ScamSach

Privacy

ScamSach is a free, non-commercial personal project. It has no ads, does not sell data and uses no tracking or advertising cookies. This page explains in plain words what happens to what you paste.

When you check a message

  • Before any AI sees your message, we replace phone numbers, bank account, card, Aadhaar and PAN numbers, UPI IDs, email addresses, OTPs and vehicle numbers with labels like [PHONE_1].
  • The masked message is read by an AI service: Google Gemini, or Groq as a backup. Free AI plans may use what they receive to improve their services, which is why we mask it first.
  • Links in the message are looked up, not opened, at Google Safe Browsing, VirusTotal and URLhaus. We also look up when the website was registered in the public domain registry (RDAP).
  • We never visit the links you paste. For short links such as bit.ly we only ask the link-shortening service where the link points.

What we keep

  • Not logged in: your check is not saved to any account. A masked copy of the result is kept for up to 2 days so that the same message gets an instant answer. It is filed under a scrambled code, not under your name or IP address.
  • Logged in with Google: we keep your Google email address and name (for login), and your checks (the masked message and the result) and follow-up questions, until you delete them. "Delete all my data" on My past checks removes them straight away.
  • Feedback: we keep your rating and your comment (masked). We keep the masked message only if you tick "share this message".
  • Your IP address is used only in the server's memory, to limit how many checks one connection can make. It is not saved in our database. The server's technical logs on Render record things like IP address and which page was requested, but not your message.
  • To find and fix mistakes, the agent's steps are recorded in Langfuse using the masked text only.
  • Your login session is kept in your own browser so that you stay logged in.

Services ScamSach uses

  • Supabase (database and Google login), Render (server), Vercel (website).
  • Google Gemini and Groq (AI). Google Safe Browsing, VirusTotal and URLhaus (link checks). Langfuse (recording the agent's steps).

Please remember

  • ScamSach gives guidance, not a guarantee. When in doubt, contact the organisation through its official app, website or the number on your card.
  • Do not paste passwords, full card numbers or PINs. ScamSach never needs them.

Questions or a request to delete data? Open an issue on the project's GitHub page: github.com/apurvaraj9/scamsach/issues

Last updated: 25 October 2026

Check a message