Privacy policy

What we store

Your account, reports and case metadata are stored encrypted at rest. Visitor sessions record abuse signals to block attackers.

Encryption

Report stories, scammer details, contact emails and dispute statements are Fernet-encrypted before touching the database.

Zero file retention (the core promise)

Uploaded evidence files exist on our servers ONLY while your report is being prepared. The moment your report is submitted and the handover email to the authorities is delivered, every byte is deleted from our servers — the deletion is verified (file unlinked, directory synced, absence checked) and recorded in the audit log. The authorities hold sole custody of your files; we hold none.

What survives

Your case file keeps the metadata ledger only: file names, sizes, SHA-256 hashes, HMAC chain-of-custody signatures, recipients and timestamps — never the content. Nothing is ever served from a public path, and purged files cannot be downloaded by anyone, including us.

If delivery fails

If the handover email cannot be delivered (no authority email for your country, or a temporary outage), your files remain encrypted while retries run, and are automatically and permanently deleted within a short, published window (failsafe: 72h, orphans: 24h, no-route: 24h). Retention is never permanent — not even when delivery fails.

Controller

SCAMEND is the data controller for this platform. For any privacy request or question, contact us at [email protected].

Legal basis

We process reports under Art. 6(1)(b) GDPR (contract: filing a report), Art. 6(1)(e) (public-interest fraud protection) and Art. 6(1)(f) (legitimate interest: abuse blocking and fraud prevention). Sharing your contact details with authorities and community sharing require your explicit consent, which you can revoke at any time.

Your rights (GDPR)

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). Export your data or delete your account any time from Settings; because files are deleted at handover, these rights apply to the metadata ledger.

International transfers

Evidence may be transferred to authorities outside the EU/EEA when the victim's country or the scammer's location requires it. Such transfers serve law-enforcement and public-interest purposes; no other transfers occur.

Retention of operational data

Live feed 24h, attack logs 30d, visitor sessions 60d, checks 90d.