Privacy Policy

For the Scam Case Files mobile app on iOS and Android (com.terwi.scamcase).
Effective 14 August 2026 · Last updated 14 August 2026

The short version. Scam Case Files collects no personal information about you. It has no accounts, no advertising and no trackers. Playing is entirely offline: a case needs no internet connection at all. The app uses the network for two things only — checking a store purchase, and sending anonymous play statistics: counts of gameplay events tied to a random install identifier, never to your name or to anything on your real phone. Your progress stays in the app's own storage on your device. I run no server of my own; those two services are the only places anything ever goes.

The part people ask about first

This is a game about scams, so it is worth stating plainly: the app never reads your real messages, emails, calls, contacts, photos, accounts or transactions. The phone you investigate in the game is an invented one, built from a case file bundled inside the app. It is not your phone, it is not connected to your phone, and it never becomes your phone.

The app cannot access those things even if it wanted to: it declares no permission that would let it ask for them. The only things it ever sends anywhere are a store purchase check and the anonymous play statistics described below — see Purchases, Analytics and what makes this verifiable.

Who this is from

Scam Case Files is made by Motaz Tarawneh ("I", "me"), an independent developer. Contact for any privacy question: motaz.tarawneh@gmail.com.

What the app stores on your device

To let you close a case and come back to it, the app saves your play state in its own private storage, using the operating system's standard per-app preference store:

Case progress — which case you are in, which items you have opened, which evidence you have pinned, where you assigned it on the Scam Chain, which contradictions you confirmed or refused, which decisions you made, which hints you used, and the score and ending you reached.
Your settings — sound, haptics, and the two reduce-motion switches.
Your purchase entitlement — whether this device owns the Starter Case Pack. Deliberately kept when you reset progress.
A random install identifier — a meaningless string generated the first time the app runs, kept so the play statistics described below can count one installation once rather than many times. It identifies an installation of the app, not you.

That is the complete list. None of it is personal information about you, and none of it is readable by other apps. Only the install identifier ever leaves the device, attached to the anonymous play statistics described below; everything else is gameplay state about invented people and is never transmitted to anyone.

What is collected about you

No personal information. Scam Case Files does not ask you to create an account or sign in; does not collect your name, email address, phone number or location; and does not collect device identifiers, advertising IDs, or an IDFA. It does not ask for App Tracking Transparency permission, because nothing in it tracks you across apps or sites.

What it does collect is anonymous play statistics — which gameplay events happened, in which case, on which version of the app — keyed to the random install identifier above. The Analytics section explains exactly what an event can and cannot contain.

There is no profiling, no automated decision-making about you, and nothing is ever sold or shared for advertising.

What makes this verifiable

Claims like the ones above are easy to write and worth checking. Four things in the build back them up:

No permission can reach your content: The Android release manifest declares INTERNET, which the app needs to check a store purchase and send its play statistics, and the store and billing libraries add three more of their own: network-state, Play billing, and a private signature-level one used internally by an Android support library. You can confirm the list yourself by running aapt dump permissions on the published package. Not one of them grants access to messages, contacts, photos, the camera, the microphone, location or your accounts — those require permissions this app does not declare and cannot request.
On iOS, one usage-description key — never used: Apple requires an app to carry a purpose string before it is allowed to ask for something like the microphone. This app declares exactly one, NSMicrophoneUsageDescription, and never asks. It is there because the audio library that plays the bundled voice notes ships a recording code path this app does not call, and Apple requires the string whenever that code is present in the binary at all, whether or not it ever runs. The check that settles it is one you can run yourself: iOS shows a permission prompt the first time an app actually requests access, and this app never shows one, because it contains no recording feature. No other usage-description key exists in the app, so the camera, contacts, photos, location and your accounts cannot be asked for at all.
Analytics is allow-listed at the source: Every event the app can send is drawn from a fixed internal vocabulary, and every value attached to one is checked against an allow-list inside the app before it is sent — message text, names, financial details and anything you type are not on the list and cannot leave the device. The enforcement lives in the app itself, not in a server's good behaviour.
Case content is data, not code: Every case ships as a data file inside the app and is read, never executed. There is no mechanism for a case to fetch anything, run anything, or reach off the device.

