme, you are responsible for validating that it meets your requirements and for maintaining independent controls.

7. Acceptable use

Your use of the Service is subject to the Acceptable Use Policy, which lists conduct that is prohibited — including using the Service to test whether your own malicious content evades detection, submitting other people’s personal information, circumventing rate limits, and scraping or reselling Verdicts. Violating the Acceptable Use Policy is a breach of these Terms.

8. Fees, plans, and app-store purchases

The ScanHawk consumer app is currently free to use. We may introduce paid plans, features, or usage tiers in future. If we do, the price, billing period, and renewal terms will be disclosed to you before you are charged, and no existing free feature will start charging you without your express agreement.

Any purchase you make through the Apple App Store or Google Play is a transaction with that store, processed under that store’s terms. The store — not TwentyPin — handles payment, receipts, subscription management, and refunds. We do not receive your payment-card details. Refunds are governed by the applicable store’s policy; where we can, we will support a reasonable refund request, but we cannot issue refunds for store transactions ourselves.

API and commercial engine access are billed separately under the terms quoted to you at the time of purchase.

9. Licence and restrictions

Subject to these Terms, we grant you a limited, personal, non-exclusive, non-transferable, non-sublicensable, revocable licence to install and use the ScanHawk client applications on devices you own or control, and to use the Service for your own personal or internal business purposes.

You may not, and may not permit anyone else to:

copy, modify, translate, or create derivative works of the Service, except as applicable law expressly permits notwithstanding this restriction;
reverse engineer, decompile, or disassemble any part of the Service, or attempt to derive our detection logic, model prompts, scoring weights, or thresholds;
rent, lease, lend, sell, sublicense, resell, or provide the Service — including Verdicts — to third parties as a service of your own, except under a written agreement with us;
remove, obscure, or alter any proprietary notice, branding, or Verdict displayed by the Service, or present a Verdict in a way that misstates what it says;
use any robot, scraper, or automated means to access the Service other than the documented API, or exceed the rate limits applicable to your access;
interfere with, disrupt, probe, or attempt to gain unauthorised access to the Service or its infrastructure; or
use the Service to build, train, or benchmark a competing product.

10. Our intellectual property

The Service, including its software, engine, models, Threat Feed, documentation, design, and the ScanHawk and TwentyPin names and logos, is owned by TwentyPin and its licensors and is protected by intellectual property law. These Terms grant you a licence to use the Service, not any ownership in it. All rights not expressly granted are reserved.

If you send us feedback, suggestions, or ideas about the Service, you grant us a perpetual, irrevocable, worldwide, royalty-free licence to use them without obligation or compensation to you. You are not required to send us feedback.

11. Your submissions and the threat feed

You retain any rights you hold in Content you submit. By submitting Content — for example by scanning a code, checking a link, or reporting a URL — you grant us a worldwide, royalty-free, non-exclusive licence to host, process, analyse, store, and transmit that Content in order to operate, secure, and improve the Service, including adding indicators to the Threat Feed and sharing them with other users and with threat-intelligence partners.

You represent that you have the right to submit the Content you submit and that doing so does not violate any law or third-party right. Do not submit Content containing another person’s personal information, credentials, confidential material, or anything you are not permitted to disclose — links that embed session tokens, password-reset codes, or personal identifiers in the URL are a common example.

Threat Feed entries are indicators about destinations, not about you, and are stored without linking them to your identity. Because they protect other users, indicators derived from your submissions may persist after you erase your data.

12. Third-party services and links

To produce a Verdict, the Service transmits the submitted URL to third-party processors and threat-intelligence providers identified in the Privacy Policy. We are not responsible for those providers’ services, availability, or accuracy.

The Service reports on destinations we do not control. We do not endorse any destination, and we are not responsible for content you reach after choosing to open a link — regardless of the Verdict we returned for it.

13. API and developer access

If we issue you an API key, it is confidential and personal to you. Keep it secret, never embed it in client-side code or a public repository, and notify us immediately at support@twentypin.com if it is exposed. You are responsible for all usage and charges incurred under your key until you notify us.

We may apply rate limits, quotas, and abuse controls to API access, and may change, version, or deprecate API endpoints. We will give reasonable notice of breaking changes where practicable. You must not cache, store, or redistribute Verdicts beyond what your integration needs, and must not present Verdicts as your own product without a written agreement.

14. Privacy

Our Privacy Policy explains what we collect, what we send to third-party processors, how long we keep it, and the rights you have over it. By using the Service you acknowledge that the decoded contents of what you scan or check — which may include a URL you consider private — are transmitted to and processed by our engine and its processors.

