Privacy Policy

Welcome to PenipuMY. We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including our website and mobile application.

1. Information We Collect

Personal Information

When you create an account or use our services, we may collect:

• Account Information: Username, email address, password (encrypted)
• Profile Information: Display name, profile picture, user handle
• Authentication Data: Google OAuth tokens, Telegram user IDs (if using social login)
• Contact Information: Email address for communications

Scam Report Data

When you submit a scam report, we collect:

• Phone numbers, bank account numbers, and social media URLs of reported scammers
• Description of the scam incident
• Loss amount (if applicable)
• Evidence screenshots and documents
• Timestamp and IP address of submission

Mobile Application Data

When you use the PenipuMY mobile app, we may collect additional data to power our Community Shield protection features:

• Call Log Data: Incoming call numbers are checked against our scam database in real time to provide call screening alerts. Call content is never recorded or stored.
• Notification Access: With your permission, the app reads incoming call and message notifications to detect and alert you about potential scam contacts. Only the sender number/ID is processed; message content is not stored on our servers.
• Overlay Display: The app may display overlay alerts on top of other apps during incoming calls to warn you about known scam numbers.
• Device Information: App version, Android version, device model for crash reporting and compatibility.

Automatically Collected Information

• Usage Data: Search queries, pages viewed, features used
• Device Information: IP address, browser type, operating system
• Cookies: Session cookies for authentication and user preferences

2. How We Use Your Information

We use the collected information to:

• Provide and maintain our scam database and verification services
• Process and verify scam reports submitted by users
• Enable community collaboration and fraud prevention
• Communicate with you about your account and platform updates
• Improve our services and develop new features
• Prevent fraud, abuse, and illegal activities
• Comply with legal obligations and law enforcement requests

3. Information Sharing and Disclosure

Public Information

Certain information is publicly visible to protect the community:

• Scammer profiles (phone numbers, bank accounts, verified reports)
• Non-anonymous comments and community input
• Public statistics and aggregated data

Third-Party Services

We integrate with external verification services:

• SemakMule (PDRM): For police report verification
• Caller ID Services: We use multiple caller ID sources to identify phone number owners. Only phone numbers are shared with these services; no personal data from your account is transmitted.
• ToyyibPay: For processing FPX payments and user tipping on the web platform
• PayPal: For processing donations to the platform developer
• Google Play Billing: For processing PRO subscription purchases on the mobile app
• Meta Pixel (Facebook): We use Meta Pixel to measure the effectiveness of our advertising and understand how visitors use our site. Meta Pixel may use Automatic Advanced Matching, which shares hashed contact information (such as email address) you enter into forms with Meta, to help attribute ad conversions and improve remarketing. See Meta's Privacy Policy for details on how they handle this data.

Legal Requirements

We may disclose your information when required by law, legal process, or legitimate requests by public authorities.

4. Data Security

We implement industry-standard security measures to protect your data:

• Encrypted password storage using bcrypt hashing
• Secure HTTPS connections for all data transmission
• Regular security audits and updates
• Access controls and authentication mechanisms
• Cloudflare protection against DDoS and malicious traffic

5. Your Rights and Choices

You have the right to:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and personal data
• Opt-out: Unsubscribe from marketing communications
• Anonymous Posting: Choose to submit reports or comments anonymously

6. Mobile Application

Community Shield

Community Shield is an opt-in feature that helps protect the Malaysian community from scams. When you enable it, the app reads your phone contacts and uploads them to our server to cross-reference against our scam database. This improves scam detection accuracy for all users.

• Contact Access (READ_CONTACTS): Required to scan your contacts. Only phone numbers and contact names are processed; no other contact data (emails, addresses, photos) is collected.
• Uploaded contact data is used solely for scam cross-referencing and is not shared with third parties.
• You can enable or disable Community Shield at any time from the app.

Caller ID Lookup

The app provides a caller ID service that identifies unknown phone numbers. When you search a number or receive an unknown call:

• The phone number is sent to our server and queued for identification via multiple caller ID sources.
• Lookup results (caller name, carrier, spam status) are cached on our server to serve future lookups faster.
• Your lookup history is recorded for rate limiting purposes and automatically deleted after 30 days.

Scam Protection Features

The app also includes real-time scam protection features that require the following Android permissions:

• Call Screening (CallScreeningService): Checks incoming calls against our scam database before your phone rings.
• Notification Listener: Reads incoming call/message notifications to detect scam contacts. Only the sender number is processed.
• System Alert Window (Overlay): Displays a warning overlay during incoming calls from suspected scam numbers.

No call recordings, SMS content, or personal conversations are ever collected or stored.

PRO Subscription

The mobile app offers a PRO subscription with enhanced features. Subscriptions are billed through Google Play and subject to Google Play's terms. You can manage or cancel your subscription from Google Play settings at any time.

7. Data Retention

We retain your data for as long as necessary to provide our services and comply with legal obligations. Scam reports and profiles are retained indefinitely to maintain the integrity of our fraud database and protect the community.

8. Children's Privacy

PenipuMY is not intended for children under 13 years of age. We do not knowingly collect personal information from children.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

10. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: [email protected]