Scorpion Alert ("we", "us", "our") operates the website scorpionalert.com, the Scorpion Alert mobile apps for iOS and Android, the Scorpion Detector hardware, and the cloud monitoring service that powers the alerts (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, who else sees it, and the choices you have. By using the Service, you agree to the practices described here.
This is the second-most-important document we publish, after our Terms & Conditions. We've tried to keep it readable.
Information we collect
Information you give us when you sign up
To create an account, we collect your name, email address, and (if you sign in with Apple or Google) a unique identifier from that provider. If you sign in with Apple and choose to hide your email, Apple sends us a private-relay address that forwards mail to your real address — that's fine; we treat it the same way.
If you opt into SMS alerts, we collect a phone number for that purpose. You can change or remove it at any time in the app's notification settings.
When you set up a Detector, we collect the room or location name you assign to it, the postal code and country code you choose for the location, and any notification preferences you set (push, SMS, email, and whether to override silent mode for alerts).
Information your Scorpion Detectors send us
The Detector contains a small camera and a 365 nm UV light source. When the device sees the characteristic green fluorescence of a scorpion, it captures a still photograph and sends it to our cloud service over an encrypted (HTTPS) connection. We use this photograph to verify the detection with our AI verification model and to show it to you in the alert so you can confirm what we found.
Along with each photograph, the Detector sends technical metadata about the detection event: a confidence score, brightness and contrast measurements, a cluster pattern fingerprint, timestamps, the Detector's serial number and firmware version, its local IP address on your home network, and the name (SSID) of the Wi-Fi network it's connected to.
What the Detector does NOT capture or transmit:
- It does not record video or continuous footage. It captures a single still image only when a fluorescence event triggers.
- It does not record audio.
- The Wi-Fi password you provide during setup is stored only in encrypted flash memory on the Detector itself. It is not transmitted to our servers.
Information from your mobile app
When you use the app, we collect the push notification token (FCM on Android, APNs on iOS) so we can send you alerts, your device platform and OS version, the app version, and an app session token. Firebase, our authentication and messaging provider, also collects standard crash diagnostic data — function-level traces of unexpected app crashes, no personal content from inside the app.
Information from the website
When you visit the website, we collect standard server logs (IP address, user agent, referring URL, timestamps) and analytics events via Google Analytics 4. GA4 uses cookies to measure page views, session duration, and aggregate usage patterns. We have configured GA4 with IP anonymization enabled and do not share the data with Google for advertising purposes.
If you interact with our chatbot on the website, we record the conversation: your messages, the assistant's responses, the page you were on when you asked, and a snapshot of your recent browsing behavior on the site (page views, scroll depth, time on page, the campaign you arrived from). We use this to improve the assistant and to follow up if a question wasn't answered well.
Information from your payment
Our payment processor, Stripe, handles your card. We do not store your full card number on our servers; we store a customer reference, the last four digits of the card for your reference, the billing email, and the subscription metadata (plan, quantity, status, next billing date). At checkout for hardware delivery, Stripe also collects your shipping address; we receive a copy of that address so we can ship your Detectors.
How we use your information
- To operate the Service — sign you in, deliver alerts, ship hardware, manage your subscription, send transactional email about your account.
- To verify detections — every detection photo is sent to a cloud AI verification step (see the next section) before it becomes an alert in your app.
- To notify you — push notifications, SMS, and email when a Detector identifies a potential scorpion, when a Detector goes offline, and for transactional account events.
- To improve the Service — diagnose crashes, tune the detection models, and understand which features are used. See the section below on AI training for the specific case of detection photos.
- To communicate with you — transactional email about your account, subscription, or a safety-relevant product issue. We do not send marketing email without your opt-in.
- To run our internal operations — when you sign up or change your subscription, our system posts a notification to our internal Slack so we can spot issues early. The notification includes your name, email, and account status. It is visible only to Scorpion Alert staff.
- To comply with the law — respond to valid legal process, enforce our terms, and protect the rights and safety of our users.
Detection photos and AI verification
Detection photographs are the most-sensitive thing we hold for you, so we want to be specific.
How they're processed. When your Detector captures a photo, the image is sent over HTTPS to our cloud service. The image is then sent to OpenAI's Vision API for AI verification — OpenAI's model determines whether the photo contains a scorpion. The verification result and the photo are then attached to the detection event in your account, where you can view it in the app. Photos are served only to authenticated mobile app sessions.
Storage and retention. We store detection photographs alongside the corresponding event record. Today, photographs remain available in your account history for as long as the event itself remains in your account. If you delete an individual event in the app, the event record is removed; the photo file may still exist on our servers for a short period before our cleanup process removes it. We are working toward an explicit time-bound retention window and will update this policy when we have one to commit to.
Other people in the photo. Because the Detector captures a still photo when fluorescence triggers, it's possible — though unusual — for a person, a pet, or another moving object to appear in the frame. By placing a Detector in a location, you confirm that you have the right to monitor that location and that you are responsible for any applicable notice or consent obligations toward other people who may enter that area.
