Your data is yours. This policy explains what we collect, why we collect it, who we share it with, and what you can do about it. We never sell your personal information, and we never use it for advertising.
Project Protect is operated by Keystone Protect Inc. ("Keystone Protect", "we", "us"). This policy covers the Project Protect website (www.projectprotect.app), the Project Protect app on the web (my.projectprotect.app), the Project Protect mobile apps, and the emails and texts we send you. Together we call these "the service".
Project Protect is offered to NerdWallet members, but Keystone Protect is a separate company. NerdWallet's privacy policy does not cover the service, and we do not share your Project Protect data with NerdWallet.
This policy is in these sections:
- What we collect and why
- Information we get from others
- Connected accounts and Plaid
- How we use AI
- Who we share your information with
- Cookies and analytics
- How long we keep your information
- How we protect your information
- Your choices and rights
- Children
- Where your information is stored
- Changes and questions
What we collect and why
Our rule is to collect only what we need to protect you. Here is what that means in practice.
Your account
When you sign up, we ask for your first and last name and your email address, and we confirm your email address with a one-time code. If you sign in with your mobile phone number, we confirm it the same way. We use these to create your account, to sign you in, to send you alerts, and to reach you about a case.
When you agree to receive texts, we keep a record of that agreement: your phone number, the words you agreed to, the date and time, and the IP address you used. The law requires us to be able to show that you agreed.
We keep a record of your email settings, such as whether you want email alerts, a weekly roundup and news from Project Protect.
If you were invited to Project Protect, we keep the email address the invitation went to and when you accepted it.
Your free scan
When you sign up, we run a free scan. We send the email address you signed up with, or your phone number if you signed up with it, to our identity protection partner, which checks it against records of data breaches. If your phone number turns up in a breach next to another email address, we may check that address too, and we show it to you only partly hidden.
We keep the results: which breaches you were found in, when they happened and what kinds of information they exposed. If a breach exposed a password, we keep only a masked version of it, never the password itself.
Your connected accounts
When you connect a bank, card or loan account, we receive information about that account and its transactions. Connected accounts and Plaid explains this in full.
Identity protection
Identity monitoring starts when you create your account. We watch the details you gave us when you signed up (your name, your email address and, if you gave it, your phone number) for data breaches and leaks on the dark web. You can add more for us to monitor: a middle name, your date of birth, up to two home addresses, and more email addresses and phone numbers. We don't ask for your Social Security number.
If you're a member, we also ask data broker sites to remove your information. A data broker is a company that collects and sells information about people. Removal starts once we have your date of birth and home address, which the broker sites need to find you. Our partner searches the broker sites and sends removal requests for you. When you look at a broker site in the app, we show what it lists about you; we fetch that from our partner each time and don't store it.
We use these details only to search for your information in data breaches, on the dark web and on data broker sites, and to ask data brokers to remove it. We encrypt these details before we store them.
You can turn off identity monitoring at any time. When you do, we stop using these details and ask our partner to delete them. If data broker removal is still running, our partner keeps what removal needs until removal stops. We keep the record of breaches we already found, because they are part of your history with us.
Reports, cases and claims
When you report a problem, such as a charge you do not recognize or a scam, we keep what you tell us: the charges involved, your answers to our questions, any notes, and any files you upload as evidence, such as screenshots or statements. We use this to work your case, to help you dispute a charge with your bank, and to review a reimbursement claim. Our staff can see your case so that they can help you, and they can add their own notes to it. We record each time a staff member opens a file you uploaded.
Scam checks
When you ask us to check a text message, an email or a screenshot, we keep the message so that you can see it again and so that we can review a result you think is wrong. We store the message separately from the rest of your account. We also keep the result, for example the verdict and the web domains we found in the message.
Ward, our security assistant
When you chat with Ward, we keep your messages and Ward's replies so that you can come back to the conversation. Do not put passwords, one-time codes or full card numbers in a chat. Ward never asks for them.
Questionnaires and surveys
If you answer a questionnaire or a survey, we keep your answers. We use them to improve the service.
