What we keep, and what we don’t

Scanning a link or a QR code

We store the link or code you checked and the result, so the checks can improve and a domain’s history builds up. We do not store your IP address; we store a salted hash of it to count scans per connection, and that hash cannot be turned back into the address. A Wi-Fi QR code’s password is removed before anything is stored.

Looking up a seller or account

A lookup is not stored against you. A phone number, email address or bank account number is hashed before it is looked up; the number or address itself is never written down.

Signing in

Signing in with Google or LINE asks for your account id and nothing else: no e-mail, no name, no picture. We store a salted hash of that id, which lets us recognise the same person next time and nothing more. A username account stores the username and a hash of the password. We cannot e-mail you, because we do not know your e-mail.

Filing a report

A report keeps what you typed about the account you report: the name, the LINE ID, the hashed phone number, email address or account number, the reason you picked, and the note and link if you added them. The note and link are seen by our reviewers only; visitors see counts, dates and reasons. The report is tied to your hashed sign-in so that one person is counted once, and carries the same salted hash of your connection that a scan does, so that “many reports” means many different people.

Deleting your account

You can delete your account on the sign-in page. We erase your username, your password and the link to your Google or LINE sign-in, and sign you out. The reports you filed stay up and keep counting, because other people rely on them, but they are no longer linked to any sign-in.

Advertising

Adverts from Google AdSense appear only in fixed places we chose: at the bottom of pages, in one space under each tool, and after each article. None is ever placed inside a scan result, and a shared result, the answer to a lookup and a report you filed carry none at all. Google and its partners use cookies to choose those adverts, including from your visits to other sites. We do not pass what you check or report to Google or to any ad network.

You can turn off personalised adverts in Google’s Ads Settings, and read how Google uses information from sites that show its ads: Ads Settings · How Google uses this information

Cookies

A session cookie keeps you signed in, and a CSRF cookie protects the forms. Our hosting service adds one more, ARRAffinity, which only sends your visit back to the same server. On pages with adverts, Google may also set its own advertising cookies. No other cookies are set.