What we see, and what we never will.

Last updated 8 August 2026

Guardian reads the transactions on the cards you connect and tells you which of them went to gambling platforms. This page describes everything we collect, why, who else touches it, how long we keep it, and how you delete it.

The short version.

We read transactions on the accounts you connect, and nothing else. Your bank login goes to Plaid and never to us, and what we hold can only read. We do not sell your data, we do not run ads, there are no analytics or tracking SDKs in the app, and nothing from Guardian feeds the merchant intelligence Detect The Bet sells to banks. You can delete everything from Settings, immediately, without asking us.

1. What we collect

Transactions on the accounts you connect. Date, amount, the descriptor your bank sent, the merchant name where the bank provides one, the account it belongs to, and the institution. This is the core of the product and there is no version of it that works without this.
Your account details. The email address or phone number you sign in with, and your date of birth, which we ask for because the app is 18+ and we enforce that rather than assuming it.
A label you write. If you tell us a card belongs to someone in your household, we store the words you typed. Nothing is collected from that person, they have no account, and we never contact them.
A device token, if you turn notifications on, so we can send you alerts. Section 6 says where that token goes.
What you do inside the app, to the limited extent the product needs it: which findings you have opened or marked, your notification preference, and your settings.
A phone number for a second adult, if you invite one, used once to send them their invite.
Basic technical records created by operating the service, such as server logs and error records.

Under California law these fall into the categories of identifiers, commercial information, financial information, internet or app activity, and inferences. Financial information is the sensitive one, and we treat it that way.

2. Where it comes from

From you, when you sign up, write a label, or change a setting.
From your bank, through Plaid, after you connect an account and authorise it.
From your device, if you allow notifications.
From us, in the sense that the gambling classification attached to a transaction is our conclusion rather than something anybody sent us.

We do not buy personal information, and we do not receive it from data brokers, advertising networks, or social platforms.

3. What we never collect

Not messages, not location, not browsing history, not photos, not calls, not contacts, not app usage, and not anything at all from anybody's phone but your own. Guardian is not installed on anybody else's device and cannot be. There are no advertising identifiers, no third-party analytics SDKs, and no tracking pixels in the app.

4. Your bank login never reaches us

Connecting a card goes through Plaid Inc., which handles the login with your bank inside its own interface. We never see, receive or store your banking credentials.

What Plaid gives us is read-only. We request transaction data and nothing else. We did not request, and therefore cannot use, the permissions that would let us move money, read the account and routing numbers used to move it, or open, close or change anything about your account. That is a property of how the connection was built, not a policy we could quietly relax.

Plaid's own handling of your information is described at plaid.com/legal.

5. Why we use it

To identify gambling charges on the accounts you connected and show them to you.
To alert you when we find something, if you have notifications on.
To show you history and coverage, so you can tell what we did and did not review.
To keep your account secure, prevent abuse, and enforce our Terms.
To improve how well Guardian recognises gambling merchants, within the boundary in section 7.
To provide support when you write to us.
To meet legal, regulatory and recordkeeping obligations.

We process this information to provide a service you asked for, on the consent you gave when you connected an account, and to meet our legal obligations. We do not process it for advertising, because we do not advertise.

6. Who else touches it

We keep this list short on purpose, and we name every processor rather than describing them as a category:

Plaid Inc. Connects your bank and delivers transaction data. This is the only third party that receives your financial account data.
Supabase, which hosts our database and backend in the United States. Your data lives here, encrypted.
Expo and Apple, if you turn notifications on. Push is delivered through Expo's push service and then by Apple. They receive your device token and the text of the notification, which says how many new charges matched and can name one of the platforms. They do not receive your transactions. If you would rather that text did not travel, turn notifications off in Settings and the app will still show you everything when you open it.
Twilio, only if you invite a second adult, to send that one message to the number you gave us.
Apple, which operates the App Store and, if you ever subscribe, processes the payment. We never see your payment details.

