Privacy Policy for the ob8 app

Last updated: 23 September 2026 · Deutsch (the German version prevails)

1. Controller

MH-Services GmbH, Gerasdorf bei Wien, Austria
Company register FN 657388y, Regional Court Korneuburg · VAT ID ATU82388612
Email: office@mh-services.eu · Legal notice: mh-services.eu/impressum

2. In short

• ob8 checks messages that you paste or share yourself for fraud.
• There is no account, no advertising, no tracking and no analytics in the app.
• We do not store the text of a message unless you explicitly send it to us as feedback (“Wrong assessment?”).
• The app reads images and screenshots on your iPhone. The image itself never leaves your device.

3. Checking a message

• Data: the text of the message you paste or share, or the text the app read from an image on your iPhone.
• Recipients: our server (Hetzner Online GmbH, data centre in Germany) and our AI provider TypeSafe (typesafe.ai), which computes the assessment.
• Purpose: assessing whether the message is a scam.
• Legal basis: your consent (Art. 6(1)(a) GDPR), which you give before your first check. You can withdraw it at any time in the app under Info → Privacy → Withdraw consent. If a message contains data of other people (e.g. a sender’s number or names), we rely on the legitimate interest in detecting and preventing fraud (Art. 6(1)(f) GDPR).
• Storage on our side: our server does not store the text. Operational logs contain only technical details (time, request ID, result, text length, app version), no content.
• TypeSafe: TypeSafe processes the text on our behalf. According to TypeSafe, inputs are not used to train AI models. TypeSafe does not disclose in detail how long it keeps inputs; according to its data processing agreement, for as long as necessary for the purpose. TypeSafe may process data outside the EU on the basis of the EU Standard Contractual Clauses in its data processing agreement.

4. Device registration and abuse protection

• On first launch, the app registers with our server using Apple’s App Attest and DeviceCheck services: Apple confirms that the request comes from the genuine ob8 app on a genuine iPhone. DeviceCheck remembers per device whether the free period has already been granted.
• What we store: a random device key (only as a hash on our side), the App Attest key ID, the time of registration and last use, start and end of the free period, and counters for usage limits. No name, phone number, email address or advertising ID.
• IP addresses are used only for an hourly limit on registrations, and only as a salted hash. We do not log them.
• Purpose and legal basis: providing the app with its free period and subscription (Art. 6(1)(b) GDPR) and protecting against abuse and disproportionate costs (Art. 6(1)(f) GDPR).
• Deletion: entries are deleted 12 months after last use unless a subscription is active.

5. Subscription

• Purchase and payment are handled entirely by Apple. We receive neither payment details nor your name.
• The app sends us the purchase receipt signed by Apple (product, transaction ID, term) so our server can verify the subscription. We store the expiry date and the original transaction ID.
• Legal basis: Art. 6(1)(b) GDPR. Deletion as in section 4.

6. “Wrong assessment?” feedback (optional)

• Only if you explicitly agree in the dialog do we store: the text of the message, our assessment, your assessment, the check’s request ID, the app version and the hash of the device key (to limit feedback).
• Purpose: testing and improving detection. For this, the text may be assessed again by TypeSafe, as in a check.
• Legal basis: your consent (Art. 6(1)(a) GDPR); for other people’s data in the message, Art. 6(1)(f) GDPR.
• Retention: at most 12 months.

7. Images, screenshots and links

• The app reads text from images on your iPhone (Apple Vision). The image is sent neither to us nor to TypeSafe.
• If you share an image of which only the address arrives, the app downloads it directly from there, but only image files and images from well-known image servers, without cookies.
• The app never opens other links; it only checks the address.

8. Notifications

The reminder before the free period ends is a local notification scheduled by your iPhone. No data is sent for it.

9. Recipients

• Hetzner Online GmbH, Germany: operation of our server (processor).
• TypeSafe: assessment of messages (processor, see section 3).
• Apple: App Attest, DeviceCheck, App Store and subscription. Apple processes data under its own privacy policy.

10. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR), and the right to withdraw consent at any time with effect for the future. Write to office@mh-services.eu. As we do not know you by name, we can only match data if you help us, for example with the time of a feedback.

You can lodge a complaint with the supervisory authority: Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

11. Changes

If the app or the law changes, we will update this policy. The version published here applies.