Privacy Policy

Data Stored in Your Browser

ScamKit stores the following data locally in your browser using localStorage. This data never leaves your device unless you explicitly export it.

• Saved cases — URL and email analysis results you choose to save.
• Quiz scores and streaks — Your Scam Simulator performance data.
• Pro unlock status — Whether Pro features are activated on this browser.
• UI preferences — Onboarding tip dismissal and similar settings.

You can clear all locally stored data at any time by clearing your browser's site data for ScamKit, or by using the "Clear All" button on the Reports page.

Analytics and Event Tracking

ScamKit collects anonymous usage events (such as which tools are used and which buttons are clicked) to understand how people use the site and improve the tools. These events include:

• Page visited and page title.
• Button clicks and tool usage (e.g., "analyzed a URL", "started quiz").
• Timestamp of the event.

Events are stored locally in your browser and may be sent to analytics providers (such as Google Analytics or Plausible) if configured. No personally identifiable information (PII) is included in analytics events.

Error Reporting

ScamKit uses Sentry for error tracking to identify and fix bugs. When an error occurs, Sentry may collect technical information such as the browser type, operating system, and the error message. Sentry is configured with sendDefaultPii: false, meaning no personally identifiable information is sent.

Server-Side Processing

When you use certain features, data is sent to ScamKit's serverless functions hosted on Netlify for processing:

• URL Analysis — The URL you submit is checked for redirects on the server. The URL is not stored after analysis.
• Pro Code Verification — Your access code is sent to the server for validation. Codes are compared in memory and not logged.
• VirusTotal and URLhaus lookups (Pro) — The URL or domain you submit is forwarded to third-party APIs for threat intelligence. These services have their own privacy policies.

Rate limiting uses your IP address (from request headers) to prevent abuse. IP addresses are stored in memory only and are not persisted or logged.