Forward It exists to protect people, so we hold ourselves to the same standard we check others against. This page says what we collect, what we do with it, and what we never do — in plain English.
We only see what's forwarded to us. When someone forwards a text or email to their Forward It number or address, we analyse that message to give a verdict. We never have access to anything else on anyone's phone — not their other messages, contacts, photos, or location. Nothing is installed, so there's nothing else we could see.
After a check, we keep the verdict, the reasons for it, and a scrambled fingerprint (hash) of the message — not the message itself. Raw message content is deleted within 30 days; we keep it that long only so we can review mistakes when someone tells us a verdict was wrong. We keep the details you give us at sign-up: names, mobile numbers, and email addresses of your family members, and your billing details are held by Stripe, our payment provider — we never see card numbers.
Family members never see the content of anyone's messages. Alerts and the family view show only that a message was checked, when, and what we advised — for example, "Dad forwarded a scam this morning; we flagged it." What was actually in the message stays between the person who forwarded it and us.
A forwarded message often includes someone else's details — the sender's number, a name, an email address. We use those details only to check whether the message is a scam and to protect other families from the same scam (for example, adding a scam sender to a blocklist). We handle all personal information in line with the Australian Privacy Principles.
We never sell personal information. We never use your family's messages to advertise to you. We never share message content with family members, and we never claim to know things we can't observe — we can tell you we sent a warning; we can't tell you what someone did after reading it.
Only the services that make Forward It work: our SMS carrier (to send and receive texts), our email provider (to send and receive email), our payment provider Stripe, our AI provider (which phrases replies — the scam decision itself is made by our own system), and our hosting provider Cloudflare. Each receives only what it needs to do its job. If you report a scam, we pass the scam's details — never yours — to Scamwatch.
Reply STOP to any of our texts to stop receiving them. Ask us to delete your family's data at any time and we will, within 30 days. To ask anything about your data, email privacy@getforwardit.com.
Effective July 2026. If our practices change, this page changes first, and we'll tell account holders by email.