Voice notes and audio

Some messages in a case carry a short voice clip. Those clips are audio files bundled inside the app and played locally. Nothing is streamed, nothing is downloaded, and nothing is recorded — the app has no recording feature and never requests microphone access. (It does carry a microphone purpose string, which it never uses; what makes this verifiable explains why.) Every voice note also carries a written transcript, so the case reads identically with sound off.

Sharing a result

At the end of a case you can tap Share the result. That hands a short block of text — the case title, your rank and score — to your device's own share sheet, and you choose where it goes. If no share target is available it is copied to your clipboard instead. Nothing is sent to me at any point, and nothing is shared unless you tap that button.

Purchases

The Starter Case Pack is a one-time in-app purchase handled entirely by the App Store or Google Play. The payment itself is a transaction between you and Apple or Google under their own privacy policies: your card details, billing address and store account are never visible to this app. What the app receives back is a single fact — whether this device owns the pack — which it stores locally.

Purchases are validated through RevenueCat, which acts as the app's purchase-validation service. It receives only the store's own receipt and an anonymous app-generated identifier — never your name, email address or payment details, and nothing about how you play. Checking whether this device already owns the pack, and validating a purchase or a restore, are the app's only network requests apart from the analytics described next.

Analytics

This version sends anonymous play statistics to Statsig, an analytics service, so I can see which cases are played, where players stop, and whether the app is working — the minimum needed to improve the game.

An event carries its name (such as "case started"), a small set of allow-listed values such as a case id or a score band, the random install identifier, a per-launch session id, the app version and the platform it runs on. Like any internet service, Statsig's servers can see the network address a request arrives from. Events are processed on my behalf by Statsig, Inc. under its own privacy and security commitments.

An event can never carry message text, names, email addresses, financial details, anything you type, or anything from your real phone. The statistics are keyed to the install identifier, not to you: neither I nor Statsig can connect them to your name, your store account or your device's advertising identity.

Your operating system's own features

Two things sit outside the app and are worth naming plainly, because they are governed by Apple's and Google's policies rather than mine:

Device backups: If you have iCloud Backup or Google's backup switched on, your device's own backup may include this app's saved progress along with the rest of your apps. That is your operating system's service. I have no access to it, and you can exclude or delete it through your device's settings.
The app stores themselves: Downloading and updating the app is a transaction between you and your app store, which collects its own data under its own policy. I receive only the aggregate, anonymous sales and download figures that the stores publish to every developer, and these cannot identify you.

Children

Scam Case Files deals with fraud, financial loss and emotional manipulation, and is intended for players aged 16 and over. It knowingly collects no personal information from anyone, including children; the anonymous play statistics described above identify no person of any age. If you have a concern, please write to me.

Deleting your data

Everything the app stores is under your direct control on your own device:

Settings → Reset all case progress erases every case's play state and returns each case to the beginning. Your purchase is kept, so a reset never costs you what you paid for.
Deleting the app removes everything on the device at once, including the install identifier — after that, nothing can connect any past statistic to this installation. No copy of your progress exists anywhere else.

Your rights

Privacy laws such as the GDPR (Europe and the UK) and the CCPA (California) give you rights to access, correct, port, delete and restrict the processing of your personal data, and to object to it.

I hold no personal data about you. The only data held at all is the anonymous play statistics described above, and neither I nor Statsig can tell which of them came from you, so there is no profile to hand over, correct or erase. You are still welcome to contact me with a question or a complaint, and if you are in the EEA or UK you have the right to complain to your local data protection authority.

Data breaches

There is no account system and no database of personal information. The only thing held off your device is the anonymous play statistics described above, hosted by Statsig; a breach of those would expose gameplay counts keyed to random identifiers, not names, messages or payment details. Everything else lives on your own device, where a passcode and device encryption are what protect it.

Changes to this policy

Changes are described here rather than quietly made. Since this policy was first published, one change has been made, in this version: purchases are validated through RevenueCat, and anonymous play statistics are collected through Statsig — both described above. If the app ever gains a feature that changes this policy again — accounts, cloud sync, or online cases — it will be updated and re-dated before that version is released. The date at the top of this page always reflects the current version.

Contact

motaz.tarawneh@gmail.com