Privacy Policy

• We never keep the message you check — unless you are a paying member, in which case your checks are saved to your own private history so you can re-open them.
• Most of what we keep is deleted after 90 days, automatically, by a job that runs every night.
• Your first name and last initial appear on our homepage when you spot a scam. This is switched on for accounts created from 2 August 2026, and off for accounts created before then until they choose. You can change it at any time, and switching it off also removes anything already showing.
• We do not sell your information, and we do not use advertising trackers.

When you paste a message, email, website, or phone number into the checker, we analyze it to produce your result. Unless you are a paying member with saved history, we do not keep the message itself — the part that can contain your personal information — and we never use it to build public pages.

When a result is suspicious or high-risk, we do keep the scam’s “fingerprints” to help warn other people: the links, phone numbers, and sender email addresses involved. These identify the scammer, not you. We never store the body of your message alongside them.

If you are signed in, we keep a record that you ran a check — the date, how risky the result was, and what kind of scam it looked like. We do not keep what you checked in this record: not the message, not the link, not the number.

You can see this list on your account page. It is deleted after 90 days, and deleted immediately if you delete your account. Checks run without an account are not recorded against anyone.

When a signed-in check finds a scam, your first name and last initialmay appear on our homepage — for example “Mary G just spotted a delivery scam”. It helps people see that others are catching these too.

This is switched on by default for accounts created from 2 August 2026. Accounts created before that date stay off until they turn it on. Either way you can change it at any time on your account page, and switching it off also removes your name from anything already showing — not just future checks.

It never includes your surname, your email, what you checked, or how many checks you have run. Nothing appears at all if your account has no first name saved.

Paying members — Pro, Family, and Founders — can save their checks to My Reports, a private history in their own account. Those saved reports do include the message you checked. They are visible only to you, and you can delete any of them at any time. Free and anonymous checks are never saved this way.

If you forward a suspicious message to our check-by-email address, that check is saved to My Reports too, so you can re-open it. We remove your own email address from it before we store it.

If you choose to submit a report through the Report a Scam form, we store what you enter so a person can review it. Reports are never published automatically. If we ever publish information from reports, we remove personal details first. Your name and email — if you provide them — are never shown publicly and are used only to follow up if needed.

After 90 days, we automatically remove the personal parts of a report — the reporter’s name and email and any pasted message — keeping only non-personal information like the scam type for our statistics.

If you were signed in when you reported, we also keep a short receipt so you can see your own reporting history — the type of scam and the date, and nothing else. There is no room in that record for the number you reported, what you wrote, or your name. After 90 days the receipt stops linking to the report, so the details are genuinely gone rather than just hidden from view. The receipt itself is deleted if you delete your account.

At the end of a result you can tell us whether it was helpful, and add a short note explaining what was off. We keep the rating so we can measure whether the checker is getting better.

Anything you type in that box is removed after 90 days. Please don’t include personal details there — a short description of what went wrong is all we need.

ScamSplain uses AI from Anthropic (the maker of Claude) to read and explain suspicious content. That means the text or screenshots you check, the messages you forward to us, and the messages you send to Sam, our scam-helper chat, are processed by Anthropic’s service to produce your answer. Anthropic processes this data to provide the service and does not use it to train their models.

To point you to real help, Sam can also run a web search— for example to find your bank’s official contact page or a local repair shop. If you’ve saved a city and state in your profile, Sam may include them in that search so the results are actually near you. Sam never searches your name, your messages, or anything else about you.

Accounts are optional — anyone can run a check without one. If you create an account (handled by Clerk, our sign-in provider), we store your name and email. You can also choose to add a city, state, ZIP code, and phone number to your profile: city and state let Sam recommend nearby help without asking, and the phone number lets us reach you if we ever need to. We never ask for your street address. You can edit or clear these at any time, and delete your whole account from the account menu.

If you are on a paid plan we also store which plan it is, and — for Founders members — the price you locked in, so we can keep honouring it.

If you are on a Family plan, we store who is in the group, who pays for it, when each person joined, and — if someone leaves — that they left and when. That last record is what keeps the seat count and the billing correct.

What we do not do is show anyone else what you checked. The person paying cannot see your checks, your saved reports, or your history, and neither can anyone else on the plan.

Invitations are sent from your own email or messaging app, so we never receive or store the address or number you send them to. We keep a scrambled version of the invite link so it can only be used once, and it expires after 7 days.

We send a small number of emails — account messages such as the welcome note, and the verdict when you forward something to be checked. If you unsubscribe, we keep a scrambled version of your email address on a do-not-send list. We keep it precisely so we can check against it before sending, and so we cannot email you again by accident. We will still send you essential messages about your account, such as a password reset or a problem with a payment.

If you dispute a flagged entry through our removal request form, we store your request and any proof document you attach (like a letterhead or bill) so a person can review the case. These documents are only visible to our admin team, are never published, and — along with the request’s personal details — are automatically deleted after 90 days.

If you report a bug or use the Contact form, we store what you send (and your name and email if you include them) so we can respond and improve ScamSplain. Personal details in old messages are automatically removed after 90 days.

ScamSplain uses a small number of cookies, all functional — none are for advertising:

• Sign-in session — keeps you logged into your account (set by Clerk).
• Free-check counter — remembers how many free checks have been used on this device.
• Admin session — used only by our own staff area.

We don’t use advertising cookies or cross-site trackers.

Like most modern websites, ScamSplain is built on a small set of trusted providers, each of which processes some data to do its job:

• Anthropic — AI analysis of submitted content and Sam’s chat.
• Clerk — account sign-in and profile storage.
• Paddle — payments. Paddle handles your card details entirely; we never see or store them.
• Vercel — hosting, and Supabase — our database.
• Cloudflare — DNS, bot protection on sign-in, and routing the mail sent to our check-by-email address.
• Purelymail — runs our check@scamsplain.com mailbox. If you forward a suspicious message there, it passes through Purelymail on the way to us.
• Upstash — the shared counter that stops one person flooding the checker.
• Resend — sends the email we send you: account messages like the welcome note, and the verdict when you forward something to be checked.
• ntfy — sends our team a content-free “new report” ping (never your message or details).
• Vercel Analytics — counts page views and where visitors arrived from. It uses no cookies, does not follow you across other websites, and does not build a profile of you.

To keep the service working and to prevent abuse and spam, we process basic technical information such as your request rate. Our rate limiter briefly uses your IP address itself as a counter — that counter is kept for about a minute and then expires on its own. Anywhere we keep a longer-lived record tied to something you submitted, we store only a one-way scrambled (“hashed”) version of your IP address, never the address itself.

We also count visits to each page. This is aggregate only — how many people saw a page and which site they came from. It is not tied to your account, your checks, or you.

• We do not sell your information.
• We do not require an account to run a check.
• We never show the message you checked to anyone else.
• We do not publish your surname, your email, your phone number, or your address — and never what you checked. The only thing that can appear publicly is your first name and last initial on our homepage, described above, which you can switch off.
• We do not put personal or sensitive data into web addresses or share it with third parties for advertising.

Deleting your account removes your profile, your saved reports, your check history, and your reporting receipts, and takes your name off the homepage.

You can also do any of these on their own, at any time: delete individual saved reports from My Reports, clear your profile details, or switch off the homepage board — which also removes your name from anything already showing.

For anything else — or to ask us to remove data across all our systems — use the Contact page and we’ll take care of it.

You never need to give ScamSplain your full card number, passwords, PINs, or Social Security number, and we ask that you don’t include them in reports, feedback, or messages.

If we make meaningful changes to this policy, we’ll update the date at the top. Questions about privacy? Use our Contact page.