How you use the service
We collect information about how you use the service, such as the pages and screens you visit, the buttons you press, errors you hit, your device and browser type, and your IP address. We use it to keep the service working, to fix problems, and to decide what to improve. On the web, we also record some sessions so that we can see where people get stuck. These recordings hide everything you type and all text on the screen.
When you contact us
When you email us or ask for help, we keep the conversation and your contact details so that we have the history if you contact us again.
Information we get from others
Besides what you give us, we receive information about you from:
- Your banks and card companies, through Plaid, when you connect an account. The next section explains what.
- Our identity protection partner: the data breaches and dark web leaks your details turn up in, and what data broker sites list about you.
- Whoever invited you: the email address we sent your invitation to.
Connected accounts and Plaid
We use Plaid Inc. ("Plaid") to connect your accounts. When you connect an account, you choose your bank and sign in through Plaid. We never see or store your bank username or password. By connecting an account, you agree that Plaid can collect your information from your bank under the Plaid End User Privacy Policy.
From the accounts you choose to connect, we receive:
- the account name, type and the last few digits of the account number (never the full account number)
- balances and, for cards and loans, the credit limit and other account details
- transactions: the amount, date, merchant or payee, description and category
We use this information to show you your accounts and activity in one place, to look for charges that might be fraud or a scam, to alert you, and to fill in the details when you report a charge. Our access is read only. We cannot move money, make payments or change anything at your bank.
You can disconnect a bank at any time from your Accounts page. When you do, we tell Plaid to stop sharing that bank's data with us, and we stop receiving new transactions. We keep the accounts and transactions we already received, because a case or claim can depend on them. To have them deleted, ask us (see Your choices and rights).
How we use AI
We use artificial intelligence (AI) in three places:
- To screen charges. Our rules look at each new charge. When a charge looks risky, an AI model can review it and help decide whether to alert you. The model also writes a short summary of your usual spending, such as the payees you pay regularly, to help it judge new charges.
- To answer you in Ward. When you chat with Ward, an AI model writes the replies.
- To check messages. When you ask for a scam check, an AI model reads the message and gives a verdict.
The AI model is Claude, made by Anthropic. It runs inside Amazon Web Services (AWS), through a service called Amazon Bedrock, so the information we send it goes to AWS and not to Anthropic. When we send information to the model, we do not include your name, email address, phone number or any account number, unless you wrote them into a chat message or a message you asked us to check. We do send what the model needs to do its job, such as the charges involved, a summary of your accounts and recent activity, your chat messages, or the message you asked us to check. Under AWS's terms, this information is not used to train AI models.
AI can make mistakes. An alert or a verdict is our best judgment, not a final decision. For some smaller claims, our rules approve the claim as soon as you send it. People on our team review every other claim before we make a decision about it. If you think we got something wrong, tell us. On a scam check, you can press "Think we got this wrong?".
Who we share your information with
We share your information only to run the service, at your direction, or when the law requires it.
Service providers. We use other companies to run the service for us. They can use your information only to do that work for us, and our contracts require them to protect it.
| Provider | What they do for us | What they receive |
|---|---|---|
| Plaid | Connects your accounts | The connection to your accounts, see above |
| Amazon Web Services | Hosts the service and our data, and runs the AI model (Claude, made by Anthropic) through Amazon Bedrock | All the data the service stores, and what we send the AI model as described in "How we use AI" |
| Twilio | Sends our texts and emails | Your phone number, email address, first name and the content of each message |
| Iris, powered by Generali | The free scan, identity monitoring, dark web monitoring and data broker removal | Your name, email address and phone number from your account, and the identity details you add for these services |
| PostHog | Product analytics, session recordings and error reports | How you use the service, your email address and an account ID |
| Google Fonts | Fonts on our website | Your IP address, when you visit www.projectprotect.app |
At your direction. When you ask us to, we share information to help you, for example with the bank you connect through Plaid.
When the law requires it. We disclose information when a valid legal process requires it, such as a subpoena, court order or warrant. When the law allows, we tell you before we disclose your data. We can also disclose information when we believe it is necessary to prevent fraud or to protect someone's safety.
If the company changes hands. If Keystone Protect is acquired or merges with another company, your information can be transferred as part of that deal. We will tell you before your information becomes subject to a different privacy policy.
