Last updated 9 October 2026
Scam Check (“we”, “us”) is a free, non-commercial consumer-protection service that helps people in South Africa recognise phishing and scams. This policy explains, in plain language, what information we handle and how we protect it. We are committed to the principles of the Protection of Personal Information Act, 2013 (POPIA).
When you use the website quick checker: we process the message, link, phone number or screenshot you send. AI helps analyse wording and read screenshot text. Quick-check text and images are not saved as community reports. Link results may be cached, and detected phishing addresses and technical findings may be saved and added automatically to public warnings. We don’t require an account. Remove personal details and private tokens from links first.
When you use the WhatsApp assistant: the message you forward (so we can analyse the scam), and a salted hash of your WhatsApp number — a scrambled value we use only to prevent abuse (rate-limiting) and duplicate processing. We do not save the sender’s number as an identifier, but message content may itself contain phone numbers or other personal details.
When you send a website report: the message, link or screenshot you submit and any context you choose to add. A name is optional and is treated as public credit if the warning is published; leaving it blank keeps the report anonymous. An optional email address is kept private and is never published.
Basic technical data: standard request information (such as IP addresses, request metadata and timestamps) that our infrastructure may log to keep the service secure and reliable.
A moderator may turn a submission into a public warning. Only the public summary fields and an optional first-name credit are exposed; unedited report text, the private contact field and reporter email are not published. A phone number can contribute to public number-check results only after a moderator explicitly approves it as a scam contact in a published scam warning. Screenshots are published only when a moderator confirms they contain nothing sensitive, and links are defanged so they cannot be clicked.
We combine reports from the public with established threat-intelligence sources, including urlz.dev, OpenPhish, phishunt, TweetFeed and community reports shared by security researchers. Protected server-side checks may follow a link’s redirects and read public page text without executing it on your device. We may also send suspicious URLs to urlz.dev, which opens pages in a remote security sandbox on Cloudflare and captures what they do.
Where we detect a place that a scam is leaking victims’ information, we report its location to the affected brand or a CERT so they can act. We do not download, store or process those stolen credentials ourselves.
We may share scam indicators (such as malicious domains) with banks, telecommunications providers and recognised anti-fraud bodies to help protect the public. We use trusted infrastructure providers (including Cloudflare) to run the service, and may share a suspicious URL with urlz.dev for remote analysis. Cloudflare Workers AI processes message text and images for automated analysis and text recognition. We do not sell or rent personal information to anyone.
We keep moderated scam intelligence for as long as it is useful for protecting people. Salted sender/IP hashes are removed after 30 days. Rejected reports are removed after 30 days, and reports still awaiting review are removed after 90 days. For published warnings, private reporter email, unedited message text and private contact fields are removed after 90 days; the reviewed warning and its technical scam indicators, including explicitly approved scam-contact numbers, may remain available. Unapproved number candidates attached to published reports are removed with the private report fields after 90 days. Submission-attempt records used for abuse prevention and duplicate handling are removed after 24 hours.
You have the right to ask what personal information we hold about you, to have it corrected or deleted, and to object to its processing. Because we deliberately avoid storing identifying information, we may be unable to link a request to a specific person — but we will always help where we can. To make a request, email hello@scamcheck.co.za.
You may also lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.
The service is intended for general public use and is not directed at children under 18.
We may update this policy as the service evolves. We’ll change the “last updated” date above when we do.