These terms govern your use of the CMS SecureMe mobile app, and anything you buy in it. By installing or using the app you accept them.
They used to be two documents: terms of use for the app, and terms and conditions for the subscription, with a clause saying which won where they disagreed. They are one document now, so nothing has to win.
How your data is handled is a separate document, the privacy notice.
Part one covers using the app and applies to everybody. Part two covers paying for it and applies if you buy something. Part three is the legal apparatus that applies to both.
Who we are
CMS SecureMe is published by CMS InfoSec Ltd, registered in England & Wales, company number 16417846, registered office The Accountancy Partnership, 70 Grange Road East, Wirral, CH41 5FE, United Kingdom.
Support: support@cmsinfosec.com.
Part one: using the app
Who may use it, and your account
You must be 18 or over to hold an account or buy a plan. Someone younger can be added to a plan by an adult who holds one, on the terms set out in the privacy notice.
The free checks work without signing in. Family Protect, a solo plan and SecureMe Watch all need you to sign in with Apple or Google, because something that has to survive a change of phone cannot be held under an identity that exists only until the app is reinstalled. The app refuses to start those without a sign-in rather than letting you build something that would be stranded later.
Keep your Apple or Google account secure. Anyone who can sign in as you can reach what your account holds.
Signing in with a different Apple or Google account signs you into that account. If that identity already belongs to an existing user, you are signed in as them, and anything the app built up before you signed in stays behind with the earlier anonymous install. That is how the platforms work rather than a choice of ours, but it surprises people, so it is written down here.
If you close your account, what we hold is deleted on the timetable in the privacy notice. What is on your phone goes when you uninstall the app. A backup you saved to your own iCloud or Drive is in your account rather than ours, so you have to delete that yourself.
Your licence
We grant you a personal, non-exclusive, non-transferable, revocable licence to install and use the app on devices you own or control, for your own non-commercial use, in accordance with these terms and with the app store rules that apply to your platform.
You may not copy, modify, reverse engineer, decompile, disassemble, rent, lease, sell or sublicense the app, except to the extent that any of those is expressly permitted by law and cannot be excluded by contract.
We keep all rights not expressly granted.
What the app is
A tool that helps you assess your personal security, tells you what to fix first, and helps you respond if something goes wrong.
What the app is not
This matters more than usual here, because the gap between what people assume a security app does and what this one does is where harm happens.
- It is not antivirus. It does not scan for, detect or remove malware or viruses.
- It is not a VPN, and it does not filter, inspect, route or protect your network traffic.
- It does not block calls, messages, websites or applications.
- It is not a monitoring service. Nobody is watching your accounts on your behalf in real time. SecureMe Watch re-checks addresses against a breach corpus about once a day. It is not a person and it is not continuous.
- It is not a password manager. The vault holds recovery codes and reference numbers you choose to put in it. It does not store, fill or synchronise your passwords.
- It is not legal, financial or regulatory advice. The guidance on reimbursement rights, reporting routes and incident response is general information about how the UK system works. It is not advice on your situation and it does not predict your outcome. If you need advice, get it from someone qualified to give it.
- The Digital Estate list is not a will. It is a list of your accounts so the people you trust can find them. It decides nothing about who inherits what, and it has no legal effect on your estate.
The limits of the checks
Every check in the app has a boundary, and we would rather set it out than let you discover it.
Breach checking is only as complete as the corpus behind it. A result of “no breaches found” means your address does not appear in the datasets we can query. It does not mean your address has never been exposed. Breach datasets are incomplete and are not real-time.
Link, message and caller checks can be wrong in both directions. A link that comes back clean may still be malicious, and a legitimate one may be flagged. Where a check cannot establish that something is safe, the app says so rather than guessing. “We cannot tell” is a real answer, and you should treat it as one.
Self-reported answers are taken at face value. Several of the six areas ask you what you have done rather than measuring it. If you tell the app two-factor authentication is on, it believes you.
