Privacy Policy

Effective July 23, 2026 · Astratic Technologies LLC, doing business as ViperAI ("Viper", "we")

Viper checks messages for scams, protects your family, and helps with everyday tasks. It's built to know as little about you as a tool like this can. This page says exactly what exists, where, and how to erase it — in plain language.

Using the free scam checker

You can check any message for scams at viperai.co with no sign-up. We create a random anonymous ID so the tool works — it carries no name, email, or phone number. When you paste a message to check, that text is sent to our server and to our model provider so it can analyze whether it's a scam and explain why. We use it only to answer you. We do not sell it, use it for advertising, use it to identify you, or use it to train AI models.

How long we keep it: we don't. The text you paste is processed in memory to produce your answer and is not saved to our database afterward. If the check flags a scam, the only thing our scam feed keeps is the web address (domain) of the scam site — the message text itself is never stored and never leaves the check. The two narrow exceptions, both described below: quality reports (a reply's text may be logged if it trips our safeguards) and phone numbers you explicitly report as scam callers.

Photos you check

When you check a photo, the image is sent to our server and analyzed in memory — its hidden content-credentials signature is read and a vision model looks for the tells of AI generation. The image is not saved. We keep no copy after the check completes, we never use it to identify anyone in it, and we never use it to train AI models. Don't upload photos containing information you wouldn't paste as text (account numbers, medical records).

Your account

The full app (iPhone and web) runs on an account. By default that account is the same kind of anonymous ID — no name or email needed. You may optionally add an email so your subscription and settings follow you across devices. It is never required and never used for marketing.

Your conversations & tasks

Your chat history lives on your device, not our servers — unless you turn on cross-device sync, which is end-to-end encrypted so only you can read it.
When you send a message or start a task, that message is transmitted to our server and relayed to our model provider (OpenRouter, Inc.) to generate the reply. It's processed for that purpose only, and is not used to build a profile of you or to train models.
Voice input, where supported, is transcribed by Apple's on-device speech recognition; audio is captured only while you hold the talk button.

Connecting Google (optional)

If — and only if — you connect a Google account, Viper requests exactly two permissions: manage your Google Calendar events and send Gmail on your behalf (emails are drafted for your approval; nothing sends without you). We do not access Google Drive, Docs, contacts, photos, or anything else. Your connection token is stored for your account only and can be revoked anytime in Settings, which deletes it.

What our server keeps

Usage counts against your ID, to enforce free and paid limits.
Subscription status if you subscribe — payments are handled by Apple (in-app) or Stripe (on the web); we never see your card details.
Memory — only if you turn it on: short facts you choose to share that Viper may reuse later. Off by default; nothing is kept while off; erased when you delete your account.
Your family safe word: on the website it stays on your device only. In the app, if you turn on family sync, it is shared with the members of your family so everyone knows the word — kept against your family account and never sold, shared outside your family, or used to identify you. If you never enable family sync, it stays on your device.
Optional items you enable — an email, a push token for alerts, a Google connection, address preference — each kept only while the feature is on.
Quality reports: if a reply trips our safeguards or you report it, that reply's text may be logged for review.

Protecting others from scams

To keep the scam checker sharp for everyone, we may keep a record that a particular website or link was flagged as a scam, and phone numbers that you explicitly report as scam callers go into the shared caller warning feed. These records are about the scam — never about you, and never tied to your identity.

What we never do

No selling of data, no advertising, no trackers, no analytics SDKs.
No reading of your contacts, photos, location, or anything else on your phone.
No training of AI models on your conversations or the messages you check.

Not for protected health information

Viper is a consumer tool and is not HIPAA-certified. Please don't paste medical records or other protected health information into it.

Deleting your data

Delete account in Settings erases your ID, usage counts, memory, connections, and preferences from our servers immediately and permanently, and clears the conversations stored on your device. Deleting the app removes the on-device history too. For the free checker, clearing your browser data removes the anonymous ID.

Third parties

Minimum surface: Supabase (backend hosting, US region), OpenRouter (model inference), Stripe (web payments), and Google (only if you connect it, for the calendar/email actions above). Apple processes in-app subscriptions under its own terms. Each receives only what's described here.

About the model step, plainly: OpenRouter is a router — it passes each request to a large-model provider to generate the answer and processes the content transiently under its privacy policy. We do not permit the content of your checks or conversations to be used to train models, and we do not store that content ourselves after answering (see above).

Children

Viper is rated for users 13 and up and is not directed at children.

Changes & contact

If this policy changes materially, the app will say so before the change applies. Questions: privacy@viperai.co.