Dwg. ScamLens / Privacy
What happens to what you paste
People paste sensitive things into a tool like this: bank alerts, password resets, private conversations. ScamLens treats every input as sensitive, whatever it contains.
Analyzed, then discarded
Your input is processed in the server’s memory and the findings are sent back to you. Nothing is written to a database, a cache, or an analytics system. There are no accounts and no history.
Links are never visited
Submitted URLs are analyzed by their structure alone. ScamLens makes no request to them, so pasting a link here never signals anything to whoever controls it, and the server cannot be tricked into fetching internal addresses.
Logs contain no content
Server logs record only metadata: the input type, its length, and how many findings were produced. A redaction layer additionally strips URLs, email addresses and digit runs from any error text before it can be logged.
No third parties
No analytics, no trackers, no external fonts or scripts. By default the analysis makes zero outbound requests. If an operator enables the optional AI summary, the AI provider receives the structured findings only: rule names, severities and short evidence excerpts, never your full message. That instance should say so.
Evidence stays with you
Findings quote short excerpts of your input, because that is what makes them explainable. Those excerpts exist only in the response shown to you.
Honest limits: content necessarily exists in server memory while the analysis runs, and if you run ScamLens behind your own reverse proxy, make sure it does not log request bodies. The full technical privacy model lives in the repository at docs/PRIVACY.md.