Your score is a summary, not a guarantee. A high score means the specific things we check look good. It does not mean you cannot be scammed. Nothing means that.
Answers expire on purpose. Settings drift and apps reset them on update, so the app asks again rather than treating a six-month-old answer as current.
Your responsibilities
You agree to:
- give accurate answers, since a self-assessment built on inaccurate answers produces an inaccurate result;
- keep your device secured with a screen lock and keep its operating system up to date;
- keep your own backup of anything in the vault that you cannot afford to lose (see the warning below); and
- not use the app to check data belonging to someone else without a proper basis for doing so.
On the vault and the recovery passphrase. Vault contents are encrypted on your device with a key we do not hold. That is the security property you want, and it has a consequence you need to understand: if you lose the device or delete the app without a backup, we cannot recover what was in it. There is no reset, no recovery link and no support route that gets it back, because there is nothing on our side to recover it from.
The same is true of the passphrase that locks your plan recovery key and of the passphrase on a backup you made. We never receive either, so we cannot reset either. Losing one means the thing it protects cannot be opened, by us or by anyone else.
Plans and other people’s data
If you set up a plan, you are responsible for making sure everyone you add knows they have been added and agrees to it. Where someone is under 13, you must confirm that you hold parental responsibility for them. Scores sync end-to-end encrypted, so you see how someone is doing without seeing what they entered, but you should still ask them first.
If you invite someone by name, that name reaches our server before they have agreed to anything. Invite with the group code instead if you would rather it did not.
Anyone in a plan can leave it, and the plan holder can remove a member. Removal takes effect immediately on our server: from that moment the removed member can fetch nothing new, and their name and token are deleted 30 days later.
Two things about removal we would rather say than have you discover. There is no undo, so a removed person has to be invited again. And because every member holds a copy of the family key, a removed member keeps theirs, so anything they had already downloaded from the plan stays readable to them.
Availability and changes
We may update, change or withdraw features. We may end support for older operating system versions, and the app relies on third-party services that could change their terms or stop being available. If a provider withdraws, the check that depends on it stops working.
We do not promise the app will be uninterrupted or error-free.
Suspension
We may suspend or terminate your access if you breach these terms, if we are required to by law, or if we reasonably believe the app is being used to harm someone. Where it is practical and lawful to do so, we will tell you why.
Part two: paying for it
What stays free
The core of the app is free and stays free. You do not need to pay for anything to run the six checks, follow the action plan, use the tools, or get the incident guidance.
Each email address gets one free breach check. Checking the same address again needs a plan, and so does having it re-checked while the app is closed. Checking a password is free, however often you do it.
The Digital Estate list is free too. It is not part of any plan, and you do not need one to keep it.
Who you are paying
Not us, directly. Everything paid for in CMS SecureMe is sold as an in-app purchase through the Apple App Store or Google Play, depending on your device. Your payment relationship is with Apple or Google. That covers the card on file, the receipt, the billing history and the refund route. We never see your card details, your billing address, or the amount you were charged.
This matters most when you want money back, so it is set out in full under Refunds below.
What is for sale
Three subscriptions and two one-off purchases.
SecureMe Protect, the household plan
Covers up to six people, including you, and includes two things:
- SecureMe Watch. Continuous breach monitoring for everyone on the plan, re-checked about every day, with an alert when something turns up.
- Family Protect. The family group, encrypted score syncing, the choice to share your Digital Estate list with the people on your plan, and a family screen that points out, when you open it, whose score has fallen and who has not checked for a fortnight.
£19.99 a year, or £2.49 a month.
SecureMe Protect, extended
The same plan, covering up to ten people.
£21.99 a year, or £2.69 a month.
The extension is a different subscription product, not an add-on charged alongside the standard one. Moving between the two is a plan change in your app store, and your store decides when it takes effect. See Changing the plan.
SecureMe Protect for one
For a person with nobody to share with. Covers one person, and includes SecureMe Watch for your own addresses. It does not include a family group, and no one else can be added to it.
