Thanks for using Project Protect. These terms are the agreement between you and us. We kept them as short and plain as we could, but please read them: using Project Protect means you agree to them.
Project Protect is operated by Keystone Protect Inc., [a Delaware corporation] ("Keystone Protect", "we", "us"). When we say "the service", we mean the Project Protect website (www.projectprotect.app), the Project Protect app on the web (my.projectprotect.app), the Project Protect mobile apps, and the emails and texts we send you. "You" means the person who holds a Project Protect account.
Project Protect is offered to NerdWallet members, but Keystone Protect is a separate company. These terms are between you and Keystone Protect only.
Our privacy policy explains what we collect, why, and who we share it with. It is part of these terms.
These terms limit our liability[ and ask you to settle disputes by individual arbitration instead of in court]. See Limits on our liability and Disputes and governing law.
These terms are in these sections:
- Who can use Project Protect
- Your account and signing in
- Texts and emails
- Connecting your accounts
- Price, coverage and claims
- Alerts, scam checks and Ward
- Identity monitoring and data broker removal
- Using Project Protect fairly
- Your information and our service
- Closing your account
- Changes to the service and these terms
- Uptime and security
- Limits on our liability
- Disputes and governing law
- Other things to know
Who can use Project Protect
- You must be 18 or older.
- You must live in the United States. If you give us a mobile number, it must be a US number.
- Project Protect is an early pilot, and you can join only with an invitation. An invitation is for the email address we sent it to. We can close invitations, or limit how many people join, at any time.
- One account per person, and it must be yours. Accounts made by bots or other automated means are not allowed.
Because this is a pilot, Project Protect will change often, and the pilot will end. If we end it, we will tell you [at least 30 days] before, and we will finish any claim you made before it ends.
Your account and signing in
- You sign in with a one-time code that we text or email you. A code works once and expires after 10 minutes.
- You are responsible for keeping your account secure. Anyone who can read your texts or your email can get a code and sign in as you, so keep your phone and your email account secure. If you think someone else has signed in to your account, email us right away at hello@projectprotect.app.
- You are responsible for what happens under your account. We are not responsible for a loss that happens because someone got into your phone or your email.
- Give us your real name and an email address you control, and keep them up to date. We use them to reach you about alerts and claims.
Texts and emails
When you sign in with your mobile number, we text you a one-time code. Those are the only texts we send, and you get one only when you ask for a code. Message and data rates may apply.
To stop texts, reply STOP[ to any of our texts]. After that, sign in with your email address instead. For help, reply HELP or email hello@projectprotect.app. Mobile carriers are not liable for delayed or undelivered messages.
We email you sign-in codes, and, unless you turn them off, alerts about your accounts and claims, a weekly summary every Monday, and news from Project Protect. You can turn off alerts, the weekly summary and news in your profile, and the weekly summary and news with the link in those emails too. Sign-in codes cannot be turned off, because you need them to sign in.
Connecting your accounts
We use Plaid Inc. ("Plaid") to connect your bank, card and loan accounts. You sign in to your bank through Plaid, so we never see or store your bank username or password. By connecting an account, you agree that Plaid can collect your information from your bank under the Plaid End User Privacy Policy.
- Only connect accounts that are yours, or that you have the right to share.
- Our access is read only. We can see your accounts, balances and transactions. We cannot move money, make payments or change anything at your bank.
- That also means we cannot lock a card, stop a charge or dispute it for you. You do that with your bank, and we help you prepare.
- Information from your bank can arrive late or contain mistakes. While a connection is broken, or your bank or Plaid is down, we do not see new transactions and cannot alert you about them.
- You can disconnect a bank at any time from your Accounts page.
Price, coverage and claims
Price
During the pilot, Project Protect is free, and every account gets membership. We do not charge you anything and do not ask for a card. If we start charging, we will tell you first, and you will choose whether to pay.
What coverage pays
Coverage comes with membership. It pays each claim minus a $100 co-pay, so a loss of $100 or less is not paid back. The co-pay is taken once per incident, however many charges or accounts it involves. There are no other fees, and nothing else comes out of what we pay.
