Privacy Policy

TL;DR: You upload evidence of scams. We extract the accounts scammers use and send the evidence to the platforms, financial institutions, and law enforcement that can act on it. We don’t make reports public, we don’t sell your personal information, we don’t include your account details in the reports we send to institutions, and we strip personally identifying metadata from images you upload.

Who we are

Quarry Intelligence Inc. (“we”) operates quarry.fyi (“Quarry”) and is responsible for the personal data described here (the “controller”). Contact details are at the end of this policy.

What we collect

• Account information: your email address, your Reddit username (invitations go through Reddit, and we link the username to your account), and your name if you choose to give it. An email is required to create an account.
• Reports: the evidence you upload, and the scam account identifiers we extract from it (such as phone numbers, social media accounts, bank accounts, and crypto wallets). Evidence may contain information about you, scammers, and other people, including victims and people whose accounts were taken over or handed over to scammers. We don’t seek sensitive information, but if evidence contains it, we process it only as needed to prevent and detect fraud. We remove personally identifying image metadata on upload. We don’t use facial recognition or collect biometric identifiers.
• Technical information: IP address, browser and device type, request logs, and page-view analytics.

How we use it and our legal basis

Reports describe suspected crimes. We process that information only to prevent and detect fraud and other unlawful acts, as permitted by law. We may use automated tools and service providers to extract identifiers.

Who we share it with

• Institutions that can act on scam activity: platforms, financial institutions, payment and telecom providers, anti-fraud organizations, and law enforcement. We share reports and the identifiers we extract from them, individually or in aggregate (for example, lists of email addresses or phone numbers used by scammers), with the institutions we believe can act on them. We may receive compensation from institutions for reports. Once an institution receives information, its own policies apply.
• Not your account details. The reports we send to institutions don’t include your email or other account information. We disclose your account information only as described in the rest of this section. Evidence may show your own details unless you redact them.
• Service providers that run Quarry for us: Clerk (accounts), Vercel (hosting and analytics), Supabase (database and storage), and providers of content-safety scanning and automated analysis, including LLMs, that help us extract identifiers and detect prohibited content.
• NCMEC and law enforcement, as required by law, if we find child sexual exploitation material.
• Legal and safety: to comply with law, subpoenas, or court orders; to enforce our Terms; to protect our rights and safety and those of our users or others; and with our professional advisors.
• A successor if we merge, are acquired, or sell our assets.
• Aggregated or de-identified information that can’t reasonably be used to identify anyone.

We don’t sell reporters’ personal information, and we don’t make reports public.

If you appear in a report

We received your information from a Quarry user. Appearing in a report doesn’t mean you’re accused of wrongdoing; many identifiers belong to people who were impersonated or whose accounts were misused. We don’t make reports public and we don’t decide whether an identifier belongs to a scammer; the institutions that receive reports make their own decisions. We generally don’t notify people individually, because that could undermine fraud prevention. If you think a report includes your information in error, contact us; we’ll review our records, but we can’t reverse decisions institutions have made.

Cookies and analytics

We use only essential cookies to keep you signed in. Our analytics don’t use cookies. We don’t track you across other websites, so browser “Do Not Track” signals don’t change how we operate.

Retention

We keep account information while your account is open, technical information for a limited time for security, and reports for as long as they’re useful for preventing fraud or required by law. Deleting your account deletes your account information, not your reports, except that we may keep a record of which account submitted each report. If we suspend or ban an account, we may keep the information needed to prevent it from returning. Reports already shared with institutions can’t be recalled.

Where your data is stored

In the United States. If you’re outside the US, your data is transferred to and processed there.

Security

We encrypt data in transit and at rest. No system is perfectly secure. If a breach affects your information, we’ll notify you and the relevant authorities as required by law.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your data, and to restrict or object to how we process it. Contact us; we’ll verify your identity and respond as the law requires. Some rights are limited where data is needed for fraud prevention, legal obligations, or legal claims.

If you’re in the UK or EEA

Because reports describe suspected crimes, we process information about criminal offences. In the UK, we rely on the conditions for preventing or detecting unlawful acts and preventing fraud in Schedule 1 of the Data Protection Act 2018; elsewhere, we process such information only as applicable law permits. You can complain to your data protection authority (in the UK, the ICO).

Children

Quarry is for people 18 and older. If we learn we’ve collected account information from someone under 18, we delete it.

Changes

We’ll post changes here and update the date above, and we’ll notify you of material changes.

Contact