Using your photos to improve the AI model. By default, your detection photographs are used to train, fine-tune, and evaluate our AI verification models, in addition to verifying the specific event they came from. Improving the model lowers the false-positive rate and improves detection accuracy for every customer. By using the Service, you grant Scorpion Alert a worldwide, royalty-free license to store, process, and use your detection photographs for these purposes — until you tell us otherwise. You can opt out at any time by emailing support@scorpionalert.com with the subject line "AI training opt-out." Once we apply your opt-out, photographs captured by your Detectors after that point will not be used for training. We cannot retroactively remove the contribution of any photograph from a model that was already trained on it.
Third-party services
We use a small number of third parties to run the Service. Each has its own privacy policy:
- Stripe — handles your payment. We receive a customer reference, the last four digits of your card, the billing email, and subscription metadata. We do not see your full card number.
- Firebase (a Google service) — authentication, push notifications, and crash diagnostics for the mobile app.
- Sign in with Apple — optional authentication provider. If you use Apple's email-relay feature, your real email is hidden from us.
- OpenAI — powers two parts of the Service: (1) the AI Vision verification step that confirms whether a Detector image contains a scorpion, and (2) the AI chatbot on our website. OpenAI processes the data we send for those purposes; per their enterprise data policy, content sent to their API is not used to train OpenAI's general models.
- Google Analytics 4 — website analytics.
- Slack — receives internal notifications about new signups and subscription changes. The notifications include your name, email, and account status. They are visible only to Scorpion Alert staff.
- Cloudflare — hosts our website and serves it through their global CDN.
- App Store platforms — Apple App Store and Google Play manage the distribution and update flow for the mobile app.
We do not sell or rent your personal information to anyone, and we do not share it for cross-context behavioral advertising.
Cookies and similar technologies
The website uses a small number of first-party cookies and browser localStorage entries to keep you signed in (sar_email, checkoutid, aidToken) and remember your preferences (sar_quantity, sar_display_name, sar_photo_url). Google Analytics sets its own cookies (_ga, _ga_*) for visit measurement. We do not use cross-site tracking pixels or advertising retargeting cookies.
If you block or delete cookies, the site will still work, but we won't be able to remember your session across visits.
Data retention
Different categories of data are kept for different lengths of time:
- Account information (your profile, locations, Detector configuration) — for as long as your account is active.
- Detection events and their photographs — for as long as the corresponding event remains in your account history. See the Detection photos section above.
- Push notification tokens — for as long as the device is registered with your account.
- Subscription and billing records — retained per the requirements that apply to financial records, typically several years, in accordance with Stripe's policies.
- Server logs — up to 30 days, unless extended for security or compliance reasons.
- Website chat conversations and behavior events — retained for ongoing improvement of the chat assistant. We are working toward a time-bound retention policy here too.
Your choices and rights
- Access and correction. You can view and update your profile, notification preferences, and Detector configuration from the app. For anything the app doesn't expose, email us and we'll help.
- Portability. We'll provide a copy of your account data on request.
- Deletion. You can request that we delete your account and associated personal information by emailing support@scorpionalert.com. When we process a deletion, we remove your user record, account, locations, Detector records, detection events, AI prompt and response logs, push notification tokens, and app sessions. Some related data may persist for a limited period: your record at our payment processor (Stripe) is retained per Stripe's own policies, separate authentication identities (e.g., your Firebase Auth login) are deleted via your Google or Apple account settings, our internal Slack notifications are not retroactively deleted, and our website chat history may persist linked to a browser visitor identifier rather than to your now-deleted account. We are actively working to extend the deletion process to those areas where it is technically possible.
- AI training opt-out. By default, your detection photographs are used to improve our AI verification model. To opt out of this use for future captures, email support@scorpionalert.com with the subject line "AI training opt-out." Photographs captured before your opt-out may already have contributed to a trained model and cannot be retroactively removed.
- Notification preferences. You can disable push, SMS, or email alerts in the app at any time.
- Opt out of analytics. For the website, the Google Analytics opt-out add-on disables GA4 in your browser.
- California residents (CCPA/CPRA). You have the right to know what we collect, to correct it, to delete it, to limit the use of sensitive personal information, and to opt out of "sale" or "sharing." We do not sell your information and do not share it for cross-context behavioral advertising, so the sale/sharing opt-out is a no-op for us — but the right is available on request. To exercise any California right, email support@scorpionalert.com with the words "California Privacy Request" in the subject. We may need to verify your identity before responding.
Security
We use HTTPS for the website, the mobile app's traffic to our servers, and the Detector's traffic to our servers. The Detector pins our root certificate, so a tampered network can't impersonate our backend.
Detection photographs are served only to authenticated mobile app sessions. We follow the principle of least privilege for internal access.
No online service is perfectly secure. If you spot a vulnerability, please report it to support@scorpionalert.com and we'll respond quickly.
Children's privacy
The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it.
International users
The Service is intended for use by individuals in the United States. We host data on infrastructure located in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States.
Changes to this policy
When we make material changes, we'll update the "Last updated" date at the top of this page and, for logged-in users, surface a notice in the app the next time you open it. Older versions are available on request.
Contact us
Questions about this policy, or requests to exercise your rights:
Scorpion Alert
Email: support@scorpionalert.com
This policy is provided for transparency. It is not legal advice. If you need a binding interpretation of your rights under a specific law, consult a licensed attorney in your jurisdiction.
