Privacy Policy

Last updated: 2026-07-26.

Scam Checker is a free, privacy-first tool. The checker analyses what you paste in your browser, not on our servers. Extracted indicators may be sent securely for reputation checks. Content you explicitly submit as a community report is separate: scrubbed private evidence is stored while public group views use masked values or fixed non-content labels. This page is written in plain English; it is engineering practice, not legal advice.

1. What Scam Checker does

We help you decide whether a message, email, link, SMS, screenshot, or PDF you received is a scam. The analysis is local to your device. We also publish community-reported scams so other readers can search for the same value.

2. Data we collect

2.1 Scam checker tool (/check and dedicated tool pages)

• Pasted text, screenshots, PDFs, etc. are analysed in your browser via JavaScript. Only extracted indicators such as a URL, domain, IP, email, or phone may be sent securely for community and external reputation checks.
• We do not store a full scan body or scan history. An extracted public IP and its AbuseIPDB result may be cached for 24 hours; an extracted domain and RDAP registration result may be cached for seven days. Expired rows are removed by a bounded cleanup.
• File OCR (images, PDFs) is done with tesseract.js and pdfjs-dist in the browser. Files are never uploaded.

2.2 Community scam reports (/api/report)

• The type of scam (e.g. email, phone, URL).
• The value(the scammer's phone, email, or URL) — truncated to 500 characters. Exact non-message targets are retained privately so matching works. Message-like evidence is scrubbed by a server-side scrubber before write. Eligible public groups use a precomputed masked email, phone, or URL; Message, SMS, and WhatsApp groups always use fixed labels and never publish a content excerpt.
• Optional notes — capped at 1000 characters and scrubbed for OTPs, CVVs, card numbers, passwords, SSN / TFN / Medicare numbers, and JWT-shaped tokens before saving.
• Keyed HMAC-SHA-256 hash of the request IP address (NOT the raw IP). Used as the server-derived input to target/group-scoped abuse controls.
• Keyed SHA-256 hash of the User-Agent string (NOT the raw UA). This is telemetry only and is not reporter/voter identity, so changing it cannot create another identity.
• Country code (2 letters) — coarse geo only.

2.3 Server logs (Vercel)

• Request-level metadata only: route, status code, region, response time. No request bodiesare written to logs.

2.4 Optional accounts and sign-in

• The scam checker remains available without an account. If you choose to sign in, we store your normalised email and verification time in an account record.
• One-time sign-in links expire after 15 minutes. Only a SHA-256 digest of the random link secret is stored; the original secret is delivered by Resend in a URL fragment and is never stored. Sign-in, account and callback pages do not load analytics.
• Session and mobile refresh secrets are also stored only as SHA-256 digests. Mobile access tokens are signed and expire after 15 minutes. Native sign-in also stores a non-secret PKCE challenge and a digest—not the raw value—of random correlation state.
• App-store review staff may use a dedicated, non-public account to verify account-gated features. Its credentials are not stored in the app, and its separate access grant and session expire automatically or can be revoked.

2.5 Analytics (opt-in only)

• Google Analytics 4 (G-4NCNQMQVFB) loads only after explicit consent via the cookie banner.
• Vercel Analytics and Speed Insights also load only after explicit consent. They measure page use and performance; no event parameters carry user content.
• The allowed GA4 event parameters are fixed by a server-side allowlist. Anything outside the allowlist is dropped.
• Live presence. Behind the same consent, we run our own first-party count of who is using the site right now, visible only to the site owner on a private dashboard. It records which page you are on, a two-letter country code, your device type, and whether you arrived from search, social or directly — and nothing else. It never stores your IP address or your browser's user-agent string.Records are deleted after ten minutes, and the key they are filed under is re-derived daily, so one day's activity cannot be linked to another's. Withdrawing consent deletes both the cookie and the record.
• If you reject analytics we still count that a page view occurred, with no cookie and no identifier at all — one number per page per minute, the same thing a web-server log records. It exists so the owner can tell how much traffic the consented figures are missing, rather than mistaking a low number for a quiet day.
• We never send the contents of your pasted text, URLs, phone numbers, emails, OCR output, OTPs, card details, or report notes to GA.

