WHAT WE KEEP. (ALMOST NOTHING.)

Screenshots

Your screenshot is re-encoded in your browser (which strips photo metadata), uploaded to a short-lived private storage area, read once to extract its text, and deleted immediately afterwards — whatever the outcome. A background job removes anything older than 15 minutes as a backstop. Screenshots are never used to train models.

Links and extracted text

Links are never opened in your browser. Our server looks up public records and follows redirects without loading page content. The link and any extracted text are held only for the analysis and are not stored unless you choose to save a report.

Saved reports

If you click “Save report”, we store the score, findings and a defanged display of the input — never the screenshot or its full text. Saved reports expire after 30 days, are reachable only by their unguessable link, and can be deleted at any time with the delete code shown when you save.

Rate limiting

To prevent abuse we keep a salted, one-way hash of your network address for up to two days. The raw address is never stored.

Third parties that may receive data

• Lovable AI (text extraction and wording analysis) — receives the screenshot or its text.
• Google Safe Browsing, URLhaus, PhishTank and VirusTotal, when enabled — receive only the link or domain, never screenshots.
• Cloudflare DNS, rdap.org and crt.sh — receive only the domain name.

Logs

We log only job IDs, stage timings and error codes — never submitted text, links or images.