15. Suspension and termination

You may stop using the Service, erase your data, and uninstall the app at any time.

We may suspend or terminate your access, with or without notice, if we reasonably believe you have breached these Terms or the Acceptable Use Policy, if your use creates risk or legal exposure for us or other users, or if we are required to do so by law. Where the breach is not serious and the circumstances allow, we will try to notify you first and give you a chance to fix it.

We may also discontinue the Service, or any part of it, on reasonable notice. Sections that by their nature should survive termination — including §§ 6, 10, 11, 16, 17, 18, 20, 21, and 24 — survive.

16. Disclaimers

THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE”, WITHOUT WARRANTY OF ANY KIND. TO THE FULLEST EXTENT PERMITTED BY LAW, TWENTYPIN AND ITS SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, ACCURACY, AND NON-INFRINGEMENT.

WE DO NOT WARRANT THAT THE SERVICE WILL DETECT ANY PARTICULAR THREAT, THAT VERDICTS WILL BE ACCURATE OR COMPLETE, OR THAT THE SERVICE WILL BE UNINTERRUPTED, SECURE, OR ERROR-FREE.

Some jurisdictions do not allow the exclusion of implied warranties, so parts of this section may not apply to you. Nothing in these Terms excludes or limits any right you have under mandatory consumer protection law, including, for residents of the United Kingdom and the European Economic Area, statutory rights that cannot be waived by contract.

17. Limitation of liability

TO THE FULLEST EXTENT PERMITTED BY LAW, TWENTYPIN WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, GOODWILL, OR BUSINESS INTERRUPTION, ARISING OUT OF OR RELATING TO THE SERVICE, WHETHER IN CONTRACT, TORT, OR ANY OTHER THEORY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

THIS EXPRESSLY INCLUDES ANY LOSS ARISING FROM A THREAT THE SERVICE FAILED TO DETECT, FROM A VERDICT THAT PROVED INCORRECT, OR FROM YOUR RELIANCE ON A VERDICT.

OUR TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS RELATING TO THE SERVICE WILL NOT EXCEED THE GREATER OF (A) THE AMOUNT YOU PAID US FOR THE SERVICE IN THE TWELVE MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM, OR (B) ONE HUNDRED U.S. DOLLARS (US$100).

These limits do not apply to liability that cannot lawfully be limited — including liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or under mandatory consumer protection law. Some jurisdictions do not allow certain limitations, so parts of this section may not apply to you.

The allocation of risk in §§ 16 and 17 is a fundamental basis of this agreement and reflects the fact that the Service is provided to consumers free of charge.

18. Indemnification

You will defend, indemnify, and hold harmless TwentyPin and its officers, employees, and agents from any third-party claim, demand, loss, or expense (including reasonable legal fees) arising out of your Content, your use of the Service, your breach of these Terms or the Acceptable Use Policy, or your violation of any law or third-party right. This section does not apply to the extent a claim arises from our own breach or negligence, and, if you are a consumer, applies only to the extent permitted by the consumer protection law that applies to you.

19. Changes to the Service and these Terms

We may modify the Service and these Terms from time to time. When we change these Terms we will update the version number and the “last updated” date at the top of this page.

Material changes require your renewed agreement. If we make a change that materially affects your rights or obligations, we will present the updated Terms to you in the app and ask you to accept them again before you continue using the Service, and we will give at least 30 days’ notice of the change where practicable. Non-material changes — clarifications, typographical corrections, updated contact details — take effect when posted. Continuing to use the Service after a non-material change means you accept it. If you do not accept a material change, your remedy is to stop using the Service, erase your data, and uninstall the app.

20. Governing law

These Terms and any dispute arising from them are governed by the laws of the State of Texas, United States, without regard to its conflict-of-laws rules, and by applicable United States federal law. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

If you are a consumer resident in the European Economic Area, the United Kingdom, or another jurisdiction whose law gives you the protection of your local courts and mandatory local consumer law, nothing in this section deprives you of that protection.

21. Dispute resolution and arbitration

PLEASE READ — THIS SECTION AFFECTS HOW DISPUTES ARE RESOLVED. IT REQUIRES INDIVIDUAL ARBITRATION AND WAIVES YOUR RIGHT TO A JURY TRIAL AND TO PARTICIPATE IN A CLASS ACTION. YOU MAY OPT OUT WITHIN 30 DAYS — SEE §21.5.

