Privacy Policy

Last updated: 2 November 2026 · Applies to the TrustStep app for iPhone and iPad (version 1.1 and later), its Safari extension, Share extension and SMS filter, and the TrustStep email add-ins for Gmail and Outlook.

1. Who is responsible

The controller for the processing described here is Joel Filipe Pereira Ribeiro, an individual developer based in Oberkorn, Luxembourg, who publishes TrustStep. Contact: privacy@truststep.eu.

2. What stays on your iPhone

Your check history (a short preview of what was checked, the verdict, reasons and date — including the address of pages where Safari protection warned you and the title of suspicious calendar events), your language choice, the country you choose for the scam list, your appearance choices, where you placed the Safari button and your App Lock setting are stored on your device only, in storage protected by iOS. You can delete a single entry, all history, or all TrustStep data at any time in the app. Deleting the app removes this data.

When a message you check contains bank account details (an IBAN) and the sender’s email address, TrustStep remembers on your iPhone which accounts each sender has used, so it can warn you if a known sender suddenly asks you to pay a different account. It stores only irreversible codes derived with a key that never leaves your iPhone — not the account numbers, addresses or names — keeps them at most 365 days, never sends them to TrustStep, and deletes them when you delete all TrustStep data.

If you use the Evidence Vault, the results, messages, screenshots and notes you save there stay on your iPhone, in storage iOS keeps unreadable while the iPhone is locked. Screenshots are stored without their location data. Nothing is sent to TrustStep; a report leaves your iPhone only when you export and share it yourself. Deleting a case, or all TrustStep data, erases it.

If you choose trusted contacts (up to three), iOS gives TrustStep only each person’s name and the number or address you picked; they are kept on your iPhone, never sent to TrustStep, and used only when you decide to message or call them about a warning. Deleting all TrustStep data removes them.

Screenshots and photos you choose are read on the device with Apple’s on-device text recognition. The image itself is never uploaded.

If you check something without an internet connection, TrustStep checks it on your iPhone and keeps that text on your iPhone only until it can check it again with the full online analysis (at most 7 days), then deletes it. Deleting your history also deletes it.

The SMS filter first checks each message on your iPhone. iOS only shows it messages from senders who are not in your contacts; it never sees iMessage conversations or messages from your contacts. Only in the case described in section 3a (a link or phone number the on-device check cannot decide) may iOS ask TrustStep’s service.

3. What is sent for analysis, and when

When you ask TrustStep to check something — by pressing Check, sharing to TrustStep, scanning a QR code, using Suspicious call, or tapping the TrustStep button in Safari — the content needed for that check is sent over an encrypted connection (HTTPS) to TrustStep’s analysis service:

• the text, link or email you chose (for screenshots: the recognised text only);
• in Safari, when you focus a password, card or code field, or tap the TrustStep button: the page address, title and visible text of that page, so TrustStep can warn you before you type;
• for Calendar Shield (only if you enable it): the title of upcoming events that contain a link or phone number, and only those lines.
• for Suspicious call: your answers, your own words and, if you type it, the caller’s number, with your iPhone’s region setting (for example “LU”) so a number typed without its country code can be read. The number is compared with the numbers organisations publish on their own websites and with fraud reports, to tell you whether it matches who the caller claims to be — a number never proves who is calling;
• with any check made while you are on a phone call: only the fact that a call is in progress (yes or no). TrustStep never receives the number, the other person or the audio of your calls. During a call, advice can stay on the Dynamic Island and the Lock Screen: fixed texts shown by your iPhone, with nothing from the call and nothing sent to TrustStep.

The analysis service combines rule-based checks with AI models. To analyse ambiguous content it may send the content to an AI provider acting on TrustStep’s behalf (section 4). Before anything is sent to an AI provider, one-time codes, passwords, card numbers and all but the last four characters of IBANs are removed. The content is used only to produce your result. Under OpenAI’s API terms, content sent through its API is not used to train its models. TrustStep asks OpenAI not to store it; under OpenAI’s terms it may still keep API content for a limited time, up to 30 days, to monitor abuse, unless zero data retention applies to TrustStep’s account.

Checks TrustStep makes itself. To check a link, TrustStep’s server may open it to follow its redirects; the website then sees a request from TrustStep’s server, never from you. When a message names an organisation, TrustStep may look up only that organisation’s name in Wikidata (the public database of the Wikimedia Foundation) to find its official website, and read the title of that official website; the rest of your content is never sent. Lists of known fraudulent websites are downloaded from public threat-intelligence sources; nothing about you or your checks is sent to them. To see how recently a website was created, TrustStep may ask the domain's public registry (RDAP) for its registration date; only the domain name is sent.

Retention. TrustStep does not store the content you submit. Technical logs record only non-content metadata (a random request ID, verdict, score, which signals fired, number of characters, whether a link was present, and processing time) to keep the service reliable and secure. Your IP address is processed transiently to prevent abuse (rate limiting) and is not stored by TrustStep.

