1. Who we are
ScamChecker (“we”, “us”, “our”) operates the website scamschecker.co and the associated API. We provide AI-powered scam detection services to consumers and families.
For questions about this policy, contact us at support@scamschecker.co.
2. Information we collect
2a. Account information
When you create an account, we collect your email address and a hashed password (managed by Supabase Auth). We use this solely to authenticate you and to manage your subscription.
2b. Usage data
We store a monthly check counter per account to enforce plan limits. We also store your subscription tier and billing status. We do not store the content of your checks.
2c. Billing information
Payment details are handled entirely by Stripe. We store only your Stripe customer ID and subscription status. We never see or store your card number, expiry date, or CVV.
2d. Technical logs
Our servers produce standard access logs containing IP addresses, timestamps, HTTP methods, and response codes. These logs are retained for up to 30 days for security and performance monitoring. Logs never include the content of analysis requests.
2e. Waitlist (historical)
The waitlist has been retired — you can now use the checker directly. For anyone who joined it previously, we stored your email address and the source of your sign-up. We use this only to notify you at launch.
3. What we do NOT collect
- The text, URLs, images, or QR codes you submit for analysis
- The verdicts or risk scores returned by the AI
- Any personally identifiable information about third parties mentioned in your checks
- Biometric data
- Location data beyond your IP address (used only for rate limiting)
Analysis requests are processed entirely in memory. The content is passed to our AI provider (Anthropic) for analysis and then immediately discarded. Anthropic's API usage policy prohibits using API inputs to train their models.
3b. What happens to links you submit
This is the one place where something you submit may leave our systems, so we want to be precise about it rather than bury it.
Checks that stay on our servers
Most of what we do never leaves our infrastructure. We compare links against copies of public malware and phishing blocklists that we download and hold ourselves, and we analyse the shape of the address for lookalike and impersonation patterns. Both happen locally: nothing about your link is sent anywhere to do them.
Contacting the website in the link
To see where a link really leads, our servers may contact the website in the link itself. We request only the page’s headers, not its content, follow any redirects to find the final destination, and check the site’s security certificate. This request comes from our servers, never from your device, and carries nothing about you — not your IP address, your email, or the rest of the message.
The website will be able to see that its link was visited. If a scammer sent you a link that is unique to you, that visit could tell them the link was opened. If that concerns you, paste the message without the link and we will analyse the rest.
Checks that query a third party
To tell you how old a domain is, or whether security vendors have already flagged it, we have to ask someone. We may send the domain name or the full link — never the surrounding message, your email, or anything about you — to domain registries (RDAP), Certificate Transparency logs, Google Web Risk, and VirusTotal.
Links we may submit to VirusTotal for scanning
If VirusTotal has never seen a link before, we may submit it so that it gets scanned. A link submitted this way becomes visible to VirusTotal and its security community. That is how the service works, and it is worth knowing before you paste something.
Because of that, we automatically refuse to submit any link that looks like it carries a secret. Password-reset and email-confirmation links, anything with a token, key, password or signature in it, one-time login links, shared document and invoice links, and meeting links with a passcode are all held back — we will still look them up, but we never publish them. If you are ever unsure, paste the message text rather than the link and we will analyse that instead.
This behaviour is off unless we have deliberately enabled it, and you can ask us to disable it for your account by emailing support@scamschecker.co.
4. How we use your information
- To authenticate you and manage your account
- To enforce free-tier usage limits
- To process payments and manage your subscription via Stripe
- To send transactional emails (account confirmation, password reset)
- To notify waitlist subscribers at launch
- To detect and prevent abuse of our service
We do not sell your personal data. We do not use it for advertising. We do not share it with third parties except as necessary to provide the service (see Section 5).
5. Third-party processors
We use the following sub-processors:
Supabase
- Purpose:
- Database & authentication
- Data shared:
- Email, account data
Stripe
- Purpose:
- Payment processing
- Data shared:
- Email, billing data
Anthropic
- Purpose:
- AI analysis
- Data shared:
- Submitted content (not stored)
RDAP registries
- Purpose:
- Domain age lookup
- Data shared:
- Domain name only
crt.sh
- Purpose:
- Certificate history
- Data shared:
- Domain name only
Google Web Risk
- Purpose:
- Known-bad URL check
- Data shared:
- Submitted link
VirusTotal
- Purpose:
- URL reputation & scanning
- Data shared:
- Submitted link — becomes public if submitted for scanning; screened links are looked up only
Vercel
- Purpose:
- Frontend hosting
- Data shared:
- IP address, request logs
Railway
- Purpose:
- API hosting
- Data shared:
- IP address, request logs
Redis
- Purpose:
- Rate limiting cache
- Data shared:
- IP address, user ID (temporary)
| Provider | Purpose | Data shared |
|---|---|---|
| Supabase | Database & authentication | Email, account data |
| Stripe | Payment processing | Email, billing data |
| Anthropic | AI analysis | Submitted content (not stored) |
| RDAP registries | Domain age lookup | Domain name only |
| crt.sh | Certificate history | Domain name only |
| Google Web Risk | Known-bad URL check | Submitted link |
| VirusTotal | URL reputation & scanning | Submitted link — becomes public if submitted for scanning; screened links are looked up only |
| Vercel | Frontend hosting | IP address, request logs |
| Railway | API hosting | IP address, request logs |
| Redis | Rate limiting cache | IP address, user ID (temporary) |
6. Data retention
Account data is retained for as long as your account exists. If you delete your account, we delete your personal data within 30 days. Stripe retains billing records as required by law (typically 7 years). Server access logs are purged after 30 days.
7. Your rights
Depending on your location, you may have rights to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Object to or restrict processing of your data
- Receive a copy of your data in a portable format
- Withdraw consent at any time (where processing is consent-based)
To exercise any of these rights, email support@scamschecker.co. We will respond within 30 days.
9. Security
All data is transmitted over HTTPS. Passwords are hashed by Supabase Auth using bcrypt. Database access is restricted by Row Level Security policies — users can only access their own data. We follow security best practices including HSTS, Content Security Policy, and regular dependency audits.
10. Changes to this policy
We may update this policy occasionally. When we do, we'll update the date at the top. For significant changes, we'll notify you by email if you have an account with us.
11. Contact
Questions about this privacy policy? Email us at support@scamschecker.co.