Inspiration
Almost everyone deals with scam messages, sometimes daily. They're an annoyance for most people, and for anyone who falls for one they can turn into real financial and personal damage. We saw the same pattern in our own university GroupMe: different usernames posting the same fake ticket and parking pass offers. Most people can't tell whether a message is real without researching it, and the alternative is handing an app access to all your messages. We built Ravel to make checking a suspicious message as easy as sharing a screenshot, without giving up your privacy.
What it does
Ravel checks messages you choose to share. From the iPhone Share menu you send a screenshot, text, or link, or you can text it to the Ravel iMessage agent. Google Gemini reads the content and extracts scam signals such as payment requests, urgency, and suspicious links. Ravel's safety policy then turns those signals into a plain-English verdict: what looks suspicious, how much evidence there is, and what to do next. Ravel never labels something as confirmed fraud, since extracted claims are unverified, and when evidence is thin it says so.
How we built it
- iOS app: SwiftUI with a Share Extension and a shared Swift package
- Backend: Python and FastAPI, with strict input validation and a rules-based assessment policy
- AI: Google Gemini API for multimodal extraction from text and images, with structured outputs validated before use
- iMessage: a TypeScript agent built on Photon Spectrum, calling the same backend as the app
- Testing: pytest (216 backend tests), XCTest, and 420 offline tests for the Photon agent
Challenges we ran into
Privacy was the hardest part. For a privacy and security app, collecting less data is the main goal. So Ravel is user-driven: you share only what you want checked, images are stripped of metadata before analysis, and raw messages and images aren't saved. We also had to handle unpredictable AI output. We validate everything Gemini returns, never fall back to fake results when the provider fails, and tested the policy against benign messages so it doesn't cry wolf. Photon's iMessage path currently supports text and links but not screenshots, which shaped how we designed that part.
Accomplishments that we're proud of
- We went from idea to a working end-to-end prototype quickly, through fast ideation and prototyping.
- We verified real Gemini analysis on synthetic text and screenshots, and a live iMessage round trip on a real phone.
- We built privacy into the design from the start: private checks never create reports.
- We tested the system heavily, with over 600 automated tests across the backend and iMessage agent.
What we learned
We learned how to build with the Google Gemini API, including structured outputs and handling when the model is unsure or wrong. We learned that pairing AI extraction with a deterministic, rule-based policy is what makes an AI app trustworthy, and that skill carries into any data-driven app. We also learned how to build for iOS Share Extensions and connect an iMessage agent through Photon to the same backend.
What's next for Ravel
- Opt-in community reporting so Ravel can connect messages across platforms and spot coordinated scam campaigns. The reporting contract already exists in our API, but matching is not built yet.
- Screenshot support over iMessage
- Suspicious call analysis
- Replacing the Gemini API with our own model, which gives us full control over how data is processed and a stronger privacy story.
Log in or sign up for Devpost to join the conversation.