Each is bound by contract to protect what we give them, to use it only to provide their service to us, and not to use it for their own purposes. We may also disclose information if the law requires it, to protect someone's safety, or in connection with a merger or sale of the business, in which case this policy continues to apply until you are told otherwise.

7. What we do not do with it

We never sell your data. We do not sell or share personal information as those terms are defined under California law, including for cross-context behavioural advertising, and we have not done so in the past twelve months. We do not share it with advertisers, data brokers, or analytics networks, and there is no advertising in Guardian.
Nothing from this app feeds anything we sell. Detect The Bet sells merchant intelligence to banks. That product is built from public and independently gathered sources. Your transactions are not part of it. This is a boundary in the system, enforced by which tables the code is allowed to read, rather than a promise about intent.
We do not use your data to train models sold to anyone else, and we do not send it to a third-party AI service.
We never contact the person named on a label. We have no way to. We hold the words you typed and nothing else about them.

8. How the analysis works

Guardian compares the descriptor your bank sent against a registry of gambling and gambling-adjacent merchants that we maintain, and applies rules about naming patterns. When it matches, we record what matched and how strongly, and the app shows you that reasoning rather than a bare verdict.

This is automated, and it is fallible. It produces an opinion about a charge, not a finding of fact about a person. It does not score anyone, does not build a behavioural profile of the person named on a label, and does not make any decision that produces a legal or similarly significant effect. Every decision that follows is yours. If you think we got a charge wrong, tell us and we will look at it.

9. The person you are watching for

This is the part most privacy policies get to describe simply and Guardian does not, so we will be exact about it.

Guardian shows you activity on your own account. Where a teenager in your household spends from a card you hold, their spending appears on your statement, and so it appears in Guardian. That means the app produces information about a person who is not you, and often about a minor.

We collect nothing from them. They have no account, install nothing, give us no information, and are never contacted by us. Everything we know that touches them arrived as a line on your bank statement.
The label is yours, not an identity. If you name a card after someone, we store the words you typed. We do not verify it, do not ask for their documents, and do not connect it to any other record of that person anywhere.
They are not profiled. We do not build a file on the person behind a label, and nothing about them leaves your account.
Deleting your account deletes them too. There is no residue, because there is no separate record.
What you do with what you learn is yours. We report; we do not advise. Laws about monitoring family members vary, and section 8 of the Terms covers your responsibilities there.

10. Children

Guardian is for adults. You must be 18 or older to use it, and the app enforces this rather than asking. Guardian is not directed to children, is not in the Kids Category, and collects nothing from a child: the person whose spending appears in the app does not have an account, does not install anything, and is never contacted by us.

Because no child ever registers, uses, or gives information to Guardian, we do not knowingly collect personal information from a child. If we learn that someone under 18 has created an account, we will close it and delete the information associated with it. If you believe that has happened, write to support@detecthebet.com.

11. Gambling data and health privacy laws

Some state laws, including Washington's My Health My Data Act, define consumer health data broadly enough that information about gambling behaviour may fall within it. We would rather address that directly than hope it does not apply.

Guardian does not diagnose anything. It does not assess whether anyone has a gambling disorder, does not measure severity, and is not a clinical tool.
We treat gambling findings as sensitive regardless of which label the law puts on them. They are visible to you, to a second adult only if you invite one and only for the one person you chose, and to nobody else.
We do not sell this information, to anyone, for any price. Where a law would permit a sale with your signed authorisation, we still do not do it, because we do not want the option.
We collect it only to provide the service you asked for, and you can delete it at any time from Settings.

12. What we cannot see

We cannot see cash, accounts you have not connected, or money moved inside an app we are not connected to. We do see money leaving a connected account, including money sent to another person, and the app says so on the screens that report what we found. Finding nothing is not proof that nothing happened.

