Privacy Policy

Last updated: October 5, 2026

What we collect

When you use ScamCheck without an account, we process your input to generate a scan result. We do not store the message itself, with two exceptions:

• Shareable warnings. When a scan is rated Likely Scam or Suspicious, we keep a redacted copy so you can share the warning (for example to a family WhatsApp group). Before it is saved we remove phone numbers, email addresses, codes (OTP/PIN), card, account and ID numbers, names after greetings, and link parameters. It is kept under a random link, is not listed in search engines, and is deleted after 180 days.
• Scam statistics. For risky scans we record which brand was impersonated, the suspicious website names in the message, the scam type and your country (not your city or IP). We use these counts to improve detection and to alert impersonated companies. They contain no message text and cannot be linked to you.

To enforce the free daily scan limit we log the IP address of anonymous scans. When you create an account, we store your email address, name, and your scan history. If you scan before signing up, your browser keeps that last result for up to 48 hours so it can be saved to your new account.

Scam alert emails

If you subscribe to scam alerts, we store your email address, chosen country, and the time and country of your confirmation. You are only subscribed after you confirm via the link we email you. Every alert includes a one-click unsubscribe link, and unsubscribing stops all alert emails.

How we use your data

We use your data only to provide and improve the ScamCheck service. We do not sell, rent, or share your personal information with third parties for advertising purposes.

Cookies

We use strictly necessary cookies for authentication sessions. We do not use tracking or analytics cookies without consent. To improve sign-up, we count anonymous, aggregate events (for example "a sign-up prompt was shown" or "the Google button was clicked") with no identifier, IP address, account or message content attached.

Third-party services

We use Supabase for database and authentication, Google (Gemini) and Anthropic (Claude) for AI analysis, Brevo for sending email, and Razorpay for payment processing. Each of these services has its own privacy policy.

When a message needs AI analysis, we first remove phone numbers, email addresses, codes (OTP/PIN), card, account and ID numbers and names, and send only the redacted text. Screenshots you upload are sent to the AI provider to read the text in them. Google may use content sent through its free Gemini API tier to improve its products, so please don't upload screenshots containing information you wouldn't want shared — crop or cover personal details first.

Data retention

Account data is retained as long as your account is active. You can delete your account and all associated data at any time from your dashboard settings. Redacted shareable warnings are deleted after 180 days. Scam-alert subscriptions are kept until you unsubscribe.

Contact

For privacy-related questions, please use our contact form.