Privacy policy

What we collect

Your account

• Username and email address. You need these to sign up, and we email a code to confirm the address is yours.
• Password. We store it only as a one-way hash, never in readable form.
• Optional profile: display name, bio, profession and photo, plus your privacy choices for them.
• Ad settings: the image and link you choose for the ad box beside your reports.

What you post

• Scam reports: their text, tags, evidence images, the business details you add (name, websites, phone numbers, emails) and the place (address, city, region, country).
• Comments, updates to your reports, and your up and down votes.

Location

If you choose “Use my location”, your browser shares your coordinates with us. On a report, we use them to fill in the city and save them so the report ranks higher for people nearby. We never show them. To find the city, our server sends the coordinates to OpenStreetMap's Nominatim service. When you search, your location (if you allow it) is used only to rank nearby scams first and is not stored.

Technical data

• Your IP address is used, in memory only, to limit how many sign-ups, codes and searches one address can make in a short time.
• One-time codes and password-reset links are stored as hashes and expire within an hour, or within 10 minutes for codes.
• Our hosting provider keeps standard, short-lived request logs: IP address, time and requested page.

Cookies and browser storage

We set one cookie, which keeps you logged in. It's needed for the site to work. The browser also stores a draft of a report you haven't published yet and your location choice, so they survive a reload. We set no analytics or tracking cookies of our own.

Advertising

Some pages show ads from Google AdSense. Google and its partners use cookies and similar technology to show ads, including ads based on your visits to this and other websites, to limit how often you see an ad and to measure how ads perform. Google receives your IP address and information about your browser and the page you're on, but not your account or your reports.

You can turn off personalised ads in Google's ad settings, and read how Google uses information from sites that use its services. Visitors in the European Economic Area, the UK and Switzerland are asked for consent before personalised ads are shown.

What is public

• Your reports, comments and report updates, with your username or display name.
• Your profile: the photo and profession only if you choose to show them, and your email only if you turn on “Show email” in Settings.
• The business details and place in a report. These, along with the report text, are also available through our public search and lookup API, which the ScamSafe extension uses.

Exact coordinates, your email (unless you choose to show it) and your password are never public.

Who processes your data

We use these providers to run the site. They process data only to provide their service to us:

• Vercel: hosting.
• Our PostgreSQL database provider: stores accounts and reports.
• Brevo: sends sign-up codes, password-reset emails and password-change codes.
• Cloudinary: stores and serves the images you upload.
• OpenStreetMap Nominatim: finds the city for coordinates, as described above.
• Google AdSense: shows ads, as described under Advertising.

If you paste a link to an image instead of uploading one, that image is shown straight from its own website, which then sees the visitor's IP address. We ask browsers not to tell that site which page it was shown on. Ads beside reports link to whatever the reporter or our admins chose, and following one takes you to that website.

We don't sell your data. Apart from what Google AdSense collects in your browser to show ads, we don't share it for advertising.

How long we keep it

We keep your account and posts until you ask us to delete them. Reports and comments that moderators hide remain stored, so decisions can be reviewed. Expired codes and reset links are useless after they expire.

Your choices and rights

• Change your profile, privacy choices, ad and password at any time in Settings.
• To get a copy of your data, correct it, or delete your account and posts, email us from your account's address at scamme2twice@gmail.com. We answer within 30 days.

Children

ScamMeTwice isn't meant for children under 13, and we don't knowingly collect their data.

Changes

If this policy changes, the new version will be posted on this page with a new date.

Contact

scamme2twice@gmail.com