Privacy notice
Last updated 25 October 2026.
In short
- Messages you check are not stored. Screenshots are never kept.
- There are no accounts. ScamBhai does not ask for your name, phone number or email address to check a message, read the guide or post in the community.
- What is kept from checking, reading and posting is anonymous: counts of checks, masked community posts, and the scam website addresses found in risky messages.
- If you send a complaint, you may give an email address so we can reply. Complaints are kept apart from everything else and deleted one year after they are closed.
- No advertising, no advertising trackers, no third-party analytics, and no selling of personal data.
- You can delete your own posts and your Family Shield at any time, and a parent can switch alerts off at any time.
Who is responsible
ScamBhai ("we") decides how the information described here is used and is responsible for it under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. Questions and requests go to scambhai@proton.me.
What we handle, why, and for how long
Messages and screenshots you check
The text or screenshot you give is sent over an encrypted connection to our AI service provider, only to prepare your result, and ScamBhai does not save it. A screenshot is first made smaller on your own phone. When a typed message looks like a scam (a score of 50 or more), we keep the result for 24 hours under a one-way code made from the exact words, so that the next person who pastes the same words gets it at once. That result can quote a few words of the message, with numbers, links and IDs masked. After 24 hours it is deleted.
Anonymous counts of each check
Each check adds one record that identifies no one: the date and time, the kind of scam, the name of the company or office the message pretended to be from (only for messages that look like scams, and with a one-way code per network so that one person cannot push a name onto the lists), the risk score, the language, how the message arrived, whether it was a screenshot, and the state it came from, worked out from the network address without storing the address. If you press a share button or answer "Was this right?", that is counted the same way. These records are kept for two years and are used to improve ScamBhai, for the public trends page and for anonymous statistics (see below).
Scam website addresses
When a message scores 60 or more, the website addresses in it are kept as domain names only, without the rest of the link, with the number of different networks that sent them. Each network is recorded as a one-way code that is different for every address and cannot be matched to anything else. Government sites, large platforms and link shorteners are left out. These are kept for 12 months after they were last seen.
Protection against abuse
To stop robots and floods, ScamBhai uses a one-way code made from your network address. For limits on checks, votes, logins, short questions and buttons it keeps these codes for up to two days. The code is also kept with community posts and reports, so that a post is hidden for review only when reports come from different networks. ScamBhai does not store IP addresses.
Counting visits
A small cookie on your browser (sbv) holds only four dates: your first visit, your last visit, your first check and your last check. It contains no code or identifier and cannot tell us who you are. From it, ScamBhai keeps daily totals, such as how many visitors were new or returning, which kind of page they arrived on, the kind of device (phone or computer), the site language, the state worked out from the network, and where the visit came from (for example a search engine, a social network or a shared ScamBhai link). We also count how many times the AI was used and how much text it handled, to keep costs in check. None of this is linked to a person or a message, and these totals are kept for two years.
Short questions
Now and then the site asks one optional multiple-choice question, such as how you heard about ScamBhai, and the Quick survey page linked at the bottom of every page has a few more. Only the choice is counted, with the day and the site language, and these counts are kept for two years. You can skip any question. If you write in the survey page's free box, we keep what you wrote, with the day and the site language, for 12 months; phone numbers, links, account numbers and email addresses in it are masked before it is saved, nothing else is kept about who wrote it, and only the ScamBhai team reads it. Masking cannot catch everything, such as an address written out in words, so please leave out anything that could identify you or anyone else.
Sharing a message to ScamBhai
If you add ScamBhai to your phone's home screen and share a message or screenshot to it, or use the iPhone shortcut, the message is checked exactly like one you paste in, and ScamBhai does not store it. The iPhone shortcut hands the message to the site in the page address, after a # sign, a part of the address that is never sent to our servers. Your browser may still keep that address in its history, as it does for any page you open, and you can clear it there. A message that arrives through a link is only filled in; it is checked when you tap the check button.
Community posts
Before anything is published, phone numbers, links, account numbers and names are masked automatically, and a second automatic check reads every new post for anything that could still identify a person; posts it is unsure about wait for an editor before they appear. Posts marked ScamBhai desk are written by ScamBhai's editors, not by members: either a composite of commonly reported scams, or a retelling of a news report with a link to its source. They are never counted as member reports. Automatic masking can miss an unusual name or address, so please leave out names, addresses and other details of real people yourself. If you see a post that identifies someone, use Report or write to us and we will remove it. We store the masked post, its random handle, the state it was sent from, its hashtags and a random code for your browser, so that votes count once and you can delete your own post from the same browser. Deleting your post removes its text at once, unless members have already reported it: then it leaves the site at once but is kept like a removed post. A post the editor removes, or one removed because of a complaint, leaves the site at once but its text is kept out of sight for 180 days, as the IT Rules require so that it is available to an investigation, and is then wiped. There are no accounts and no private messages. Published posts can be read by anyone and may be used, in anonymous form, to write and improve the scam guide.