2.6 Contact form (/contact)

• Name, email, category, and message are stored in Postgres so we can respond to the enquiry. Keyed request-IP and User-Agent hashes support abuse controls; raw values are not stored by the application.
• If email delivery is configured, Resend receives the enquiry fields to notify the operator and may send a confirmation to the address you supplied.

2.7 Weekly scam alerts (/api/newsletter)

• Resend processes the address to deliver an encrypted, 48-hour confirmation link. We do not add the address to the subscriber audience unless you open that link and press the confirmation button.
• After confirmation, Resend stores the address and subscription status for weekly alerts. It is not connected to checker input, reports, analytics identifiers, or advertising profiles.

2.8 Protection features (optional, signed-in, opt-in)

Free scam checking never requires an account and is never put behind a plan. The features below only exist if you sign in and switch them on individually.

• Saved check history is separately opt-in and sanitised. When you choose to save a check, we do not store what you pasted. We store a risk band, the identifiers of the warning signs that matched, the standard explanation text for each, which sources were checked and whether each answered, and masked labels such as a***@example.com, ****1234 or 203.0.113.*. Raw text, uploaded file bytes, OCR output, passwords, one-time codes and card details are never saved. You pick 30, 90 or 365 days when you save, and you can delete any entry at any time.
• Watch interests are the brands, categories and regions you ask to be told about. We store a keyed one-way digest for matching plus the public label you picked from our list — never anything you typed.
• Security alerts are separate from marketing. Turning on security alerts does not subscribe you to the weekly newsletter, and unsubscribing from the newsletter does not switch off a security alert you asked for. They are two independent consents you can change independently in either direction. If you withdraw security-alert consent, alerts already waiting to be sent are cancelled rather than sent.
• Push notifications. If you register a device, its push token is stored encrypted (AES-256-GCM) and can be revoked. The notification that reaches your phone carries only a generic title, a generic line of text and a link back to our own site. The incident title, the summary and your watch labels are shown only after the app fetches them behind your sign-in. Expo delivers the notification and receives the token, the generic text and that link.
• Family sharing gives nobody a look at your private data. Being in a family does not let the owner or any member read your saved checks or your alerts. Each share is one item, to one named person, that you can revoke.
• Not available: we do not offer personal email monitoring and we do not search breach marketplaces on your behalf. Business accounts are not on sale. Nothing on this site monitors your inbox.

3. Data we deliberately do NOT collect

• The full text pasted only for checker analysis. Content you explicitly submit as a community report is stored separately as scrubbed, private evidence, and a check you explicitly save is stored as the sanitised summary described in 2.8.
• Uploaded images / PDFs (bytes never leave your browser).
• Raw request/client IP addresses from ordinary API traffic (only short-lived, window-scoped keyed rate-limit buckets and keyed hashes for abuse controls). If you explicitly check a public IP, that indicator and its reputation result can be cached for up to 24 hours as described above.
• Raw User-Agent strings (only a keyed SHA-256 telemetry hash).
• Recognised passwords, login credentials, OTPs, card numbers, and CVVs in report notes and message-like evidence; the server scrubber removes these recognised patterns before persistence. Exact non-message targets are retained privately for matching, so do not put private data in a reported URL, path, or query.
• Cross-site tracking pixels or advertising IDs.
• Browser fingerprinting techniques.

4. Cookies

Detail lives on the dedicated Cookie Policy. Summary:

• sc_consent — first-party, lax SameSite, 6-month expiry. Stores your cookie-consent decision.
• __Host-scamchecker_session — set only after you choose to sign in. Host-only, Secure, HttpOnly and SameSite=Lax; expires after at most 30 days. It is strictly necessary for the account session and is not used for tracking.
• Google Analytics cookies (_ga, _ga_<id>) — only after you accept.
• __Host-sc_presence — only after you accept. Host-only, Secure, HttpOnly, SameSite=Lax; expires after 30 minutes of inactivity. First-party live-visitor count; never shared, never used for advertising.
• No advertising cookies. No tracking pixels.

