Privacy policy

Who we are

Scam Judge (called Juez de Estafas in Spanish and Juiz de Golpes in Portuguese) is made by Cyberguide Dad and operated by [Operator legal name] ("we", "us"). For any privacy question or request, email daniel@cyberguidedad.com.

What you send us to check

When you run a check, you send the content you want checked: text you type or paste, links, text read from a screenshot, or the text of what you said using voice input.

We use that content only to produce your verdict and advice. Scam Judge does not save the content you check or your results: there is no database of checks and no history. Checked content is kept out of our logs and telemetry.

Because nothing is saved, we can't show you a past result again or recover it later.

Screenshots

Screenshots are read on your device: on the website, inside your browser; in the apps, on your phone. Only the text found in the image is sent for checking. The image itself is never uploaded.

Voice input

• On the website, voice input uses your browser's built-in speech recognition. Depending on your browser, the browser maker's online speech service may process the audio under its own privacy terms.
• In the apps, voice input uses on-device speech recognition when your phone supports it for your language. When it doesn't, it uses your phone's speech service (Google on Android, Apple on iOS), which may process the audio on its servers under its own privacy terms.

Scam Judge never receives your audio, only the resulting text, which is handled like any other text you check.

Services that help analyze your check

To produce a verdict, the content you submit, or parts of it such as links, domains, phone numbers, email addresses, or crypto wallet addresses found in it, may be sent to these services. Not every service is used on every check, and each one handles the data under its own terms:

• Azure OpenAI (Microsoft) reads the text to assess it. Microsoft's abuse monitoring may keep a sample of requests and responses for review by authorized Microsoft staff when its systems flag possible misuse. Microsoft states that this data is not used to train its models.
• VirusTotal, Google Web Risk, and abuse.ch URLhaus check links and domains against lists of known malicious and phishing sites.
• CryptoScamDB checks crypto wallet addresses against reported scam addresses.
• Deep analysis only: IPQualityScore checks phone numbers, email addresses, and links for fraud signals.
• Deep analysis only: Tavily runs a short web search built from the message, with names and account-style numbers removed where possible, to add context about recent events and organizations.

Human verification and abuse prevention

To keep out bots and abuse, Scam Judge uses Cloudflare Turnstile, which looks at information about your browser or device, including your IP address, to tell people apart from automated traffic, under Cloudflare's privacy policy. After you pass, a short-lived verification token is kept on your device so you don't have to repeat the check every time.

Our server also keeps short-lived usage counters by IP address in memory, for at most a day, to slow down scripted abuse. They are not written to logs or a database, and we don't log IP addresses.

Anonymous device identifier

The website and the apps create a random identifier for your device. It is used so that a paid deep analysis can only be used on the device that bought it. It is not linked to your name, an account, or your phone's hardware identifiers. The website keeps it in your browser's local storage; the apps keep it in secure storage on your phone.

Payments

Website: the optional deep analysis and donations are paid through Stripe. You enter your payment details with Stripe, not with us, and we never see your full card number. Stripe keeps the payment status and minimal unlock details (the product, the anonymous device identifier, and whether the deep analysis has been used) so the purchase can be verified and refunds stay possible. Stripe handles payment data under its own privacy policy and may use its own cookies for fraud prevention.

Apps: purchases are made through Google Play or the Apple App Store, under their terms. To verify a purchase and make sure it is used only once, our server checks it with Google or Apple and keeps a purchase record that contains only:

• the store (Google or Apple) and the product
• a hashed (scrambled) purchase identifier
• a hashed version of your anonymous device identifier
• the purchase status and when it changed (for example purchased, used, refunded)
• order or store reference numbers
• the store's purchase token, only when it is needed to finish the purchase with Google

The purchase record never contains the messages you check, your results, or your name. We keep it for about 400 days after the purchase is used, refunded, or voided, and then delete it, unless the law or accounting rules require us to keep it longer.

Analytics and diagnostics

When enabled, we use Microsoft Azure Application Insights to understand traffic and keep the service running:

• On the website, analytics is cookieless. It records page views and a few events, such as a check being run or a payment completing, never the content you check.
• Our server records technical events such as errors, response times, and verdict categories, without the content you check.
• Application Insights estimates an approximate location from your IP address and then discards the IP address.

The apps don't add their own analytics or crash reporting. Google or Apple may collect diagnostics according to your phone's settings.

Reports and feedback

If you choose to send a report (for example, that a result was wrong), it is filed as an issue in our GitHub repository so we can review it. It includes what you write, your language, and, only if you tick the box to include it, the checked content and its result. GitHub stores these reports under its own terms. Please don't include personal information. To have a report deleted, email daniel@cyberguidedad.com.

Cookies and storage on your device

Scam Judge sets one cookie, sj-locale, to remember your language. The website also keeps a few items in your browser's local storage: the anonymous device identifier, the human-verification token, an unlocked deep analysis if you bought one, and your light or dark theme choice. You can clear them in your browser settings at any time.

What we don't do

• No accounts or logins.
• No ads.
• We don't sell your personal information or share it for advertising.
• We don't track you across other apps or websites.

Where data is processed and how it is protected

Scam Judge runs on Microsoft Azure. Information is encrypted in transit (HTTPS). The services described above may process data in countries other than yours, including the United States.

Children

Scam Judge is meant for adults 18 and older and is not directed to children. We don't knowingly collect personal information from children. If you believe a child has sent us personal information, email daniel@cyberguidedad.com and we will help remove what we can.

Your choices and rights

Because there are no accounts and we don't save what you check, we usually hold nothing that identifies you. You can still email daniel@cyberguidedad.com to ask what we hold, or to have it corrected or deleted.

• For an app purchase record, include the purchase details from Google Play or Apple (such as the order number or transaction ID) so we can find it.
• For a website payment, include your Stripe receipt.

Depending on where you live, local data protection law may give you additional rights, including the right to complain to your data protection authority.

Changes to this policy

If our practices change, we will update this page and its effective date.

Contact

[Operator legal name]: daniel@cyberguidedad.com