Privacy

Spotter is a hackathon project running on the PayPal sandbox. No real money moves. Here is exactly what it keeps, and what goes where.

What Spotter stores

• From Log in with PayPal: your PayPal user id, your name and your email. Nothing else, and never your password.
• Your household: your first name, a scrambled version of your PIN (scrypt, never the PIN itself), the people you add and their limits.
• Payment requests and Spotter's decisions, including the text that was checked, so you can see why something was held.
• For a held or stopped payment, the case file: what each check found, and when a link was opened, a small screenshot of that page and the facts about it (where it ended up, what it asks for).
• For connected people and for you: the email address, Telegram chat or Discord user they paired from. For agents: a scrambled copy of their key.

What goes where

• Anthropic (Claude): the text being checked, with the payee and amount, for the scam check and the case file. Watchtower's assistant also uses Claude: it gets your question and the board's rows (names, amounts, outcomes, Spotter's reasons), never the scam messages themselves.
• KERNEL (cloud browser): when a held or stopped payment has a link or a shop page, that one address is opened in a throwaway browser that KERNEL runs, so nobody in the family has to click it. The browser has no cookies, logins or family data, and it's deleted after the visit. KERNEL keeps a recording of the visit for about a day; Spotter offers it for 23 hours. "Look at it safely" sends only your scrolls to a browser like that.
• Channel3 (real shop prices): the product name for price checks and price watches. A photo you check is sent to Channel3 to find the things in it; Spotter never stores the photo, only the answer from Channel3. For spot the difference, the shop page's screenshot is sent to find the same product.
• Telegram and Discord, only if you connect them: alerts (who, how much, to whom, and why) go through them, and messages you forward to the bot are checked like an email. Telegram and Discord can see those messages.
• PayPal (sandbox): the payments themselves. PayPal tells Spotter when it holds, pays or releases money. Agentboxd: forwarded emails arrive through it, and alert emails go out through it.
• Only your signed in household sees your data. Other households can't see or act on it. The Spotter network shares only a scrambled fingerprint of a payee, never names or messages.

How long

Demo families are deleted after 48 hours. To delete your household, leave a comment on Spotter's Devpost project page asking for it, and it is removed within a week. Comments there are public, so leave personal details out.