Privacy

Last updated: 2026-09-12

Short version: no accounts, no analytics, no ad networks, no fingerprinting, no third-party trackers, no data sold. We use three first-party cookies, a little on-device browser storage for display preferences, and a handful of aggregate counters. Scam checks are answered by our own matching code on our own infrastructure — no AI model reads your query, and your query text is never stored.

What we collect

We collect aggregate, non-identifying counters (e.g. "the total number of times the home page has been viewed") and we set three first-party cookies to remember your preferences. We do not collect names, email addresses, phone numbers, payment information, or any other personal data, because the site never asks for them.

Cookies

These are the only cookies set by this site. None of them are used for advertising, none are shared with third parties, and all are first-party (set by isthatascam.com).

• itas_loc (90 days) — Stores your chosen country/language (e.g. in/hi) so that future visits to the homepage don't bounce you to a default. Set only when you explicitly pick a country or language from the header.
• itas_counted (24 hours) — A flag that prevents the same browser from inflating the visit counter on refresh. Contains the literal value 1 and nothing else.
• itas_thanked (90 days) — A flag that prevents the same browser from voting twice on the "This helped me" button. Contains a literal flag value and nothing else.

We also keep three display preferences in your browser's local storage, which never leaves your device and is never sent to us: itas_theme (light/dark), itas_textsize (large-text mode), and isthatascam:choice (your last country/language pick on the front page). Clearing your browser's site data removes all of them.

Scam-check query handling

When you type or speak into the search box and submit, your query text, country code, and language are sent to a Cloudflare Pages Function on our own infrastructure. That Function:

• Matches your query against our own public scam catalog using a deterministic text-matching algorithm (BM25) that runs entirely inside the Function. No AI model is involved, and your query is not sent to any third-party service — not to an AI provider, not to anyone.
• Returns the verdict, red flags, and what-to-do steps to your browser.
• Briefly caches the response (a few minutes) keyed on a hash of the normalized query, so repeat questions get a fast answer. The hash cannot be reversed into your text, and nothing links it to you.

We do not store your query text. When a query matches no known pattern, we count which words from a fixed scam-vocabulary list it contained — see "Aggregate counters" below; the text itself is never kept in any form.

Website / job-offer checker (/verify)

When you submit something on the /verify page, the text you enter — a website link, a domain, or, if you choose to paste one, an email address — is sent to a Cloudflare Pages Function on our own infrastructure. That Function:

• Extracts just the domain and uses it to query a public domain-registration lookup service (RDAP, the ICANN-standard successor to WHOIS) and to check whether the domain serves a working HTTPS site.
• Returns the resulting signals to your browser.
• Caches the result at Cloudflare's edge for up to 24 hours, keyed only on the bare domain — never on you, your IP, or the full text you entered.

We do not store the text you submit, do not log it, and do not associate it with you. If you paste an email address, only the part after the @ (the domain) is used; you do not need to enter an email for the tool to work. The Trustpilot, BBB, Google, and ICANN buttons are ordinary outbound links — clicking one takes you to that independent third party under their terms and privacy policy; we are not told whether you clicked, and we send them nothing beyond the domain in the link you choose to open. Before each check you confirm an "I understand" acknowledgement; this is a momentary on-page step only — nothing about it is stored in your browser or sent to us.

Scam report form (/report)

When you submit the anonymous report form, the description you write (plus the country/language of the page and, if you chose one, the contact channel) is sent to a Cloudflare Pages Function on our own infrastructure and stored in Cloudflare KV for up to 90 days, then deleted automatically. Before storing, the Function automatically removes email addresses and long number sequences (phone, card, account numbers). We use reports solely to update the public scam catalog.

• No name, email, IP address, or any identifier is collected with a report — there is no way for us to know who submitted one, and nothing to link a report to you.
• Please don't include personal details in the description; if you do, the automatic redaction plus a manual review pass removes what it catches before any of the text influences the catalog.
• Report text is never published or rendered on the site. It is read only by the site's maintainers and the automated routine that drafts catalog updates for human review.

Aggregate counters

We keep a handful of counters in Cloudflare KV storage. None of them contains any identifier tied to you:

• Total visits since launch.
• Visits per day (last 90 days, then expired).
• Visits per country — the two-letter country code Cloudflare attaches to each request, counted as a bare number per country (shown publicly on /stats). No IP address or any other request detail is stored with it.
• Total scam checks performed.
• Scam checks per day (used to enforce a daily persistence cap that keeps us inside Cloudflare's free tier).
• When a check matches no known scam pattern, a per-day, per-country tally of which words from a fixed scam-vocabulary list built into the site (words like "refund", "otp", "parcel") appeared in unmatched queries (kept 35 days). This tells us which scam types our catalog is missing so we can add them. Only counts of those fixed list-words are recorded — the text you typed is never stored, and words not on the list (names, numbers, anything personal) are never recorded in any form.

These exist so we can show the visit counter on the site and avoid exceeding Cloudflare's free tier. They do not contain IP addresses, query content, or any identifier tied to you.

Voice input

Voice transcription uses your browser's built-in SpeechRecognition API. The audio is transcribed by your browser (or, on some browsers, sent to your device's OS or to that browser's own speech service per its policy — Apple, Google, Microsoft). We do not record audio, and audio never reaches our servers. Only the resulting text is sent when you submit.

WhatsApp updates channel

We operate optional WhatsApp Channels that broadcast scam alerts. They are one-directional: we post, followers cannot reply, and the channel cannot message you privately.

• We never receive your phone number, name, or any identity. WhatsApp Channels are designed so that channel admins cannot see who follows them. We keep no follower list — there is nothing on our side to store, export, correlate, or delete.
• Following a channel is a relationship between you and WhatsApp/Meta, governed by WhatsApp's own privacy policy, not ours. Your contact details stay with WhatsApp; they are never shared with us.
• We will never direct-message you, ask for money, an OTP, or personal details, or send payment links. Anyone doing that in our name is impersonating us — our official channel links are published only on this site.
• You can unfollow at any time inside WhatsApp. Because we hold nothing about you, no further action is needed on our side.

What we don't do

• No Google Analytics, Plausible, Mixpanel, Segment, or any other analytics service.
• No advertising networks, no remarketing pixels.
• No browser fingerprinting.
• No third-party scripts, stylesheets, or fonts. The search index (Pagefind) and the site's fonts all ship as static assets from this site's own domain — your browser makes no request to any other company's servers while using this site.
• No accounts. No email newsletter. No lead capture. No "free trial."
• No sale, license, or sharing of any data — there is nothing to sell.

Server logs

Cloudflare, which hosts and serves this site, automatically logs standard request data (IP address, time, URL, user agent) at the edge per their own retention policy. We do not query, export, or correlate those logs with anything. They exist for Cloudflare's network operations and security, not for us.

Your rights

We don't hold anything tied to you, so there is no data of yours to export, correct, or delete. If you have a question or want to confirm any of the above, email [email protected].

Children

This site is intended for adults. We don't knowingly collect any data about anyone, let alone children under 13.

Changes to this policy

If our data practices change, we update this page and the "last updated" date at the top. This site is version-controlled in a public-history way; changes to this page can be reviewed in the commit log.