21.1 Talk to us first

Before starting a formal proceeding, email support@twentypin.com describing the dispute and the relief you want. We will do the same for a dispute we have with you. Both of us agree to try in good faith to resolve it informally for 60 days before proceeding.

21.2 Binding individual arbitration

If we cannot resolve a dispute informally, you and TwentyPin agree that it will be resolved by binding individual arbitration administered by the American Arbitration Association under its Consumer Arbitration Rules, rather than in court. The Federal Arbitration Act governs the interpretation and enforcement of this section. The arbitrator decides all issues, except that a court decides whether the class-action waiver in §21.3 is enforceable. The arbitration will be held in the county where you live, or remotely by video or on the documents, at your election. An arbitrator can award the same individual relief a court could.

21.3 Class-action and jury waiver

You and TwentyPin each waive the right to a jury trial and agree that claims may be brought only in an individual capacity, not as a plaintiff or class member in any class, consolidated, or representative proceeding. If this waiver is found unenforceable as to a particular claim, that claim — and only that claim — will proceed in court, and the rest of this section remains in force.

21.4 Exceptions

Either of us may bring an individual claim in small-claims court in Fort Bend County, Texas or in the county where you live, and either of us may seek injunctive relief in court to stop infringement or misuse of intellectual property.

21.5 How to opt out

You can reject this arbitration agreement. Email support@twentypin.com with the subject line “Arbitration Opt-Out”, stating your name and, if you have one, the installation identifier shown in the app under About → Privacy & data, within 30 days of first accepting these Terms. Opting out affects nothing else in these Terms and will not affect your use of the Service. If you opt out, disputes go to the courts identified in §20.

21.6 Consumers outside the United States

If mandatory law in your country prohibits pre-dispute arbitration agreements or class-action waivers for consumers, this §21 does not apply to you, and disputes are resolved in the courts identified in §20.

22. Export control and government users

You may not use or export the Service in violation of United States export control or sanctions laws. You represent that you are not located in, and are not a national or resident of, a country or region subject to comprehensive U.S. sanctions, and that you are not on any U.S. government restricted-party list.

The software is “commercial computer software” as defined in FAR 12.212 and DFARS 227.7202. U.S. Government end users acquire only the rights granted to all other end users under these Terms.

23. Apple and Google platform terms

These Terms are between you and TwentyPin only — not with Apple Inc. or Google LLC. When you obtain ScanHawk through the Apple App Store, the following additional terms apply, and Apple’s own Licensed Application End User Licence Agreement also governs to the extent it conflicts with a less protective term here:

Apple has no obligation to furnish any maintenance or support for the app.
If the app fails to conform to any applicable warranty, you may notify Apple, and Apple will refund the purchase price (if any). To the maximum extent permitted by law, Apple has no other warranty obligation with respect to the app.
TwentyPin, not Apple, is responsible for any product liability claim, any claim that the app fails to conform to a legal or regulatory requirement, and any claim arising under consumer protection or similar law.
TwentyPin, not Apple, is responsible for investigating and resolving any third-party claim that the app infringes intellectual property rights.
You represent that you are not located in a country subject to a U.S. Government embargo or designated as “terrorist supporting”, and are not on any U.S. Government restricted-party list.
Apple and its subsidiaries are third-party beneficiaries of these Terms and may enforce them against you.

Where you obtain the app through Google Play, your use is also subject to the Google Play Terms of Service, and Google is not a party to these Terms.

24. General

Entire agreement. These Terms, together with the Acceptable Use Policy and the Privacy Policy, are the entire agreement between you and us about the Service and supersede any prior understanding.

Severability. If any provision is held unenforceable, it will be limited or removed to the minimum extent necessary and the rest stays in effect.

No waiver. Our failure to enforce a provision is not a waiver of it.

Assignment. You may not assign these Terms without our written consent. We may assign them to an affiliate or in connection with a merger, acquisition, or sale of assets, on notice to you.

Force majeure. Neither party is liable for a failure to perform caused by events beyond its reasonable control.

Notices. Because we do not require an email address, we give you notice through the app itself — including the re-acceptance prompt described in §19 — and by posting to scanhawk.io. If you have given us an optional email address, we may also use it. You may give us notice at support@twentypin.com or by post to TwentyPin, Inc., 2750 FM 1463 Road, Suite 150-70, Katy, TX 77494.

Relationship. Nothing in these Terms creates a partnership, joint venture, employment, or agency relationship between us.

25. Contact

TwentyPin, Inc. — 2750 FM 1463 Road, Suite 150-70, Katy, TX 77494
support@twentypin.com