Privacy policy

Effective November 10, 2026 · Changing Bit Group of Companies · Data requests: csr@fightscammers.com

What we collect

• Account data: your email, a hashed password (bcrypt), optional OpenRouter API key, preferences.
• Protected emails: the addresses you add, their coverage dates.
• Evidence you submit: raw scam emails with headers and extracted indicators (URLs, IPs, wallets, phones) — this is your evidence file, retained until you delete the case.
• Generated artifacts: abuse reports and takedown letters you create.
• Security metadata: IPs stored only as HMAC-SHA256 hashes; login times; an append-only audit log of security events.
• Payment records: Stripe payment IDs, amounts, status. Card data never touches our servers.
• Support: contact-form messages and their hashed IP.

What we do NOT do

• We do not sell, rent or trade your data. Ever.
• We do not read your inbox — you bring us what you choose to submit.
• We do not embed third-party trackers; no analytics cookies beyond your session cookie.

What leaves the platform

Only what you send: draft reports you copy or mail yourself, API submissions you trigger (URLhaus/PhishTank receive the specific indicator only — never your identity), and Stripe receiving billing data as processor.

AI processing

If an OpenRouter key is configured (yours or the platform's), scam-email text and case details are sent to the OpenRouter API for analysis and letter drafting. Without a key, everything runs on local regex extraction and templates and nothing is sent anywhere.

Retention & deletion

Account + evidence: retained while your account is active. Delete a case → its raw emails and indicators are removed. Delete your account (Settings → Danger zone) → account data removed; backups purge within 30 days; minimal finance records retained as required by tax law.

Your rights

Access, correction, export, deletion, objection — email csr@fightscammers.com and we respond within 30 days. You may also export your period reports (CSV) anytime from the app.

Security

Described fully at Security: captcha + honeypot + timing traps, 2FA, lockouts, rate limits, hashed IPs, audit logs, CSRF, strict headers, prepared statements, Stripe-only payments.

International transfers

Hosting and processors may be located outside your country; where required we rely on standard contractual clauses or equivalent safeguards. The platform is operated by Changing Bit Group of Companies.