Privacy Policy

HackFraud (hackfraud.com) checks messages, links, emails, screenshots and files you submit to estimate whether they are scams or phishing.

What we process

• Submitted content: text, links, forwarded emails, screenshots and uploaded files (images, PDF, TXT, EML) are sent to AI providers and custom-made models to produce a verdict. Only the domain/host names of links in your submission (never the surrounding text) are sent to public threat-intelligence, DNS-security and domain-registration services, and we visit submitted links with an automated, non-logged-in request to check where they lead. Phone numbers, crypto wallet addresses and domains are also kept as one-way hashes so we can recognise repeat scams.
• Links in results: AI-written text is automatically defanged (links and phone numbers are made unclickable) so a scam link can never be passed on by this service. We do not use your submissions to train models of our own.
• Follow-up questions you ask about a result are sent to an AI provider together with the stored submission and result.
• Email submissions: we read the message and its authentication headers (SPF/DKIM/DMARC) and reply to the sender with the verdict.

What we store

We store your IP address, your country, city and network (ASN) derived from it, your browser user-agent and referrer, the content you submit exactly as submitted (which may include personal data), any uploaded file, the AI result, which models were used, timing and cost, whether the bot check passed, your optional thumbs up/down feedback, your follow-up chat messages, and usage events. This is stored for abuse prevention (rate limiting, spam and fraud detection), security, and to measure and improve the accuracy of the service. Please do not submit content you do not want stored.

Why we process it (legal basis)

Providing the service you request, preventing abuse, and improving accuracy and fraud detection (legitimate interests, GDPR Art. 6(1)(b),(f)).

Retention

Submissions, uploaded files, chat messages and logs are deleted automatically after 180 days. Rate-limit counters are kept for a few days.

Alerts

If you subscribe to alerts we store your email address (after you confirm by link; every message has an unsubscribe link), or your browser push endpoint, or your Telegram chat id, together with your language and country, only to send you scam alerts. Email is delivered through a transactional email provider. Unconfirmed email addresses are deleted after 7 days; unsubscribing deletes the record. If you join the pricing waitlist we store your email address, chosen plan, language and country only to tell you when that plan opens.

Processors

Cloudflare (hosting, D1 database, Turnstile human check, WAF and bot protection), secure cloud storage in the EU (uploaded files, kept privately and deleted with your submission), AI providers and custom-made models (AI analysis). Data may be processed outside the EU under their standard contractual safeguards. We do not sell personal data. Access to the stored data is restricted to the operator.

Your rights

You can request access, erasure or objection by contacting us. Please include the approximate time and the text you submitted so we can find your entry.

Last updated: 18 October 2026.