3a. Other data, only when you choose it

• SMS filter (server check). For a text from an unknown sender that contains a link or phone number and is not clearly a scam, iOS may send the message text and the sender’s number to TrustStep’s security service (api.truststep.eu) so the Protection Layer can decide whether to move it to Junk. Only a clear scam is moved; if the service cannot be reached the message simply stays in your inbox. iOS sends no identifier of you or your device; the content is not stored.
• “Does this result look wrong?” sends the verdict, the policy and signal names, the destination’s host name only (never the full address, its path or parameters, and never the content; TrustStep keeps only the registrable domain) and a hashed random install identifier. A person reviews each report; a single report never changes a verdict.
• Report a caller’s number (Suspicious call) sends that number and the hashed install identifier. Numbers are published to the call-identification list only after review.
• Scams going around downloads from TrustStep a public list of recent scams, gathered from official bodies, the press and public forums. It is never built from your checks. Nothing about you, your checks or your country is sent; the app chooses on your iPhone what applies to the country you selected.
• Call identification downloads the reviewed list of scam numbers; incoming calls are matched on your iPhone by iOS and never sent to TrustStep.
• Family Shield (only if you and a family member both turn it on). When TrustStep shows STOP on the protected person’s iPhone (or CAUTION, if they chose it), their iPhone sends an alert that only the other person’s iPhone can open: it is encrypted on the iPhone with Apple’s HPKE before it leaves, and says only the time, how serious it was, the kind of scam from a fixed list (for example “asked for a code”) and where it was seen (for example SMS). Never the message, the link, the sender, a number or a location. TrustStep relays it through an anonymous mailbox: it stores a random mailbox identifier, a hash of its access codes and the encrypted alert, which it cannot read. Alerts are deleted when they are collected, after 7 days at the latest, and everything is deleted when either person leaves or deletes the app’s data.
• Anonymous crash reports (off by default, Settings) send iOS crash and freeze diagnostics: stack traces, app and iOS version — no content, no identifiers.
• Risk observations. When a check ends in CAUTION or STOP, the domain involved is counted (domain, day, verdict — no content, no identifier) to recognise campaigns. Kept 180 days.
• The random install identifier is created on your iPhone, is not linked to you, and is only used — hashed — to count distinct reporters and prevent abuse.
• Abuse limits. To stop automated misuse without accounts, each check from the app carries an anonymous token that changes every day (it is derived on your iPhone from a random value and cannot be linked from one day to the next), and the service counts requests per coarse network block (for example the first three parts of an IPv4 address). Both are hashed with a secret before counting, are never stored with your checks or logged, and counters are deleted within two days. They are never used to identify you, for advertising or for tracking.
• Email add-ins (Gmail, Outlook). If you install a TrustStep add-in and press Check on an email, the sender, subject, text and links of that email are sent for analysis as described in section 3. The add-in reads only the email you have open, and only when you ask it to.

3b. Optional account

You can use TrustStep without an account. If you create one, you choose how to sign in:

• With an email address: TrustStep emails you a one-time 6-digit code; there is no password.
• With Apple: Apple gives TrustStep your email address, or a private relay address if you choose to hide it. TrustStep does not ask Apple for your name.
• With Google: Google gives TrustStep your email address after you sign in on Google’s page.

TrustStep keeps your email address, the sign-in method and the dates of account creation and last sign-in, to sign you in. Your sign-in session is stored in the iPhone’s Keychain on this device only. Checks are never sent with your account: the content you check, your history and your Family Shield alerts are not linked to it. You can sign out or delete the account at any time in Settings › Account; deletion removes it from our server. It is kept until you delete it. Deleting the account does not cancel an App Store subscription.

4. Service providers

• Supabase — hosts the analysis service (edge functions) and, if you create one, your account (email address and sign-in data).
• Apple and Google — only if you choose to sign in with them, to confirm your identity and give TrustStep your email address.
• OpenAI — AI model used for semantic analysis of ambiguous content, via its API.
• Wikimedia Foundation (Wikidata) and Cloudflare (DNS lookups) — receive only the name of an organisation a message claims to be from and the address of that organisation’s official website, never your content.
• Google Web Risk (if enabled) — receives the web address being checked, to look it up in Google’s list of unsafe sites.
• Website and API gateway host (Netlify) — serves truststep.eu and, as a separate site, api.truststep.eu, which relays SMS-filter requests to the analysis service without storing them.
• Apple — App Store distribution and, if you subscribe to TrustStep, payment. TrustStep never receives your payment details.

Where providers process data outside the European Economic Area, appropriate safeguards such as the European Commission’s Standard Contractual Clauses are used.

5. Legal basis

Content you submit is processed to provide the check you requested (performance of a contract, Art. 6(1)(b) GDPR). Security logs and abuse prevention rely on our legitimate interest in operating a safe service (Art. 6(1)(f) GDPR).

6. Permissions

Camera (only while scanning a QR code), Photos (only the image you pick), Face ID (only if you turn on App Lock) and Calendar (only if you turn on Calendar Shield), Notifications (only if you turn on calendar alerts or Family Shield, or start a free trial, for the reminder before it ends) and Contacts (only the people you pick as trusted contacts) are requested when needed and can be revoked in iOS Settings at any time.

7. Children

TrustStep is not directed at children under 13 and does not knowingly process their data.

8. Your rights

You can access, correct, delete or restrict processing of your personal data, object to processing and lodge a complaint with a supervisory authority (in Luxembourg: the CNPD, cnpd.public.lu). Because the account is optional and TrustStep does not store submitted content, most data exists only on your iPhone, where you control it directly; if you created an account, you can delete it in Settings › Account. For any request, contact privacy@truststep.eu. For help with the app: support@truststep.eu.

9. Changes

We will update this page and the date above if this policy changes. Material changes will be highlighted in the app.

TrustStep provides decision support and does not guarantee that content is safe or that every fraud attempt will be detected.