In short: ScamMinder helps you assess website safety. We collect only the information needed to run the service, secure it, and improve accuracy. For the ScamMinder browser extension, what is sent depends on the privacy mode you choose: for routine safety lookups in its default mode we receive only a 4-character one-way hash prefix of the website’s host, never the host itself, and an analysis you explicitly request with “Analyze now” sends the website’s hostname (see section 3).
1. Scope
This Privacy Policy applies to information collected through:
- the ScamMinder website and related pages,
- our APIs (including premium/API key features),
- the ScamMinder browser extension for Chrome, Edge and Firefox,
- support channels (chat, email), and
- any related services we operate.
A. Information you provide
- Account information: username, email address, password (stored hashed), and profile details you choose to provide.
- Support / contact: messages you send via contact forms, chat, or email (and any attachments you submit).
- Reports: scam reports and text you submit when reporting a website.
- Verification / compliance: if you request verification or premium features, we may collect information necessary to complete that process (for example, proof-of-ownership details and billing/contact information).
- Payments: payment status and order metadata (payment processing is handled by our payment provider; we do not store full card details on our servers).
B. Information collected automatically
- Technical and log data: IP address, timestamps, request metadata, browser/device information, and diagnostic logs used for security and reliability.
- Usage data: how you interact with features (e.g., pages visited within ScamMinder, feature usage, and aggregate metrics).
- Cookies / local storage: used for authentication, preferences, and service functionality.
C. Website analysis data (public web content)
ScamMinder analyzes websites to generate safety insights. Depending on the feature and the website being analyzed, we may process:
- Website identifiers: domain/hostname and related URLs needed to perform analysis.
- Publicly available site data: page metadata, technical signals (e.g., SSL, redirects), and limited scraped content required for analysis.
- Safety artifacts: analysis summaries, scores, flags, and (where applicable) screenshots or previews used to display results.
3. Browser extension (Chrome, Edge and Firefox)
In short: The ScamMinder browser extension has three privacy modes. In Local mode nothing about the sites you visit leaves your device. In Domain check, the default, we receive only the first four characters of a one-way hash of the website's host, which names one of 65,536 groups of sites, and the match itself happens on your device. In Full page check, which you have to switch on yourself, we receive the page address with its query string and fragment removed. A routine safety lookup writes no database record: we store no visit, no hostname and no network address for it.
What is sent in each privacy mode
| Mode | What leaves your device | Example |
|---|
| Local | Nothing about the site you are on. The extension answers from an offline list of confirmed scam domains, which it refreshes about every six hours, plus a small configuration file it refreshes about once a day. | — |
| Domain check (the default) | The first 4 hexadecimal characters of the SHA-256 hash of the website's host. Those 4 characters name one of 65,536 buckets; the server returns the whole bucket and your browser decides whether the site you are on is in it. We never receive the host itself. | example.com → a379 |
| Full page check (you switch it on) | The website's host and the page path, without the scheme, the query string or the fragment. | example.com/offers/winter |
“Analyze now” — the one exception
These modes govern routine safety lookups. If you explicitly select “Analyze now,” the extension sends the website’s hostname to ScamMinder to request a new analysis, regardless of the selected privacy mode.
- What we record: that request starts work on our side, so it is written down. We record an analysis session carrying that hostname, and a usage record for the daily and monthly analysis limits, keyed on a one-way hash of the network address the request came from.
- Your account: if you have connected an account, this request may also carry your extension key. Our analysis service does not read that key: it does not authenticate the request as your account and stores no link between the request and your account.
- The report: the analysis is then published on ScamMinder as the public report for that website, like every other report. It does not name you and does not say who asked for it.
- How long: a finished analysis session is deleted once it is more than 24 hours old; the usage record is kept as part of our service records.
Automatic checking and search results
- Automatic checking is off when you install the extension. Until you grant the extension access to the sites you visit and switch it on, a site is checked only when you open the extension's popup or side panel yourself, or use its right-click menu.
- Search results: while automatic checking is on, the extension can mark the results on a search page. It sends hashed prefixes for the result domains and never the result addresses — in every mode, including Full page check, because you have not visited those pages.
Pseudonymous installation ID
- What it is: every request the extension makes carries a random identifier created when you install it, together with the extension version. It is not a name and not an account: it identifies an installation, and we use it only for rate limits that are held in memory and never written down.
- Routine safety lookups: for the domain, offline-list and full-page verdict reads the extension makes while you browse, we write no database record at all — no hostname, no network address and no browsing history.
- Operational logs: our servers keep short-term operational error logs, which can include a requested address; our CDN provider processes connection data under its own terms.
- When you are connected: if you connect an account, the extension attaches your extension key to its requests to ScamMinder. The services that answer routine lookups, “Analyze now” and message and screenshot checks do not read that key and store no link to your account — but because the key travels with those requests, we do not describe requests made while you are connected as anonymous.
Message and image checks (optional, and only when you ask)
- Check a message: the text you paste (up to 10,000 characters) is sent when you press the button, and only then.
- Check a screenshot: the image you choose (up to 10 MB) is sent when you choose it, and only then. It is re-encoded to WebP when it arrives, which drops the metadata (such as EXIF and GPS data) the original file carried.
