Privacy Policy

Last updated: 29 October 2026

1. Overview

IsThisSpam helps users assess suspicious emails, messages, links, and websites. We aim to minimise data collection, be transparent about what is processed, and give users meaningful control over how scans are handled.

This policy explains what data is processed, how it is used, and how different features affect data handling.

2. What data IsThisSpam processes

IsThisSpam processes content submitted for analysis, either manually or through optional automated features.

Depending on your settings and usage, this may include:

• a) Personal communications: Email content or message text submitted for scam or phishing analysis.
• b) Website content: Website URLs or domain names submitted or checked for reputation and risk indicators.
• c) Optional Chrome history preview: Up to 100 unique recent website origins selected after you choose to scan your browser history.
• d) Voluntary scam stories: If you choose to share how a scam affected you, we privately store your story and optional first name for review. We only collect and use an email address for story-related follow-up when you explicitly opt in. We do not automatically publish or quote your story, share its text with product analytics, or add it to public scam-checking results. We would seek separate permission before any publication.

IsThisSpam does not require or intentionally request passwords, authentication credentials, full financial credentials, or sensitive identity documents. Users should not submit these items.

Connected Gmail and Outlook protection

If you explicitly connect an inbox from the dashboard, IsThisSpam uses provider OAuth access to provide the connected-email protection feature. For Gmail, the application requests onlyhttps://www.googleapis.com/auth/gmail.modify. This is needed to read recent Inbox messages for classification and to apply Gmail labels when a message is classified as spam.

• Gmail access is limited to recent messages matching the Inbox surface and the Inbox change notifications needed for monitoring.
• For classification, we process message headers and text content and send only the sender, subject, and a bounded body excerpt to Cloudflare Workers AI as a real-time inference service.
• When a message is classified as spam, we add the Gmail SPAM and Moved by IsThisSpam labels and remove INBOX and UNREAD. We do not send messages, permanently delete messages, or change message content.
• We do not request Gmail contacts, Drive data, Gmail settings, IMAP/SMTP access, or the broader https://mail.google.com/ scope.
• We store the connected account address, encrypted OAuth access/refresh tokens, provider message ID, sender, subject, classification, confidence, bounded reason metadata, and scan timestamp to provide connection and scan-history features.
• We do not intentionally store raw Gmail message bodies or attachment bytes in IsThisSpam's scan-history database.

Google user data obtained through connected email is used only to provide inbox spam protection. It is not sold, used for advertising, used for retargeting, or used to train, fine-tune, or improve generalized or non-personalized artificial-intelligence or machine-learning models. Cloudflare processes the bounded inference request to provide the classification service and does not use Workers AI customer content to train models or improve Cloudflare or third-party services without consent.

Product analytics and campaign measurement

For campaign landing pages such as /protect, IsThisSpam may record limited first-party product analytics such as a normalized traffic source, campaign dimensions, device platform, an opaque session funnel identifier, and whether a checkout step was reached. These dimensions are used to understand the performance of the product journey and are not joined to scan content or mailbox contents.

Browser-extension analytics depend on the installed version. IsThisSpam Chrome extension versions before 5.4.6 may send allowlisted installation, onboarding, permission, protection, scan, sign-in, and plan events. Depending on the version, those events may include a coarse result or breach-result category and an opaque analytics identifier saved in the browser profile until extension data is cleared; they do not include message content, scanned URLs, history lists, or site origins. Starting with IsThisSpam Chrome extension version 5.4.6, the extension sends a narrower set of installation, onboarding, permission/protection setup, sign-in, and plan events. These events may include the extension version and limited categories such as the feature surface or protection type; they do not include scan activity or results, message content, website URLs, history entries, account details, campaign identifiers, or a persistent extension analytics identifier. The analytics endpoint records event names and approved property keys for operational measurement, but does not persist 5.4.6 event property values to the product analytics database. Separate protection and history allowance requests use a random installation identifier; IsThisSpam stores a keyed hash of that identifier for rate limiting rather than the identifier itself. History-preview findings are not sent to product analytics or used to personalize plan offers. Network security logs may process request metadata such as an IP address.

Premium support Messenger

Authenticated premium users may open the Intercom Messenger from the dashboard to contact support. The Messenger receives a short-lived, server-signed identity token containing the account identifier, email address, display name, support tier, and plan key needed to authenticate the support session. IsThisSpam does not send scan contents, uploaded attachments, mailbox contents, passwords, payment credentials, or authentication secrets to Intercom. Intercom may process the support conversation and related account context under its own privacy and retention terms. Free and unauthenticated users are not issued a Messenger token.

