What this site counts, what it costs.

This month

Numbers right now.

Cached for up to 5 minutes at the edge. Counters are aggregate. No per-user or per-message data.

All time

Since launch.

What is recorded

Exactly this, nothing more.

• The aggregate counters above. No per-user or per-message data.
• A SHA-256 hash of the caller's IP for rate limiting. 20 checks per hour per IP on the web, 15 per hour for the report-an-issue form, 10 per hour per chat ID for Telegram. The hash expires after the rate-limit window.
• A SHA-256 hash of a normalized version of repeated scam patterns ("Seen 247 times this month"). Numbers, URLs, emails, and money amounts are replaced with placeholders before hashing, so the hash represents a category, not your input.
• Cloudflare Web Analytics records anonymous traffic counts server-side, no cookies, no fingerprinting.
• Google Analytics 4 is loaded on the home page, the transparency page, and the scam guide pages, with IP anonymisation enabled. It uses cookies (the _ga and _ga_* identifiers) to count page views. It is never run against the content you paste into the checker, and the analysis API is not instrumented. If you would prefer to opt out, install a content blocker or set your browser's "do not track" signal.
• Monthly Gemini API cost is tracked so the worker can stop calling Gemini if the free monthly budget is exceeded.
• For the report-an-issue modal: if you write a message and click Send, that exact message (and your email if you provided one) is forwarded to Hugo's inbox via Resend. Nothing about the report is stored on this site after the email is sent.

What is never recorded

Never.

• The text or image you paste in for analysis.
• Your IP address in plain form. Only the hashed form for rate limiting.
• Cookies. There are none.
• Account, name, or persistent identity. The site has no signup.
• Cross-session behavior. Every visit starts fresh.
• Anything in your follow-up questions or recovery checklist.

Where data goes

Who else sees what.

• Google Gemini sees the message or image you submit and returns an analysis. Inputs are not used for training when accessed via API key (per Google's terms). No copy is kept after the analysis returns.
• Google Safe Browsing sees URLs found in your input so we can flag known-malicious links. Google logs usage.
• VirusTotal sees URLs found in your input so we can cross-check against 90+ antivirus engines. VirusTotal logs the lookups and aggregates submissions publicly.
• Cloudflare URL Scanner sees URLs found in your input so we can pull verdicts and categories from Cloudflare's own threat intel. Cloudflare logs the lookups.
• Domain registries (RDAP) see lookups for the registrable domain of each URL so we can surface the domain's registration date. The lookups are public; registries see standard request metadata.
• Cloudflare hosts the worker and serves the page. Cloudflare sees standard request metadata (IP, headers, geo) for routing.
• Resend handles the report-an-issue email. They see what you write in the form, only when you click Send.
• Cloudflare Turnstile handles the captcha on the report form. It sees whether a captcha was solved, not the form content.
• Telegram (if you use the bot) routes the message through their servers. This is outside our control. For the strongest privacy, use the web version in a private browser tab.