What happens to your message
Nothing is kept. Here is precisely what that means, and what you can check for yourself.
Last reviewed 28 August 2026
We never ask who you are
No sign-up, no login, no profile, no email address. There is nothing to create and nothing to delete, because nothing about you is ever collected.
Your message is not written down anywhere
When the check runs on your device, which is the normal case, the message never leaves it. If you have JavaScript switched off, the message is sent to our server so the check can run there instead. In that case it is held in memory for the fraction of a second the check takes and then dropped. It is never written to a database and never written into a log file.
There is no table in our database that holds message text. Not an empty one, not a disabled one. An automated check runs on every build and fails the build if anyone adds message storage or logging, so this cannot quietly stop being true.
Your message never appears in a web address
Text in a web address ends up in your browser history, and it travels whenever a link is shared. Nothing you paste is ever put into one. If you share a result, the link carries the score and which signals fired, and no part of the message itself.
We never open the links in your message
Every judgement about a link is made from reading the address as text. We do not visit it, do not follow it, and do not check it against any outside service. Opening a link in a scam message tells whoever sent it that your number is live, and that would make you a bigger target for having used a safety tool.
Photographs and QR codes stay on your phone
When you check a QR code or a screenshot, the picture is read inside the page by your own browser. It is not uploaded, not copied to a server, and not kept after you leave the page. What the reader pulls out of a QR code is the address written inside it, and that address is then judged as text in exactly the way a pasted link is. Reading the words out of a screenshot works the same way: the text recogniser is downloaded to your phone and run there, and there is deliberately no server that could do it instead.
No trackers, at all
No analytics service, no advertising pixel, no tag manager, and no fonts loaded from anyone else’s server. A privacy tool that leaks its visitors to an ad network is not a privacy tool. Nothing on this site makes a request to any other company, and the site’s security policy prevents it from being able to.
What is kept in your browser
Two things, both on your own device and neither sent anywhere. Your display preferences — light or dark, text size, high contrast, typeface — are remembered until you change them. Your last five checks are kept for the life of the browser tab so you can look back at one without pasting it again; closing the tab ends that, and there is a button to forget them sooner. There is nothing else. No cookies for tracking, no identifier, no record that persists after you leave.
What the operator can see
Counts, and never content. How many messages were checked, how many came back at each verdict, which signals fire most often, and whether people said a verdict was right. If you use the feedback control, it records the score and which signals fired, and not one word of your message.
What a web server unavoidably sees
To send you a page at all, a server has to know where to send it. So the usual connection details exist for the moment a page is served: an address for your connection, the page requested, and the kind of browser asking. That is how every website on the internet works, and it is the honest limit of the promise on this page. None of it is joined to a check, none of it is used to build a profile, and none of it is passed to anyone else. The one thing it never contains is your message, because your message is not part of the request.
How long anything lasts
- Your message: as long as it is on the screen. Nothing beyond that.
- A photograph or QR image: as long as the page is open. It is never uploaded.
- Your last five checks: until the browser tab is closed, or until you press the button that forgets them.
- Your display preferences: until you change them, or until you clear your browser’s data for this site.
- Counts of verdicts and signals: indefinitely, because they are numbers with nothing in them to trace back to a person.
If you are on a shared or borrowed phone
Nothing here survives the tab, but the person who hands the phone back may still be able to scroll up and read the screen. If that matters, use the button that clears your recent checks before you give the phone back, and close the tab. There is no account to sign out of, so closing the tab genuinely is the whole of it.
Sharing a result with someone
A shared link carries the verdict and the list of signals that fired, and not a word of the message. That is deliberate: people share these results with a family member or into a group chat, and a link that quietly carried the original text would put a bank reference or a one-time code somewhere nobody meant to put it.
There is nothing for you to request or delete
Most privacy pages end with an address to write to for a copy of your data or its deletion. There is no such address here for a simple reason: there is no record to copy and none to delete. No account, no message text, no identifier that could single you out. A request to erase your data would be answered with this same paragraph.
If this page ever changes
The date under the title is the date it was last reviewed. If the handling described here ever changes, the change appears here first and the date moves with it. A change that weakened any of the promises above would also have to get past the build check, which is the point of having one.
Why this is not just a promise
Clause 9.6 of the agreement behind this tool makes the handling described on this page a contractual obligation, not a statement of good intentions on a web page. The automated build check exists so that the code and this page cannot drift apart.