De-identified data. We can use data that cannot identify you, such as totals across many members, to improve the service and to report on how it is doing.
We do not sell your personal information, and we do not share it for targeted advertising. We do not use advertising pixels or advertising cookies.
Cookies and analytics
A cookie is a small piece of text that a website stores in your browser.
On my.projectprotect.app we use:
- Sign-in cookies (keystone.auth and keystone.refresh). These keep you signed in, and the app does not work without them. keystone.auth lasts 15 minutes and is renewed while you use the app. keystone.refresh does the renewing, and lasts until you sign out or go 90 days without using the app.
- Analytics cookies and local storage from PostHog, to understand how the service is used, as described above.
- Local and session storage in your browser to remember small settings, such as whether the sidebar is open, and to finish connecting an account.
Our mobile apps store your sign-in in your device's secure storage.
Our website www.projectprotect.app does not set cookies and does not use analytics. It loads its fonts from Google Fonts, so Google receives your IP address when you visit.
You can block or delete cookies in your browser settings, but the app will not work without the sign-in cookies.
How long we keep your information
We keep your information while your account is open and for as long as we need it to provide the service, to work a case or claim, to resolve disputes, and to meet our legal obligations.
- Account, connected-account and case information: while your account is open, including accounts you have disconnected and their transactions. When you close your account, we delete it or make it unable to identify you within [60 days], except for records that we must keep for a claim, a dispute, fraud prevention or the law.
- Free scan results and breaches we found: while your account is open.
- Identity protection details: we stop using them when you turn off identity monitoring, and our partner deletes them. We keep our encrypted copy until you close your account.
- Scam check messages and Ward conversations: while your account is open.
- Text message consent records: [for as long as the law requires us to be able to show your consent].
- System logs: 90 days.
- Backups: our database backups are kept for 14 days, so deleted information can stay in a backup until that backup expires.
How we protect your information
We use industry-standard protections:
- All connections to the service use encryption (TLS 1.2 or later).
- Our database, its backups and our file storage are encrypted at rest.
- The credentials that connect us to your accounts through Plaid, and the identity details you give us, have a second layer of encryption.
- One-time codes and sign-in tokens are stored only in a form that cannot be reversed.
- Staff access to member data is limited to the people who need it to help you, and we record when staff open evidence files.
No system is perfectly secure. If a security incident affects your information, we will tell you as the law requires. To report a security issue, email [security@projectprotect.app].
Your choices and rights
You can:
- See and correct your information. Most of it is in your account and settings.
- Disconnect a bank at any time from your Accounts page.
- Turn off identity monitoring at any time, from the Data removal tab in Protect.
- Turn off email alerts, the weekly roundup and news from Project Protect in your settings or with the link in any of those emails.
- Stop texts [by replying STOP]. We only text you sign-in codes, so after that you sign in with your email address instead.
- Ask for a copy of your information.
- Ask us to close your account and delete your information.
To ask for a copy, a correction, deletion or to close your account, email [privacy@projectprotect.app]. We answer within [45 days]. Before we act on a request, we confirm that it came from you, usually with a code sent to the phone or email on your account. If someone else makes a request for you, we need your signed permission.
Depending on where you live, state law can give you more rights, such as the right to appeal our answer to your request. We give these rights to every member, wherever they live. We will not treat you differently because you used a privacy right.
Some information we cannot delete right away, for example records of an open case or claim, or records the law requires us to keep. When that happens, we tell you what we kept and why.
Children
The service is for adults. You must be 18 or older to use it. We do not knowingly collect information from anyone under 18. If you think a child has given us information, email [privacy@projectprotect.app] and we will delete it.
Where your information is stored
Keystone Protect is a US company. The service is for people who live in the United States, and we store your information in the United States. Our identity protection partner processes the identity details you give it in Europe. When information leaves the United States, we require the partner to protect it as this policy describes.
Changes and questions
We update this policy when our practices or the law change. When we make a change, we update the date at the top. When the change is significant, we also tell you by email or in the app before it takes effect.
Questions about this policy or your information? Email [privacy@projectprotect.app] or write to Keystone Protect Inc., [mailing address].
Adapted from the Basecamp open-source policies / CC BY 4.0.