Google Ads and Meta may receive limited browser-level page-view, checkout, and purchase events, together with coarse product or transaction values, and may use cookies or similar browser technologies for measurement and retargeting. In regions where opt-in consent is required, these integrations remain disabled until you allow them. For United States visitors, advertising measurement may be enabled by default, subject to an available opt-out. We honour supported Global Privacy Control browser signals as an opt-out. You can review or change the applicable setting through the site's Privacy choices control. IsThisSpam does not send these providers scan content, verdicts, sender details, phone numbers, scanned URLs, email content, connected mailbox data, email addresses, account identifiers, Stripe identifiers, or arbitrary query data. Declining advertising does not prevent you from using the scam checker or other core product features. The/protect funnel does not copy gclid, fbclid, referrer URLs, or arbitrary query parameters into its dedicated first-party event properties.

3. Manual checks vs automated protection

Manual checks

When you explicitly click to check content (for example, pasting an email or clicking “Check this site”):

• The submitted content is processed to generate a verdict and explanation.
• Processing occurs only in response to your action.

IsThisSpam for Outlook add-in

The IsThisSpam add-in for Microsoft Outlook checks emails only when you use it: when you open the IsThisSpam pane on an email, click Scan again or Check draft, or keep the pane pinned while you select other emails.

• For each check, the add-in reads the selected email's subject, sender address and plain-text body and sends them to IsThisSpam over HTTPS for analysis. It does not read attachments, contacts, calendars or other emails in your mailbox.
• The add-in does not send, delete, move or change your emails. If an email looks suspicious, it may add an informational warning bar to that email in Outlook.
• If you turn on send protection, the add-in checks a draft when you click Send. It sends the draft's subject, plain-text body and your email address to IsThisSpam, and warns you if the draft reads like spam. You can still choose to send.
• The add-in stores your send-protection settings and a random installation identifier in Outlook's add-in settings for your mailbox. The identifier is used only to count free checks; our servers keep a keyed hash of it with counters and timestamps.
• If you sign in from the add-in, it stores an access token, a rotating refresh token and your account email in the add-in's local storage in Outlook. Signing out removes them and revokes the session.
• Checks made without signing in, including send-protection checks, are handled as public checks (Section 4). Checks made while signed in are handled as standard private scans (Section 5).

Browser social investigation beta

When you choose “Check this profile or page”, “Check link without opening”, or “Check selected message”, the extension first shows a preview of the information proposed for analysis. Nothing is submitted until you confirm.

• The preview may include the visible Instagram or TikTok handle, canonical profile URL, visible profile description, external links, or the message text you selected. The source page and visible display name remain on the device.
• Email addresses, phone-shaped values, credentials, URL query parameters, and fragments are removed before submission where detected.
• Exact profile handles or link domains may be sent to Brave Search for public-web matching. Selected message text is not used as a public search query.
• The extension does not submit social-media cookies, login tokens, passwords, full page HTML, screenshots, or browsing history through this feature.

Social investigation requests are processed to return the requested result and are not added to public scan logs. Public-search providers may process request data under their own privacy and retention terms.

Optional Chrome history preview

This feature is available only in extension builds that include the history preview and starts only after you choose to scan and grant Chrome history access. Chrome's permission dialog may describe access across signed-in devices. Starting with IsThisSpam Chrome extension version 5.4.6, the extension checks each candidate visit with Chrome and includes only visits Chrome explicitly marks as local to the current device; synced visits and visits whose local status is unavailable are excluded. Earlier extension versions did not apply this local-device filter and could include visits available from Chrome Sync. In every version, the preview selects up to 100 unique recent website origins from your chosen time range and sends those origins to IsThisSpam for current website risk checks. The request does not include visited page paths, URL queries or fragments, page titles, visit times, cookies, passwords, message contents, or page contents. A finding describes a website now, not what it contained when you visited.

IsThisSpam may send the origin, root URL or domain to Google Web Risk, Phish.sinking.yachts, AlienVault OTX, a WHOIS/domain-lookup provider (RapidAPI or whois.vu), or Microsoft Azure OpenAI through IsThisSpam's Cloudflare-hosted AI proxy when those checks are used. The website information sent for this preview is limited to the origin/root URL and domain. These providers process requests under their own privacy and retention terms. The preview is excluded from IsThisSpam's public-scan database and product analytics. Temporary website-risk caches and processing state may remain in server memory as described below.

