Cookie Policy

Last updated: 2026-07-17.

Scam Checker keeps cookie use to a minimum. Most of the site works without any cookies at all. This page lists what we set, what they do, and how to remove them.

1. Necessary cookies (always on)

• sc_consent — stores your cookie-consent decision (granted / denied, version, timestamp). First-party, lax SameSite, 6-month expiry. Removing this cookie re-prompts you on next visit.
• __Host-scamchecker_session — set only when you choose to sign in. This host-only cookie is Secure, HttpOnly and SameSite=Lax, expires after at most 30 days, and keeps your optional account session active. It is never used for analytics or advertising. Signing out or deleting the account clears it immediately.

2. Analytics cookies (off until you consent)

If — and only if — you accept analytics, we load Google Analytics 4 (G-4NCNQMQVFB), Vercel Analytics, and Vercel Speed Insights. GA sets the following first-party cookies:

• _ga, _ga_<id> — distinguish unique visitors. We explicitly configure an approximately 13-month expiry.
• __Host-sc_presence — our own, first-party, and not sent anywhere else. It lets us see, on a private operational dashboard, roughly how many people are using the site right now and which page they are on. It holds a random value with no meaning outside our own server, is not readable by page scripts, and expires after 30 minutes of inactivity, so it identifies a visit rather than a person. It is never used for advertising and never leaves this site.

We never send the contents of your pasted messages, URLs, phone numbers, emails, OTPs, files, or report notes to GA. The allowed event parameters are fixed by a server-side allowlist, and anything outside it is dropped before any event is sent.

The same is true of the presence cookie, and more narrowly: the only things recorded against it are which page you are on, a two-letter country code, whether you are on a phone, tablet or desktop, and whether you arrived from a search engine, a social site or directly. Your IP address is never stored— it is not part of that record at all — and neither is your browser's user-agent string. Records are deleted after ten minutes, and the key they are stored under is re-derived every day, so activity on one day cannot be linked to activity on another, by us or by anyone with access to the database.

2b. Counting without a cookie

If you reject analytics, we still count that a page view happened, so that we can tell how much of our traffic we are not seeing. That count is a single number per page per minute. There is no cookie, no identifier of any kind, and nothing that could be traced back to you or joined to anything else — it is the same information a plain web-server log records, and it is why rejecting analytics does not distort the picture for everyone else.

3. Withdrawing or changing consent

You can withdraw consent at any time:

• Use the footer's "Manage privacy preferences" button on any page, then choose Reject or Withdraw.
• Withdrawal immediately disables future analytics events and removes accessible _ga cookies.
• Withdrawal also deletes the __Host-sc_presencecookie and the record stored against it. Because that cookie is not readable by page scripts, the deletion is performed by our server on your next request — so it happens whether or not you stay on the page where you withdrew.
• Clear the sc_consentcookie from your browser. On next page load you'll be re-prompted.
• If you previously granted consent, you can also opt out via your browser's Google Analytics opt-out add-on, or by adjusting browser cookie permissions.

4. Cookies we do NOT set

• No advertising / retargeting cookies.
• No cross-site tracking pixels.
• No social-network share-tracking cookies.
• No fingerprinting / canvas / WebRTC IP techniques.

5. Browser controls

You can also block or clear cookies at the browser level. Helpful links from major browser vendors: Chrome, Firefox, Safari, Edge.

6. Questions or rights

See the Privacy Policy for the broader data-protection statement, or the data removalpage if you'd like a copy or deletion of any data tied to a value you recognise.