Privacy notice · Last updated 2026-09-21
Privacy notice
Short version: we don't keep what you check and we collect as little as possible. Our guides and content pages show ads from Google AdSense. In the EEA, the UK and Switzerland we ask before any advertising or analytics cookie is set.
Who we are
The controller of your personal data is A.I.T. Multiverse Consulting Ltd, Cyprus (“we”). Contact: privacy@tapsafely.com.
What we process and why
| Data | Purpose | Kept for | Legal basis |
|---|---|---|---|
| Messages, links and screenshots you check (including forwarded emails) | To produce your result | Not stored. Processed in memory and discarded. A one-way hash of the text may be cached for up to 6 hours so repeat checks are fast. | Legitimate interests / your request |
| Anonymous check statistics (date, country, scam type, risk level, score) | Scam Weather and service improvement | Up to 180 days | Legitimate interests (no personal data) |
| Scam reports you submit, plus a salted hash of your IP address | Moderation and public warnings (published without your identity) | Until removed; rejected reports deleted after 30 days | Consent |
| Comments you post on a guide or brand page: the text, an optional first name, your country (from Cloudflare) and a salted one-way hash of your IP address | Moderation and publishing your story to warn others. A person reviews every comment first. Only the text, first name, country and date are published, with phone numbers and email addresses partly hidden and web addresses broken | Until removed. Rejected comments deleted after 30 days. Ask us to remove yours at any time | Consent |
| Reactions: “I got this one too”, “Was this helpful?”, “Did we get this right?” and daily challenge answers (right or wrong only), with the date, your country and the same daily one-way visitor code as our visit count | Showing how common a scam is, how everyone did in the daily challenge, and improving the checker | Up to 400 days | Legitimate interests (no IP address or cookie stored) |
| Email address for scam alerts | Sending the weekly scam alert email (double opt-in), and a record of which week's email was sent to you so no one gets it twice | Until you unsubscribe; unconfirmed sign-ups deleted after 7 days | Consent |
| Email address for the Family Shield waitlist, plus plan, country and the page you joined from | Sending the launch email (double opt-in) | Until launch or until you unsubscribe; unconfirmed sign-ups deleted after 7 days | Consent |
| Daily AI-check counter, keyed by a salted one-way hash of your IP address | Enforcing the free daily allowance of AI checks | Up to 2 days | Legitimate interests |
| Contact form messages | Replying to you | Up to 24 months | Legitimate interests |
| Your email address when you forward an email to us | Sending the reply | Not stored by us after sending | Your request |
Cookies and similar technologies
- Strictly necessary: a short-lived cookie (
rfr_s, 30 minutes) that remembers you passed our human check, and Cloudflare Turnstile, which protects our forms from bots. - Preferences and things saved on your device: your theme, your Scam Weather country, your last 20 check results (the risk level and scam type, never the message; for a link, its domain), your daily challenge answers and streak, which reactions you've already given (so a button stays pressed), and whether you've dismissed the install tip are saved in your browser's local storage. They never leave your device, and you can clear your check list on the checker or all of it by clearing site data.
- Installed app: if you install TapSafely, a small service worker is stored by your browser. It only receives what you choose to share to TapSafely from another app, hands it to the checker on your device and deletes it straight away. It caches nothing else.
- Cloudflare Web Analytics: counts page views and measures page speed. It doesn't use cookies, doesn't collect personal data and doesn't track you across sites.
- Our own visit count: when a page opens, your browser tells our server which page it was, the website you came from (just its name) and your language. Our server adds your country and device type (phone, tablet or computer). To count unique visitors without cookies, it combines your IP address and browser details with a secret key into a one-way code that changes every day. We never store your IP address, we set no cookies and we save nothing on your device. We keep these anonymous counts for up to 400 days, and use them only to see how the site is used, in real time.
- Partner link clicks: when you follow a link marked Partner link, our server counts it: the product, where on the page the link was, the page, your country (from Cloudflare) and the date. No IP address, cookie or identifier is kept. The company you go on to may set its own cookies to record that we referred you.
- Google Analytics 4: helps us understand which pages and tools are useful. It sets cookies (
_gaand_ga_*, kept for up to 2 years) and processes your IP address (shortened by Google), device and browser details, the pages you visit and which tools you use (for example that a check ran and the risk level it found, never what you checked). In the EEA, the UK and Switzerland these cookies are only set if you agree in our cookie message. Elsewhere they are set by default and you can say no at any time. Google processes this data for us under its data processing terms. We have turned off Google's optional data sharing. The text, links and screenshots you check are never sent to Google Analytics. Change your choice any time with Cookie settings. - Advertising (Google AdSense): our guides and other content pages show ads served by Google AdSense. The checker on the home page, the report and contact forms, the Family Shield page and our legal pages carry no ads.
- What Google does: Google and the ad partners it works with use cookies and similar identifiers (for example
__gads,__gpi,__eoiand, on Google's own domains,IDE) to show ads, limit how often you see the same ad, measure results and prevent fraud. If you allow it, they also use them to show personalised ads based on the sites and apps you have used, including this one. Google is responsible for the data it collects this way; see how Google uses data from sites that use its services and how Google uses cookies in advertising. - How we ask first: every page loads Google's own consent message (a Google-certified consent tool, run through AdSense's Privacy & messaging settings and the IAB TCF framework). In the EEA, the UK and Switzerland it asks you before any advertising cookie is set, and Google Consent Mode keeps advertising and analytics storage switched off until you answer. If you say no, Google may still show non-personalised ads (chosen from the page you are reading and your rough location), which can use cookies only for things like frequency capping, reporting and fraud prevention, or limited ads, which use no cookies for advertising at all. Outside those countries personalised ads can be on by default.
- Changing your mind: use Cookie settings (also in the footer of every page) to reopen the consent message. To turn off personalised ads from Google on every site, use Google Ads Settings (My Ad Center). You can opt out of personalised ads from many other companies at youronlinechoices.eu or aboutads.info.
- What never goes to advertisers: the messages, links and screenshots you check. They are not used to choose ads, and no ad code runs on the checker.
- What Google does: Google and the ad partners it works with use cookies and similar identifiers (for example
Who processes data for us
Cloudflare (hosting, security, AI processing, email routing) and, for advertising, Google and the other ad partners listed in our ads.txt file. Some processing may take place outside the EEA under appropriate safeguards such as the EU Standard Contractual Clauses.
Your rights
You can ask to access, correct or delete your personal data, object to or restrict processing, withdraw consent at any time, and receive your data in a portable format. Email privacy@tapsafely.com. You can also complain to the data protection authority where you live. Our lead authority is the Commissioner for Personal Data Protection in Cyprus, where our company is registered. People outside the EU have the rights their local law gives them, and we honour deletion requests from anyone.
Children
Our checker can be used by anyone, but our newsletter and reporting forms are intended for people aged 16 and over.
Changes
We'll update this page when our practices change and show the date at the top.