13. How long we keep it

We keep each kind of information for as long as we have a stated reason to, and no longer. We do not set a single expiry across everything, because the reasons differ: the record of what we found is what the product is for, and the ordinary spending underneath it is not.

What	How long	Why
Transactions	While your account is open	History is the product. The app can only tell you what it did and did not review if it still holds the rows it reviewed.
Findings, and the record of what we reviewed	While your account is open	This is what we told you we found. Removing it would take back something you were shown and may be relying on.
Account details	While your account is open	To keep you signed in and to reach you.
Device token	Until notifications are turned off, or the device stops accepting them	A token for a device that no longer exists is deleted when we learn that.
Technical and error logs	A short operational window	To keep the service working and to investigate faults.
Records we are required to keep	As long as the law requires	Limited, and only where a legal or regulatory obligation applies.

In deciding how long is appropriate for anything not fixed above, we consider the amount, nature and sensitivity of the information, the harm that could come from it being seen by the wrong person, what we are using it for, and any legal or regulatory obligation that applies to it.

When information reaches the end of its period, or we no longer have a reason for it, we securely delete it.

Backups, stated plainly

When you delete something it is removed from the live service straight away, and you stop seeing it immediately. Encrypted backups of the database are kept for a short period so we can recover from a failure, and a deleted record can persist in those backups until they rotate, which is currently within 30 days. Backups are not used to serve the app, are not searchable, and a record removed from the live service is not restored to it. We say this because "deleted instantly, everywhere, including from disaster recovery" is not true of any service that keeps backups, and we would rather tell you what actually happens.

14. Deleting your data

In the app: Settings, then Delete my account. That disconnects every card at Plaid first, then permanently deletes your account and everything attached to it: transactions, findings, labels, notes and settings. It cannot be undone, and we cannot recover it for you afterwards.

It leaves the live service immediately. As section 13 explains, encrypted backups rotate within 30 days, and deleted records are not restored from them.

You can also disconnect a single card at any time from Settings, which stops us reading it while keeping what you have already been shown.

If you would rather we did it, write to support@detecthebet.com and we will action it and confirm when it is done.

15. Withdrawing consent

Disconnecting a card withdraws the permission you gave to read it. Deleting your account withdraws everything. Neither requires you to contact us, and neither is delayed.

16. Security

Data is encrypted in transit and at rest. Access to your data is scoped to your account at the database level, not merely in the app, so a bug in the interface cannot show you somebody else's findings. Bank access tokens are held server-side only and are never present on your phone. We maintain a written information security program appropriate to our size and the sensitivity of what we hold.

No system is perfectly secure, and we will not pretend otherwise. You are responsible for the security of your own sign-in and your own device.

17. Your privacy rights

Depending on where you live, you may have the right to know what we hold about you, to get a copy of it, to correct it, to delete it, to limit how sensitive information is used, and not to be discriminated against for exercising any of these.

Guardian is built so that most of these do not need our involvement. Everything we hold about you is visible in the app, and deletion is a button in Settings that works immediately. For anything else, write to support@detecthebet.com.

We verify a request by confirming control of the account, and respond within the time the applicable law allows, generally 45 days.
An authorised agent may make a request for you with proof that you permitted it.
If we refuse a request we will tell you why, and you may appeal by replying to that message. If we deny an appeal you may contact your state Attorney General.
We honour Global Privacy Control signals on our website. Since we do not sell or share personal information there is nothing for such a signal to switch off, but we recognise it rather than ignore it.

As a company handling financial information we are also subject to federal financial privacy rules, and we do not disclose your information to anyone for marketing purposes.

18. Where your data is processed

Guardian is operated from the United States, and your information is stored and processed in the United States by us and by the providers named in section 6. If you use Guardian from outside the United States, your information will be processed there, where privacy laws may differ from those where you live.

19. Changes

If this policy changes in a way that affects what we collect or who sees it, we will say so in the app rather than quietly updating this page, and we will change the date at the top.

20. Contact

support@detecthebet.com