- Fraud coverage, up to [$1,000,000][ a year], pays for charges on your connected accounts that you did not make or allow, money stolen when someone takes over one of your accounts, and [the costs of restoring your identity, documents and credit].
- Scam reimbursement, up to [$25,000] a year, pays for money you were tricked into sending, for example in an impersonation, romance or purchase scam.
When your bank or card company can give the money back, for example for a charge you did not make, or a scam you paid by card, you ask them first. Coverage pays what they do not give back.
Coverage does not pay for:
- losses from before your membership started
- losses on business accounts
- cash you handed over in person
- money your bank, card company or the merchant gives back
- a claim with false information or false proof
- [a loss reported more than 60 days after you noticed it]
- [other exclusions the coverage terms set]
How a claim works
You report a problem in the app and answer a few questions about what happened. What else we ask for depends on how much you lost and how many claims you have made. A smaller loss may need nothing more. A larger loss, or a repeat claim, needs proof, such as a police report, a report to the FBI's Internet Crime Complaint Center, or your bank's answer in writing. For the largest losses, one person on our team handles your claim from start to finish.
For some smaller losses, our rules approve the claim as soon as you send it. Otherwise, people on our team review the claim and decide whether it is covered and how much we pay. We tell you the decision in the app. [We send the payment to the bank account you connected.]
You agree to tell us if your bank, card company or the merchant gives you money back for a loss you have claimed.
When we pay you first
For some smaller scam losses, we pay you first and then go after the money ourselves. When we do, you agree to help us, for example by sending us what you have about the payment, and you let us pursue the money in your place. If you later get money back for the same loss from anyone else, you agree to pay us back what we paid you for it.
Alerts, scam checks and Ward
Project Protect looks for signs of fraud in your connected accounts, for scams in the messages you ask us to check, and for your details in data breaches and on the dark web. Our alerts, our scam check results and Ward's answers are our best judgment from the information we have. They are not guarantees.
- We can miss a fraudulent charge, and we can flag a charge that is fine.
- A scam check can find no signs of a scam in a message that is one, or call a real message suspicious.
- We flag charges. We do not block, stop or reverse them.
- We use artificial intelligence (AI) to screen charges, check messages and answer you in Ward. AI can be wrong, and it can sound sure when it is wrong.
- Ward gives general guidance. It is not a lawyer, an accountant or a financial adviser, and nothing it says is legal, tax, investment or financial advice.
You decide what to do. When the stakes are high, check with your bank or the company involved before you act, using contact details you already trust. If you think we got something wrong, tell us. On a scam check, press "Think we got this wrong?".
Identity monitoring and data broker removal
Monitoring starts when you create your account. We watch the details you gave us when you signed up for data breaches and for leaks on the dark web. You can add more details for us to watch, change them, or stop monitoring, from the Data removal tab in Protect.
A data broker is a company that collects and sells information about people. Data broker removal comes with membership. It starts once you have given us your name, date of birth and a US home address, which the broker sites need to find you.
By using data broker removal, you authorize Keystone Protect and our removal partner to act as your authorized agent: to search data broker sites for your information, and to ask them, on your behalf, to remove it and to stop selling or sharing it. We send them only the details they need to find you. If a broker asks for proof that we act for you, you agree that we can give it.
We cannot make a broker remove your information, and a broker can list it again later. While removal is on, we keep checking and ask again. Removal does not reach every site that lists people, and it does not change public records. You can stop removal at any time from the Data removal tab. Listings already removed stay removed. What happens to your details then is in our privacy policy.
Using Project Protect fairly
When you use Project Protect, you agree not to:
- use it to watch or look up someone else, or connect accounts or add details that are not yours to share
- make a false report or a false claim, give us false proof, or pretend to be someone else
- get around or interfere with our security, or try to get into accounts or systems you are not allowed into. To report a security issue, email [security@projectprotect.app]
- copy, sell, resell, scrape or reverse engineer any part of the service
- upload viruses or other harmful code, or put an undue load on the service
- harass, abuse or threaten anyone on our team
- break the law
If you do, we can close your account without notice.