In IsThisSpam Chrome extension versions before 5.4.6, the reviewed history-preview build saved selected origins, page titles, visit times, result categories, and short findings in the browser profile; those records were not separately encrypted by the extension and could remain until extension data was cleared or the extension was uninstalled. Starting with extension version 5.4.6, selected site origins, their result categories and findings, and limited run metadata are encrypted for resume/review in the local Chrome profile with AES-GCM, using a non-extractable per-profile key held in extension-origin IndexedDB. Page titles and visit times are used transiently to select recent local visits and are not saved in the preview record or sent. This protects records at rest in extension storage, but not against a compromised browser profile or code already running in the extension.

Server-side allowance records contain keyed hashes of the installation identifier, checked hostname, and network address, plus a random preview identifier, counters and timestamps; they do not contain the original history list. These records are retained to enforce the one-time allowance and prevent abuse. The preview does not use your browsing history for advertising or transmit it to product analytics.

Extension account and local storage

When you connect an account, the extension stores an access token, a rotating refresh token and profile fields such as your email, name and plan in the browser profile. Starting with IsThisSpam Chrome extension version 5.4.6, these values are encrypted locally with AES-GCM using the per-profile key described above; earlier versions did not separately encrypt account tokens or profile fields. Version 5.4.6 and later also encrypt configured provider/license keys, local scan reports and caches, trusted senders/sites, website-check history, and breach results. Earlier versions did not separately encrypt all these records; some encrypted configured provider keys using an extension-derived key. On upgrade to 5.4.6, supported legacy records are migrated to the new encryption format and history-preview records are reduced to the fields needed for results. Tokens are sent to IsThisSpam's authentication and account services as needed, not in message or website analysis payloads. If you configure your own AI provider, its API key is encrypted on-device in version 5.4.6 and later, then sent with content only to the provider you select when you request an analysis. A local model setting sends content only to the server address you configure.

Automated protection (optional)

If you enable automated protection features in the extension settings:

• URLs of websites you visit may be automatically checked against our threat detection services.
• This occurs only when the feature is enabled by the user and can be disabled at any time.
• On the free plan, the extension sends the address of each page you open with its path but without query strings, fragments or credentials (for example, https://example.com/account/login, never anything after a ? or #), plus a random installation identifier. Page titles and page contents are not sent through this reputation-only request. We check that address against available threat intelligence providers, including Google Web Risk, Phish.sinking.yachts and AlienVault OTX. Google Web Risk receives the sanitized website address; the domain-based feeds receive the hostname. We may cache the result for that address for up to 30 minutes, and keep a keyed hash of the installation identifier with a request counter to prevent abuse. These checks are not added to public scan logs or stored with your account.
• On paid plans, the website address (without credentials, queries or fragments) may also be analysed by our AI website analysis service.

IsThisSpam does not perform background scanning unless these features are explicitly enabled.

Data breach check (signed-in accounts)

When you are signed in and view your check-up results, IsThisSpam can check whether your account's verified primary email address appears in known public data breaches. The extension never sends an email address; our server looks up your own verified account email and sends it to the XposedOrNot breach service, which processes it under its own privacy terms. The extension caches returned breach names and a result category in the browser profile and reuses a result for up to 12 hours. This is a freshness window, not an automatic deletion timer. Expired or account-mismatched cache entries are deleted the next time the result is requested; until then they remain in the extension profile. In IsThisSpam Chrome extension versions before 5.4.6, cached breach names and results were not separately encrypted by the extension. Version 5.4.6 and later encrypt them locally with the per-profile key described above. The check cannot be used to look up other people's email addresses.

Optional iOS Messages filtering

When you enable IsThisSpam in iOS Messages settings, eligible SMS/MMS messages from unknown senders are sent over HTTPS to IsThisSpam's cloud analysis service for a filtering decision. The service processes the message text and sender information to return that decision; these filter requests are not added to IsThisSpam's public scan history. If Cloud AI is unavailable or does not finish in time, the message stays in your Inbox. The filter does not automatically inspect iMessages or messages from people in your Contacts. You can disable automatic filtering in iOS Messages settings. Do not submit passwords, one-time codes, payment credentials, or other sensitive information for analysis.

