Privacy

When you press check, the text you pasted is sent from your browser to our server, and from there to Google's Gemini API, where the Gemini 2.5 Flash model analyses it. The result comes back to our server and is passed straight to your browser.

Our code doesn't save your message to a database, and doesn't write the message text to our logs. Nothing about it is attached to an account, because there are no accounts.

Google receives the text in order to analyse it. We use Google's paid Gemini API, and under Google's terms for paid use, Google doesn't use what you send to improve its products; it may keep it for a limited time to detect abuse. The details are covered by Google's Gemini API terms, not by us. This is one more reason never to paste passwords, one-time codes, Social Security numbers, or full card or account numbers. None of them are needed to spot a scam.

To stop the checker being abused, each IP address can run 10 checks a minute and 100 a day, and make 5 waitlist signups an hour. Your IP address is read from the request your browser makes and used to count against those limits. The counts are kept in a database run by Upstash (Redis).

The counters themselves expire on their own:

• The per-minute check counter is deleted after about 2 minutes.
• The daily check counter is deleted after about 2 days.
• The hourly signup counter is deleted after about 2 hours.

We don't keep usage statistics or a history of your requests in that database; only the counters above, which expire on their own.

If you join the waitlist, we store exactly four things, in the same Upstash database:

• your email address (in lowercase),
• that you ticked the consent box,
• which page you signed up from (for example home or usps-text-scam),
• the date and time you signed up.

We don't store your IP address or browser details with your signup, apart from the separate usage-limit counting described above. Nothing is stored unless you tick the consent box. We don't send confirmation emails, and the waitlist is the only place we collect an email address.

You can ask us to delete your email address at any time by writing to support@isthisascam.fyi.

We use Vercel Web Analytics to count page views, so we can see which pages people use. The analytics script on our pages doesn't set cookies or store anything in your browser. Vercel describes what it collects in its analytics privacy documentation.

Our code doesn't set any cookies and doesn't use your browser's local storage.

The site is hosted on Vercel. Like any web host, Vercel handles every request to the site, which includes your IP address. Our own error logging records technical errors, not the text of your message.

If what we collect changes, this page changes with it and the date at the top moves. See the About page for how the checker works.