Family Shield
Family Shield works without accounts, phone numbers or email addresses. The person who sets it up gets a private link, and the parent gets a separate family link. The only name it keeps is the short one the person who sets it up gives each family link before sending it, such as Mummy or Papa, so an alert can say who checked. That name is shown only to them, on their Family Shield page and in their alerts, and it is deleted when the family link is replaced or the Family Shield is deleted. The code in each link sits after the # sign, so it is never sent to our servers as part of the address, and we store only one-way codes of the links, so a copy of our database cannot open anyone's Family Shield. Each phone that opens the family link gets its own random code, and that phone makes its own choice: alerts are sent only for checks made on a phone whose user said yes on that phone, and they can switch alerts off at any time. We also keep the number of checks made this month and the paid-until date.
When a parent's phone that agreed checks a message that scores high, we keep an alert for 30 days with only the score, the kind of scam (the matching guide), where to report it and which of the family's phones it came from (shown by the name given to its link). Neither the parent's message nor ScamBhai's explanation of it is stored or shown. To deliver alerts, we keep the notification address that the phone's browser gives us. The notification we send carries no content at all; the phone then asks ScamBhai what to show. A Family Shield is deleted at once when its owner presses Delete, and automatically after 400 days without use unless it is paid for.
Payments
ScamBhai takes no payments at present. Earlier Family Shield payments were made through Razorpay and are handled under Razorpay's privacy policy. For those, we keep the payment and order references, the amount, the pass bought and the date for eight years, as the accounts law requires, and any refund goes back through Razorpay.
When you write to us
If you email us, we use your email only to answer you and keep the conversation for up to two years, or longer if the law or a dispute requires it.
Complaints
When you use the complaint form, we keep what you write, the kind of complaint, the link you give, the language of the page and, only if you give it, your email, so we can act on it and reply. If the complaint points to a community post, we keep a copy of that post with it, because the law asks us to keep a record of what was removed and why. If the complaint says a post shows an intimate image, impersonates someone or shows private details, what you wrote and the post are sent to our AI service provider for an automatic check, only to decide whether to hide the post at once; nothing else is done with them there. All of this is deleted one year after the complaint is closed. Your network address is not kept with it; a one-way code of it limits how many complaints can be sent, for up to a day.
Cookies and storage on your device
ScamBhai uses only cookies it needs. There are no advertising or tracking cookies.
| Name | What it does | How long |
|---|---|---|
| sblang | Remembers your language | 1 year |
| sbtheme | Remembers light or dark mode | 1 year |
| sbid | A random browser code, set only when you vote, post or report, so each counts once and you can delete your own posts | 400 days |
| sbkid | Opens your own Family Shield on this phone | 400 days, or until you delete it |
| sbfam | On a parent's phone, links checks to the family's Family Shield and to this phone's own choice about alerts | 400 days, or until the parent stops it |
| sbv | Four dates (first and last visit, first and last check), so visits can be counted without knowing who you are | 400 days |
| sbadmin | Keeps the editor logged in to the console | 12 hours |
Your browser may also keep, in its own storage that never leaves your phone, your language, light or dark mode, an unfinished community post, which short questions you have already seen, and when the survey invitation was last shown.
Who else handles data for us
- Cloudflare hosts the site and its database, protects it from attacks and runs the check that you are a person and not a robot. Its error logs never contain message text.
- Our AI service provider reads the message or screenshot you check, only to prepare your result. Its commercial terms do not allow it to use what we send to train its models; it may keep requests for a limited period for security and abuse monitoring before deleting them.
- Google Fonts supplies the lettering. Your browser fetches it from Google, which sees your network address and browser.
- Razorpay handled earlier Family Shield payments and handles any refund of them.
- The notification services of your phone's browser (Google, Apple, Mozilla or Microsoft) deliver Family Shield alerts. They see when a notification is sent, never its content.
- Proton hosts our email, if you write to us.
Some of these providers process data outside India. The law allows this except to countries the Government of India restricts, and we will follow any such restriction.
