SwivProtect

Gmail Add-on example

Inspiration:

Talking to the recruitment team and the passion for their company and what they do inspired me to learn about their challenge. Wanting a meaningful project inspired us to participate.

What it does:

SwivProtect protects older adults and vulnerable customers from scams in three moments, in plain words and in their own language (English, Spanish, Chinese, Tagalog or Vietnamese).

Before an attack: Scams arrive in waves. When five different people report the same scam within 30 days and share a state, age range or language, everyone else in that group gets an alert with the exact words to watch for, like "power will be shut off, past due bill, prepaid card."
During an attack: On Android, a text from a number that isn't in your contacts is checked the moment it arrives. If it matches one of our 20 catalogued scams, a notification opens a popup that names the scam, says what to do, and shows the words that gave it away. A Gmail add-on does the same for the email you open.
After an attack: A four-step report, recovery steps if money was lost (bank, FTC, AARP Fraud Watch), and the report itself becomes the warning for the next person. Reports never carry a name, and message text is never stored.

How we built it

Server: Node.js with no third-party packages, using Node's built-in SQLite. A static catalog holds 20 scam types, based on FTC and FBI categories and common scam patterns, with warning words in five languages. It is updated like patch notes. A live database holds accounts, reports and alerts and cleans itself after 30 days.
App: One web app built for big text and few choices per screen. The Android app (Kotlin) shows that same app in a WebView and adds the phone-only parts through a small bridge: reading incoming texts, skipping saved contacts, notifications, and a background alert check.
Gmail add-on: Google Apps Script. We verify Google's sign-in token ourselves and link a Gmail address to an account with a one-time code.
Detection: Transparent word-list rules instead of a black box, so every warning can say exactly why it fired.
Safety and testing: Rate limits, request-size caps and lockouts after a flood test, 53 automated tests, and a deployment kit.

Challenges we ran into:

False alarms: The same words (like "USPS") appears in several languages' lists and was counted more than once. We now count each distinct word once and only weigh links and payment words when other warning words are present.
Trusting reports without knowing who sent them: We use a five-person threshold, one report per person per scam, caps on near-duplicate reports, and 30-day expiry. Identity verification is still future work.
Platform limits: Android needs permissions and can delay background checks by about 15 minutes. Gmail add-ons only run when an email is opened. iPhones don't let apps read texts at all.

Accomplishments that we're proud of

The full loop works end to end on an Android emulator. In our demo (with seeded data), one person's report was the fifth in Texas, which warned everyone else there.
Warnings in five languages, with big text and no jargon.
Privacy by design: reports carry no names, sender numbers never leave the phone, and message text isn't stored.
A server with zero third-party dependencies, 53 automated tests, and protection against flooding.
The Android app, web app and Gmail add-on share one backend and one set of rules.

What we learned

Designing for older adults means removing choices: at most five big buttons per screen, plain words, one clear next step.
Each platform (Android, iPhone, Gmail) limits what a safety tool may see, and being honest about those limits matters.
Security details like token checks, rate limits and account linking matter as much as features.
Further implementing AI for roadmaps, ERD set ups, timeframes, and debugging. ## What's next for SwivProtect
Publish the Gmail add-on (Google Workspace Marketplace review) and the app (Google Play).
Instant alerts to closed apps with push notifications.
An iPhone version: the web app and Gmail first, Apple's message filter later.
Verified reporting to keep fake reports out.
A hosted database that scales, more scam types added patch-notes style, and translated app text and tips. -Working on a trusted contact sub-page in which a a user can designate a trusted contact that may review transfers before they are approved. -Implementing calls into our SwivProtect services.