4. Free use & public scans (no login)

When you use IsThisSpam without signing in:

Scan content retention

• Standard public checks, excluding SuperScan, may be retained after automated PII scrubbing to improve scam detection accuracy, identify emerging threats, and prevent abuse. SuperScan conversational investigations use the separate 90-day investigation-history retention described in Section 5 below.
• Stored public scan content undergoes automated PII scrubbing to redact sensitive information such as email addresses, phone numbers, and credit card numbers before storage.

⚠️ Please do not submit sensitive personal information (such as passwords, financial details, or government identifiers) to the public checker. While we use automated scrubbing, avoiding submission of sensitive data is the safest practice.

Abuse prevention

We generate anonymised identifiers, such as cryptographic hashes of IP addresses, solely for:

• Rate limiting
• Abuse detection
• Preventing automated misuse

These identifiers are not used for tracking or advertising. Public scan data is not linked to named accounts and is never sold or used for marketing purposes.

5. Optional sign-up, private scanning & SuperScan investigations

Creating an account is optional. Data handling depends on whether you use standard private scanning or the conversational SuperScan investigation tool:

Standard private scans

For logged-in users and authenticated license holders using standard single-turn checks (e.g. homepage, website, or extension scanners):

• Private processing: Submitted content is processed by IsThisSpam and the analysis providers used for the requested check. Private requests are excluded from IsThisSpam's public-scan database and shared persistent scan cache. The internal AI proxy does not independently add these requests to public scan records.
• Temporary state and website-risk caching: Processing state may remain in server memory while the server instance is active. Domain-level risk findings, keyed by domain or sanitized website address, may be reused from an in-memory cache for up to 24 hours; that freshness window does not guarantee immediate deletion of expired entries. Browser extensions may also retain local reports and caches as described above. Analysis providers handle requests under their own retention terms.
• No Training: Your private submissions are never used to train our detection models or added to public datasets.

SuperScan investigation history

SuperScan is an interactive, multi-turn scam investigation assistant. When you use SuperScan:

• Investigation history retention: User messages, follow-up inquiries, assistant risk verdicts, and structured check summaries (such as public reputation lookups for domains, social profiles, and phone numbers) are securely stored server-side.
• 90-Day retention period: SuperScan conversation history is retained for 90 days from creation to enable case continuity, follow-up analysis, debugging, and product safety improvements, after which records are automatically purged.
• Investigation linkage & ownership metadata: Each investigation uses an opaque investigation identifier. Server-side ownership metadata may also associate an investigation with an anonymous guest identity or authenticated account where required for access control and investigation continuity.
• Anonymous-to-account continuity: If you start an anonymous SuperScan investigation and subsequently sign in or create an account, your investigation history can be claimed and associated with your account so you can continue your case.
• No advertising or PostHog leakage: Raw SuperScan conversation content, message text, and uploaded attachment text are never sent to advertising platforms, third-party brokers, or PostHog product analytics. PostHog receives only non-sensitive categorical metadata (such as risk levels and tool names).
• User safety guideline: Please do not submit passwords, one-time verification codes (OTPs), authentication credentials, payment card numbers, banking passwords, or sensitive government identity documents into SuperScan.

Account data

Depending on the features you use, we process your email address, account profile details such as your name, authentication and account identifiers, and subscription or feature-access status. Clerk provides account authentication. If you purchase a plan, Stripe Checkout processes payment details; IsThisSpam receives the transaction and subscription identifiers, plan, and payment status needed to grant access and manage your account. Stripe handles card-entry details through its checkout service. We use account data to authenticate you, administer entitlements and billing, provide support, and communicate about the service. Marketing communications are subject to applicable preferences and opt-out choices. We do not sell account data or send account email addresses or identifiers to advertising platforms.

Service and marketing communications

When we send an account, product, or marketing email, we may record whether it was delivered, opened, or clicked, together with the IsThisSpam destination path. We use this limited engagement data to understand whether communications are useful, troubleshoot delivery, honour opt-outs, and avoid repeatedly contacting disengaged recipients.

Campaign reporting uses a cryptographic recipient identifier rather than storing the email address in the reporting tables. We do not use email engagement data to track browsing outside IsThisSpam or sell it to advertisers.