Anonymous statistics we publish and license
ScamBhai publishes anonymous scam trends, and licenses them to banks, payment companies, insurers, security companies and the authorities so they can protect people. What is shared is counts (for example, how many checks matched a type of scam in a state in a week) and the scam website addresses described above. States and company names with fewer than three likely scams are left out, a company name is shared only after at least three different networks have sent it, and it appears on the public trends page only after the editor has checked it. What is shared never includes messages, screenshots, community posts linked to a browser, phone numbers, UPI IDs, network codes or anything else that identifies a person.
What we never do
- Sell or rent personal data.
- Show advertising or use advertising trackers.
- Ask for an OTP, PIN, password or money.
- Share the messages you check with anyone except our AI service provider, for your result.
- Contact you, call you or send you marketing.
Why we may use it
We use personal data only for the purpose you see when you give it. When you paste a message, post a story, set up or join Family Shield, or answer a survey, you give that information yourself, for that use; the Digital Personal Data Protection Act, 2023 allows this, and Family Shield alerts also need each parent's own yes on their own phone. You can stop at any time, as set out under Your rights. Counts that cannot identify anyone are not personal data. This notice is in English; ask the Grievance Officer if you need it in another language of the Eighth Schedule.
Your rights
These rights come from the Digital Personal Data Protection Act, 2023. Most of its provisions on the rights of individuals and the duties of services start in May 2027, 18 months after the DPDP Rules were notified in November 2025; ScamBhai already honours these requests now, of its own accord. You can ask what personal data we hold about you and how we use it, ask us to correct or erase it, withdraw consent you have given, nominate someone to act for you, and complain to us and then to the Data Protection Board of India. Because ScamBhai does not know who you are, most of what we keep cannot be linked to you. You can act directly: delete your own posts from the browser you used, delete a Family Shield from its page, and, as a parent, switch alerts off or stop Family Shield on your phone. For anything else, write to scambhai@proton.me with the link to the post or the details that let us find the data. We will never ask for more than we need to do what you ask. We answer such requests within 7 days, and always within the time the law allows.
Children
Anyone can check a message. The community and Family Shield are meant for people aged 18 and over, and Family Shield must be set up by an adult for an adult family member who agrees to it. We do not knowingly process personal data of children. If you believe a child has posted personal information, write to us and we will remove it.
How we protect data
Every connection is encrypted, and the site sets strict browser security rules. Codes and links are stored only as one-way codes. The notification key is stored sealed. The editor console sits behind two separate locks: a sign-in check run by our hosting provider, and a password of its own. The code goes through a security review before each new version is released. If a breach ever affects personal data, we will inform the Data Protection Board of India and the people affected, where we can reach them, as the law requires, and until those duties start in May 2027, of our own accord.
How long things are kept
| What | How long |
|---|---|
| Messages and screenshots you check | Not stored |
| A repeated scam message's result, masked | 24 hours |
| Network codes for limits | Up to 2 days |
| Anonymous counts of checks | 2 years |
| Anonymous visit counts and answers to short questions | 2 years |
| Notes written in the survey page's free box, masked | 12 months |
| Scam website addresses | 12 months after last seen |
| Community posts | Until you or the editor remove them. Deleted by you: text wiped at once. Removed by the editor, after a complaint, or deleted by you after members reported it: kept out of sight for 180 days, then text wiped |
| Family Shield alerts | 30 days |
| A Family Shield | Until deleted, or 400 days without use if not paid for |
| The names given to family links | Until the family link is replaced or the Family Shield is deleted |
| Payment records | 8 years |
| Emails to us | Up to 2 years |
| Complaints, with any email given and a copy of a post they concern | 1 year after the complaint is closed |
Changes to this notice
If we change how we handle data, we will update this page and its date before the change takes effect. A change that needs your agreement, such as a new use of Family Shield data, will be asked for first.
Grievance Officer
The quickest way to complain is the complaint form: it gives you a reference number at once, and urgent complaints are reviewed first. Where an automatic first check finds that a post plainly shows private details, an intimate image or an impersonation, the post may be hidden at once until the Grievance Officer decides; other complaints are reviewed within the time below. Complaints about anything on ScamBhai, including a request to remove a community post, a privacy request or a payment problem, can also go to the Grievance Officer: B. Parikh, scambhai@proton.me. The Grievance Officer also answers questions about how ScamBhai handles personal data. Please write rather than call where you can, and remember this is not a helpline for recovering money: for that, call 1930. We acknowledge a complaint within 24 hours. A request to remove content is resolved within 36 hours and any other complaint within 7 days. A complaint that a post shows intimate images of someone or impersonates a person is decided within 2 hours, and one that a post exposes someone's private information as soon as we can and within 36 hours. Orders from a court or an authorised government officer are acted on within 3 hours. If you are not satisfied with our answer about your personal data, you can complain to the Data Protection Board of India.