Your information and our service
What you give us stays yours: your reports, the files you upload, your chats with Ward and the messages you ask us to check. You give us permission to use it only to provide the service to you, as our privacy policy describes. People on our team can see your account, your reports and your files when they help you or review a claim.
If you send us ideas or feedback, we can use them without owing you anything.
We and our licensors own the service, including its software, its design, and the Project Protect name and logo. Using the service does not give you any ownership of it. You may not copy or reuse any of it without our written permission.
Closing your account
You can close your account at any time. There is no button for it in the app yet. Until there is, email [privacy@projectprotect.app] and we will close it [within 30 days].
When your account is closed, we stop monitoring and removal, stop receiving information from your banks, and delete your information or make it unable to identify you, as our privacy policy describes. We finish any claim you made before you closed it, unless you ask us to stop.
We can suspend or close your account if you break these terms, if we reasonably suspect fraud or abuse, if the law requires it, or when the pilot ends. When we can, we tell you why first.
Changes to the service and these terms
We change Project Protect often, especially during the pilot. We can add, change or remove any part of it, for a while or for good.
We may update these terms. When we do, we change the date at the top. When a change is significant, we also tell you by email or in the app [at least 30 days] before it takes effect. If you keep using Project Protect after that, you agree to the new terms. If you do not agree, you can close your account. A change never reduces what we pay on a claim you made before it.
Uptime and security
You use the service at your own risk. We provide it "as is" and "as available". We work hard to keep it running, accurate and secure, but like any software it has bugs, and we do not promise that it will always be available, on time or free of errors, or that it will meet every need you have.
We protect your information with encryption and the other measures our privacy policy describes. No system is perfectly secure.
Limits on our liability
To the extent the law allows, Keystone Protect is not liable to you or to anyone else for any indirect, incidental, special, consequential, punitive or exemplary damages, or for lost profits, goodwill, use or data, resulting from:
- using the service, or not being able to use it
- an alert we sent or did not send, a scam check result, or anything Ward said
- someone getting into, or changing, your information without permission
- what someone else does or does not do, such as your bank, Plaid, a data broker or a scammer
- anything else to do with these terms or the service
This applies whatever the legal theory, including contract and tort (negligence included), and even if we were told the damage was possible.
Our total liability to you for anything to do with the service is limited to [$100]. This limit does not reduce what we pay on a covered claim. Some states do not allow some of these limits, so they may not all apply to you.
Disputes and governing law
If something goes wrong, tell us first at hello@projectprotect.app. Most problems can be sorted out that way. If we cannot sort it out within [60 days], either of us can take it further as described here.
These terms are governed by the laws of the State of [state], apart from its rules on which law applies.
[Option A, arbitration: Any dispute about the service or these terms will be settled by binding arbitration, one person at a time, under the consumer rules of [the American Arbitration Association], not in court. Either of us can still bring a claim in small claims court. You and we give up the right to a jury trial and to take part in a class action. You can opt out of arbitration within 30 days of first agreeing to these terms by emailing [address].]
[Option B, courts: Any dispute about the service or these terms will be heard in the state or federal courts in [county, state], and you and we agree to their jurisdiction. You can also bring a claim in small claims court where you live.]
Other things to know
- These terms and our privacy policy are the whole agreement between you and us about the service.
- If we do not enforce part of these terms at some point, we have not given up the right to enforce it later.
- If a court finds part of these terms cannot be enforced, the rest still apply.
- You cannot transfer your account or these terms to anyone else. We can transfer them if Keystone Protect is acquired or merges with another company.
- We send notices to the email address on your account. Send yours to hello@projectprotect.app or to Keystone Protect Inc., [mailing address].
Questions about these terms? Email hello@projectprotect.app.
Adapted from the Basecamp open-source policies / CC BY 4.0.