Privacy policy

Who runs this site

Scam Smash is an independent, non-commercial project run by its founder. For the purposes of privacy law, the founder is the data controller for this site. Contact: hello@scamsmash.com.

What we don't collect

Scam Smash does not ask you to create an account, and does not take case reports, ID documents, or details of what happened to you. The evidence pack builder and health check run entirely in your browser: what you type into them is never sent to us or stored anywhere. We do not sell or share personal information with third parties for marketing, and we do not use advertising or tracking cookies.

What we do collect, and why

• A basic, anonymous count of how many times the first-hour checklist, health check, or evidence pack are used. This is a single number, deduplicated per visit with a short-lived cookie, and isn't tied to any personal information.
• Standard server logs from our hosting provider (like any website), which may include IP addresses, browser type, and pages visited, used only for security, diagnosing problems, and keeping the site running.

Where privacy law requires a stated legal basis: we process this limited data under legitimate interest, specifically, keeping the site secure, working, and honestly measured. We don't rely on your consent for this processing because it isn't personal profiling or marketing, though you can still control cookies through your browser at any time.

How long we keep it

The dedup cookie expires after 12 hours. The anonymous usage count has no personal data attached to it and is kept indefinitely as a simple statistic. Server logs are retained according to our hosting provider's standard schedule; contact us if you'd like details.

Where your data is processed

This site is hosted with a third-party provider, and the server handling your request may be in a different country from where you're browsing. If you're in the EU, UK, or another region with data-transfer rules, this means routine, limited technical data (like the server logs above) may cross borders as a normal part of how the internet and web hosting work.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or object to the processing of your personal data, and to complain to your local data protection authority. Given how little we collect, exercising these mostly means asking what's in a server log entry tied to your IP address, which we can request from our hosting provider on your behalf.

To make a request, email hello@scamsmash.com. We aim to respond within 30 days.

Children's privacy

This site is intended for a general audience, not specifically for children. We don't knowingly collect personal information from children. If you believe a child has provided personal information to us, contact us and we'll remove it.

Outbound links

This site is mostly a directory: almost every useful link takes you to a government agency, bank, or charity's own website. Once you leave Scam Smash, that organisation's own privacy policy applies, not ours.

Cookies

One cookie is used, to avoid counting the same visit twice in the usage count described above. It expires after 12 hours, contains no personal information, and isn't used for advertising or tracking across other sites. You can block or delete it through your browser's settings at any time; doing so won't affect your ability to use any tool on this site.

Changes to this policy

If this policy changes in a meaningful way, we'll update the date at the top of this page.