6. How data is used

We process data strictly to operate and improve IsThisSpam:

• Scam & spam detection: To generate risk assessments and explanations.
• Detection improvement: Public scan submissions (anonymized and scrubbed) may be analyzed to improve accuracy and identify new scam patterns. Standard private scans are never used for this purpose.
• Community safety signals: Anonymous indicators (e.g. “this message has been reported multiple times”) may be shown without exposing personal content.

7. Data retention

• Public scans: Retained with PII redaction to improve detection, research scams, and prevent abuse.
• Standard private scans: Excluded from IsThisSpam's public-scan database and shared persistent scan cache. Temporary processing state, in-memory website-risk caches, provider processing, and local extension records are described in Sections 3 and 5.
• SuperScan investigations: Retained securely server-side for 90 days for investigation continuity, safety analysis, and debugging, linked by an opaque investigation identifier and purged automatically thereafter.
• Shared persistent scan cache: Only eligible public, unauthenticated checks contribute. Separate temporary website-risk caches may also serve private checks.
• Connected email content: Raw Gmail message bodies and attachment bytes are not written to the IsThisSpam scan-history database after processing. The bounded classification request is handled by the configured inference service for the time needed to return a verdict.
• Connected accounts and scan history: Encrypted OAuth token material and reduced scan metadata are retained while a connected account is active to provide ongoing protection and history. Disconnecting an account stops normal sync and future use of the account; the inactive account record and associated scan history may remain until an account-data deletion request is processed.
• Chrome history preview: Selected origins, findings and limited run metadata remain in the browser profile until you clear its data or uninstall. Earlier preview builds may also retain local visit metadata; encryption and local-device filtering depend on the installed build as described in Section 3. Server-side keyed hashes and counters are retained for allowance enforcement and abuse prevention; the original browsing-history list is not stored in that allowance database.

You may request deletion of account-related data, including connected-account token material and connected-email scan history, at any time by contacting privacy@isthisspam.org. You can also revoke the Google grant from your Google Account security settings. We may retain a minimal record where needed to honour a deletion request, prevent abuse, or meet a legal obligation.

8. International processing and service providers

IsThisSpam uses providers for hosting, databases, account authentication, payments, support, email delivery, analytics, threat intelligence, and AI processing. Depending on the feature and information involved, personal information may be disclosed to providers outside Australia, including recipients in the United States and India. Information may also be processed in Australia. For example, our hosting and support providers describe United States processing, XposedOrNot is operated by an India-based company, and the Azure resource used for the extension AI proxy is configured in Australia East. Other countries may also be involved where a provider or its subprocessors operate global infrastructure; the service used and its location can vary by feature and provider configuration.

Providers receive only the information needed for the requested feature, as described in this policy, and handle it under their own privacy terms. Their processing locations and subprocessor lists can change. Examples include Vercel's data processing addendum, Intercom's subprocessor list, and XposedOrNot's privacy policy. Contact us if you need more detail about a particular feature or provider.

9. Access, correction and privacy complaints

Depending on the privacy laws that apply to you, you may ask us for access to personal information we hold about you, request correction of inaccurate information, or exercise other applicable privacy rights. Email privacy@isthisspam.org with enough detail for us to understand your request. We may need to verify your identity or ask for clarification. We will respond within a reasonable time and explain any refusal and the review or complaint options available where required by law.

To complain about our handling of personal information, contact us first at privacy@isthisspam.org and describe what happened and the outcome you are seeking. We will investigate and respond. If you are in Australia and remain dissatisfied, you may contact the Office of the Australian Information Commissioner (OAIC). If you are elsewhere, you may also contact the privacy regulator in your jurisdiction.

10. What IsThisSpam does NOT do

IsThisSpam does not:

• Sell personal data
• Use scan data for advertising
• Scan browser history in the background; the optional preview starts only when you request it
• Monitor keystrokes or unrelated browsing behaviour; limited clicks from IsThisSpam emails may be measured as described above
• Intentionally request or collect passwords, authentication secrets, or financial account credentials

11. Security

We apply industry-standard safeguards, including:

• HTTPS for data sent to IsThisSpam and supported analysis services
• Encryption for supported server-stored records and extension builds with secure-storage support, with the version differences described above
• Restricted access to stored data
• Abuse-prevention mechanisms designed to minimise personal identification

12. Changes to this policy

We may update this policy as features evolve or legal requirements change. The latest version will always be available on this page.

13. Contact

IsThisSpam is built by Ultron Developments. For privacy questions, access/correction requests, deletion requests, or complaints: privacy@isthisspam.org