- On Firefox both features ask for Firefox's optional data-collection permission first. If you refuse, nothing is sent.
- These submissions are kept for 30 days and deleted at the next daily cleanup after that; the network address a submission came from is erased at the first daily cleanup after 48 hours; an uploaded image is deleted together with its record.
- These periods apply to ScamMinder's own systems. A message or screenshot sent to our AI provider is handled under that provider's terms.
Account connection and your extension key
Connecting an account is optional. You sign in on the ScamMinder website, which issues a one-time code valid for 120 seconds and held in memory only; the extension exchanges that code for an extension key. The key is stored in your browser's local extension storage on your device, is sent only to ScamMinder and only as a request header — never in a web address — and is never logged. On our side we keep only a one-way hash of it. On Firefox the key is sent only while the optional account-data permission is granted: withdrawing that permission stops it at once and disconnects the account.
What the extension never collects
- No text from the websites you visit: the extension does not read or transmit text entered into other websites’ forms, passwords, or private messages. Text you explicitly submit through “Check a message” is processed as described above. The notice that can appear beside a password or card field reads only that field's
type, name, id and autocomplete attributes and its position on screen — never its contents.
- No ads, no analytics, no telemetry: the extension loads no advertising, contains no analytics or telemetry library and sends no crash or error reports. It makes requests to ScamMinder and to no other service.
- Reporting a site sends nothing by itself: the extension opens a page on the ScamMinder website, and whatever you submit there you submit to the website.
- We do not sell personal information.
How long we keep it
| What | How long |
|---|
| Routine safety lookups | No database record is written. There is no row, no hostname and no address to keep. |
| An analysis you requested with “Analyze now” | The analysis session, which carries the hostname, is deleted once it is more than 24 hours old; the usage record behind the analysis limits is kept as part of our service records; the report itself stays published on ScamMinder. |
| Messages and screenshots | 30 days; the network address they were sent from, 48 hours. |
| Extension key | As a one-way hash, for as long as the key exists. You can disconnect at any time. |
Who processes it
- ScamMinder — the service itself.
- Our hosting and CDN provider (Cloudflare) — every request to ScamMinder passes through it, so it processes the network address the request came from.
- Our object storage (Cloudflare R2) — a screenshot you upload is stored there until it is deleted.
- An AI model provider (OpenAI) — a message or screenshot you submit for a check is sent to it for analysis.
Your choices
- Change the privacy mode at any time in the extension's settings, including Local mode, which sends nothing about the sites you visit.
- Turn automatic checking off, or never grant access to the sites you visit — the extension still works when you open it yourself.
- On Firefox, withdraw the optional data-collection permissions in the browser's add-on settings. Withdrawing the account-data permission also disconnects your account.
- Disconnect your account in the extension's settings, which deletes the stored key from your device.
- Uninstall the extension at any time.
4. How we use information
We use information we collect to:
- provide website analysis, safety scores, reports, and related features,
- operate accounts, authentication, and user preferences,
- process one-time purchases and provide Premium and API features,
- prevent abuse, enforce usage limits, and secure the platform,
- respond to support requests and scam reports,
- improve model quality and product performance (in aggregate and as needed for debugging).
5. Sharing and third parties
In short: We do not sell your personal information. We share information only to operate the service, comply with law, or protect rights.
We may share information with:
- Service providers (hosting, storage/CDN, email delivery, analytics, and operational tooling) to run ScamMinder.
- Payment processors (to process one-time payments; nothing renews by itself).
- AI and security providers used to generate analysis and protect the service (where applicable).
- Legal/Compliance if required by law or to protect our users and platform.
6. Cookies, tracking and advertising
We may use cookies and similar technologies to keep you logged in, remember preferences, and measure performance. You can control cookies through your browser settings.
Advertising and Google AdSense
ScamMinder's free service is supported by advertising. We use Google AdSense to serve ads on some pages.
- Third-party vendors, including Google, use cookies (such as the Google advertising cookie) to serve ads based on your prior visits to this website or other websites.
- Google's use of advertising cookies enables it and its partners to serve ads based on your visits to this site and/or other sites on the Internet.
- You may opt out of personalized advertising by visiting Google Ads Settings, or opt out of some third-party vendors' cookie use at www.aboutads.info.
- Advertisements are always labelled. ScamMinder's verdicts, trust scores, and analysis explanations are generated independently of advertising and are never influenced by advertisers.
- Users in the European Economic Area, the UK, and Switzerland are shown a consent message (Google-certified consent management) before personalized ads are served.
7. Data retention
We retain information only as long as necessary for service operation, security, fraud prevention, dispute resolution, and legal compliance.
8. Security
We use organizational and technical measures to protect information. No method of transmission or storage is 100% secure; we continuously improve safeguards.
9. Your choices and rights
- Access, update, or delete your account information (where applicable).
- Disable extension features (such as auto-check and notifications) in extension settings.
- Uninstall the extension at any time.
- Contact us to request help with privacy-related questions.
10. Children
ScamMinder is not directed to children under 18, and we do not knowingly collect personal information from children.
11. Policy updates
We may update this policy from time to time. We post the updated version on this page, and the “Last updated” date shown at the top of the page changes with it.
If you have questions about this Privacy Policy, contact us at support@scamminder.com.