£4.99 a year, or 59p a month.
Breach response pack
Everything about a breach you have had, gathered into one file for your bank. Bought once, kept for good.
£2.99, one-off.
Identity exposure kit
Bought once, kept for good.
£4.99, one-off.
Both one-off products are included free with any active SecureMe Protect plan, solo or household. If you hold a plan, do not buy them. You already have them, and the app says so where they are offered.
SecureMe Watch keeps checking as long as you open the app at least once every 45 days, and we remind you before it stops. If it does stop, your subscription carries on until you cancel it through your app store.
Everyone on a plan can be on any mobile network. There is no carrier requirement, on any product.
A seat is a person, not a device. Six seats means six people, whatever they are each running.
Price and billing
The price, the billing period and the number of seats are shown in the app before you confirm, and are confirmed again by your app store. The price your app store shows at the point of purchase is the price, in your own currency, and nothing on this page overrides it. The figures above are the sterling list prices, and they are what the app falls back to when it cannot reach the store.
Subscriptions bill monthly or annually. Payment is taken by your app store at the start of each period. One-off purchases are charged once and are not subscriptions.
Renewal
Subscriptions renew automatically at the end of each period, at the then-current price, until cancelled. Your app store charges you within 24 hours before each renewal.
If we increase the price, your app store will notify you and, where the platform requires it, ask you to consent before the higher price is charged. You can cancel instead.
One-off purchases do not renew and are never charged again.
Cancelling
Cancel any time through your app store: Settings → your name → Subscriptions on iOS, or Play Store → Payments and subscriptions on Android.
Cancelling stops the next renewal. It does not shorten the period you have already paid for, and your plan keeps working until that period ends.
We cannot cancel your subscription for you. Deleting the app does not cancel it either. The subscription lives with your store account, not on the device.
Your 14-day cancellation right
If you are a consumer in the UK, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 give you 14 days to change your mind about a distance contract.
Digital content has an exception: if you ask for it to be supplied immediately and acknowledge that you lose the cancellation right by doing so, the right ends once supply begins. App store purchases generally work this way, because the purchase becomes active as soon as it is made.
In practice, your app store’s own refund policy is usually more generous than the statutory position, and it is the route that actually works. Use it first.
Refunds
Ask your app store. Apple and Google took the payment, hold the receipt and issue the refund, and neither gives us the ability to refund a purchase we did not process.
- Apple: reportaproblem.apple.com
- Google: Play Store → Order history → Report a problem
If a store refuses and you think the refusal is wrong, write to support@cmsinfosec.com with your receipt. We will look at it and we will tell you honestly whether we can help, which sometimes we cannot.
When a store tells us a purchase has been refunded, the thing it paid for is withdrawn.
Separately, your statutory rights under the Consumer Rights Act 2015 apply to anything you buy here as digital content: it must be of satisfactory quality, fit for purpose and as described. If it is not, you may be entitled to a repair, a replacement or a price reduction, and those rights sit outside any store policy.
Free trials and promotions
Where a free trial is offered, its length and terms are shown before you start it. A trial converts into a paid subscription automatically unless you cancel before it ends. Cancel through your app store, not by deleting the app. One trial per person per platform, and we may withdraw or change trial offers for future subscribers at any time.
Any introductory or launch price is configured in the app stores and shown by them. It applies for the period the store states and then reverts to the standard price.
Changing the plan
You can move between monthly and annual, between the standard and extended household plans, and between a solo and a household plan, through the app, subject to what your app store supports.
Changes take effect as your store applies them: usually straight away for an upgrade, with a prorated credit, and at the next renewal for a downgrade. The store decides this, not us.
If you downgrade to fewer seats than your plan currently has people on it, the app will tell you before the change and you will need to remove members to fit. We do not choose who is removed.