5. AI & third-party processors

• Vercel hosts the site and ships request-level logs.
• Prisma + Postgres stores scrubbed private report evidence, moderated report groups, contact enquiries, short-lived rate-limit buckets, bounded reputation caches, and optional account/session records.
• Google Analytics 4 — consent-gated.
• Resend delivers user-requested sign-in, contact, and confirmation emails, stores confirmed weekly-alert subscribers, and sends the security alerts and weekly protection briefs that signed-in accounts opt into. Security mail is sent one message at a time, never through the marketing audience.
• Expo delivers push notifications to devices you register for security alerts. It receives the push token plus a generic title, a generic line of text and a link back to this site — no incident details and no account identifier.
• Google Safe Browsing, RDAP services, and AbuseIPDB receive only the applicable extracted URL, domain, or public IP for an optional reputation check.
• GitHub Actions, Gemini, and Groq support the weekly editorial generator. They receive editorial prompts and public-source research, never checker or user-submitted data.

We do not train any AI model on user submissions, and we do not sell or share data with advertisers.

6. Retention

• Reports: kept while still useful for the community report database. A 24-month rolling retention is on the engineering backlog (tracked in docs/privacy-data-map.md).
• Contact enquiries: currently retained in Postgres while needed for support and abuse handling; there is no automated purge yet. You can request deletion.
• Weekly-alert subscriptions: Resend retains the address and subscription status until deletion. Unsubscribing suppresses future sends; you may also request deletion.
• Rate-limit and reputation-cache rows: expire automatically. Rate-limit buckets live no more than two endpoint windows; reputation rows live for up to seven days.
• Consent cookie: 6 months, then re-prompt.
• Analytics cookies: explicitly configured to expire after approximately 13 months.
• Live-presence records: 10 minutes. The cookie itself expires after 30 minutes of inactivity. The per-minute totals behind the chart are kept for 400 days (about 13 months) so we can compare one month with the same month a year earlier. Those totals contain no identifier of any kind — each is a timestamp, a page name and a count, with no visitor key, IP address, device or country attached — so keeping them longer does not make them about you.
• Vercel logs: per Vercel plan default.
• Saved checks: 30, 90 or 365 days — your choice at save time. A check you delete is destroyed within 30 days.
• Other protection data: a revoked or disabled push device is destroyed after 30 days, a deleted watch interest after 30 days, a revoked family share after 365 days, the record that an alert was sent after 90 days, and a weekly protection brief after 730 days. These are removed by an automatic daily job.
• Magic links and sessions: links expire in 15 minutes; sessions expire after at most 30 days. Expired rows are removed by a bounded cleanup job.
• Optional account: retained until you delete it. Deletion anonymises the email, revokes sessions and family access, and retains limited billing/security audit evidence where required. To avoid removing access while billing can continue, you must first cancel any subscription that is pending, live, paused, in grace, in a trial, or marked to renew.

7. Your rights

Wherever you are, you can request:

• A copyof any report tied to a value that's yours.
• Correction of inaccurate data.
• Removal of a specific report.
• Deletion of a contact enquiry or confirmed weekly-alert address. Every alert also has a one-click unsubscribe that stops future sends.
• Withdrawal of analytics consent at any time via the cookie banner or /cookies.
• Deletion of an optional account from the account page. This signs out every device and anonymises the account identity while retaining required audit records. It also removes the protection data tied to that account: saved checks, watch interests, tasks, alert settings, registered devices, briefs and any shares you created.
• Independent control of each protection feature — saved history, watch interests, email alerts, push alerts and the weekly brief can each be switched on or off on their own, without affecting your newsletter choice in either direction.

Submit requests via the data removal page. Some regions (EU/UK GDPR, California CCPA, Australian Privacy Principles) grant additional formal rights — we honour the substance of these requests in the same workflow.

8. Security

See the dedicated security page for the engineering details: defence-in-depth redaction, security headers, API hardening, and our coordinated disclosure policy.

9. Children

Scam Checker is not directed to children under 13 (16 in some EU/UK contexts). If a parent or guardian believes a child's data was submitted, email privacy@scamchecker.app and we'll remove it on receipt.

10. Changes

We update this policy when our data practice changes. Material changes will be flagged on the homepage banner or via a new cookie-consent prompt where appropriate.

11. Contact

Privacy questions: privacy@scamchecker.app. Security: responsible disclosure. General contact: contact page.

This page is engineering practice and transparency, not a legal warranty. Specific regional requirements (GDPR, ePrivacy, CCPA, Australian Privacy Principles) require legal review before commercial scale-up.