One purchase, one plan
A receipt can switch on one plan and no more. If the same purchase is presented from a second account, we refuse it. This is why we keep the store’s own reference for your subscription: it is the only way to tell that two claims are the same purchase.
If we change or withdraw a product
We may change what a subscription includes. If a change materially reduces what you are getting, we will tell you before it takes effect and you may cancel.
If we withdraw a subscription altogether, we will give you reasonable notice and refund the unused part of any period you have already paid for, calculated pro rata.
If we withdraw a one-off product, anyone who has already bought it keeps it.
If you stop paying
If a renewal payment fails, your app store will retry it on its own schedule. While it is retrying, your plan stays live. If it stays unpaid, the subscription lapses and the plan reverts to the free level: monitoring stops and members stop syncing.
The free features keep working, and nothing on anyone’s device is deleted because of a lapsed subscription. What we hold on our side is cleared on the timetable in the privacy notice, including a 90-day window on watched addresses, so that renewing late keeps your history rather than starting again.
Fair use
A plan is for one household or family group. It is not for resale, not for an organisation, and not for sharing beyond that group. Where we reasonably believe a plan is being used outside those limits, we may contact you and, if it continues, end the plan and refund the unused portion.
Part three: legal
Our liability
Nothing here limits or excludes our liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be limited.
Subject to that:
- we are not liable for loss arising from your reliance on a check result, a score, or any guidance in the app, given the limits described in part one;
- we are not liable for losses caused by a scam, fraud or attack. We help you reduce the risk and respond to it. We do not insure you against it, and no security product can;
- we are not liable for the acts or omissions of third parties, including banks, platforms, the police, or the providers whose data the checks rely on;
- we are not liable for the loss of anything held only on your device or only in a backup you control, including vault contents, where the cause is a lost device, a lost passphrase or a deleted backup;
- for the free features, our total liability is limited to £100;
- for anything paid for, our total liability is limited to the amount you paid us in the twelve months before the claim; and
- we are not liable for indirect or consequential loss, or for loss of profit, business or data.
If you are a consumer, none of this affects your statutory rights, including your rights under the Consumer Rights Act 2015 that digital content be of satisfactory quality, fit for purpose and as described.
App store terms
This document is the licence agreement for the app. Where a store asks for one, this is what it means, and it applies in place of any standard licence agreement the store would otherwise supply.
Your platform’s own terms still apply alongside it. The points below are here because Apple requires any agreement offered in place of its own to carry them.
- This agreement is between you and us. Apple is not a party to it and is not responsible for the app or anything in it.
- The licence covers Apple-branded devices you own or control, and any other use the App Store rules allow.
- Support is ours, not Apple’s. Apple has no obligation to maintain or support the app. Write to support@cmsinfosec.com.
- If the app does not work as it should, you may tell Apple, and Apple will refund what you paid for it. That refund is the limit of Apple’s obligation to you. Everything beyond it is ours to answer for, and your statutory rights against us are untouched.
- Claims about the app are ours to answer, including product liability, any failure to meet a legal requirement, and consumer protection claims.
- A claim that the app infringes someone’s intellectual property is ours to defend, settle and pay.
- You confirm that you are not in a country subject to a United States Government embargo or designated by it as supporting terrorism, and that you are not on any United States Government list of prohibited or restricted parties.
- When you use the app you must comply with any third party terms of agreement that apply to you, such as your agreement with your mobile network or broadband provider.
- Apple and its subsidiaries may enforce these terms against you as third party beneficiaries of them.
Google is likewise not a party to these terms and is not responsible for the app.
Complaints and disputes
Write to support@cmsinfosec.com. We will acknowledge within five working days and aim to resolve within 20 working days.
Governing law
These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
If you are a consumer resident in Scotland or Northern Ireland, you may also bring proceedings in your own jurisdiction, and your home nation’s mandatory consumer protection law continues to apply.
Changes to these terms
We may revise these terms. The “Last updated” date at the top of this page moves when the wording does, and material changes are surfaced in the app before they take effect.