Privacy Policy

Draft under legal review. Last updated: October 2026. This English version is provided for convenience; if it differs from the Arabic version, the Arabic version prevails.

What we collect

  • When you sign in with Google: your name, email and profile picture. We never receive your password.
  • A daily counter of your checks, to apply the free limit. For visitors who aren't signed in we set a cookie with a random number that carries no information about them, and count the limit against it. We also keep an encrypted fingerprint of their address (not the IP address itself) for a daily cap that prevents abuse.
  • The message text you paste into “Check a message” is sent to our scanning server, analyzed on the spot, and not stored. We only record which scam pattern matched (a counter with no text and no address) to learn which tactics are most common. Links inside the message are checked like any link.
  • A screenshot you upload in “Check a screenshot” is read on your device (in your browser) and never uploaded to our servers or anyone else. We only send the text extracted from it to the message checker, where it is treated like message text.
  • A link you check is sent to our scanning server only for the duration of the check, and is not currently stored against your account. The scanning server opens the link itself to follow its redirects and read the page. If the page builds itself with scripts, the server opens it in an isolated browser (no cookies, no sign-in, no form filling) and takes a screenshot that is shown to you in the result. We don't store the page content or the screenshot. When we launch “alert me if a link I checked gets reported”, we will store only the links you ask us to watch, and you can delete them at any time.
  • “Your recent checks” are kept only in your browser (localStorage), never sent to us, and you can remove them with “Clear”. Reading a QR code with the camera happens on your device, and the image never leaves it.
  • Telegram bot: the message or link you send is checked on the spot and not stored, and we don't store your chat ID, only an encrypted fingerprint of it for the daily check counter. Business API checks are handled the same way: we don't store the content, only the number of checks per key.
  • If you arrive from an ad, we keep only the ad's name (e.g. “Snap, parcel campaign”) in your browser and in a first-party cookie for 30 days, to learn which ads help. We count aggregate visits and checks per ad, with no IP address or information about you. We don't use Snap, TikTok or X tracking pixels.
  • Public statistics counters shown on the site: the number of checks by type and the number of verdicts (fraud or suspicious). These are aggregate totals with no personal data, links or text.
  • For paid subscriptions: the invoice number, amount and date, and the card type and last 4 digits as shown on the payment gateway's receipt. Your mobile number is sent to the payment gateway to issue the invoice and is not stored by us. Your full card details never reach us.

Where your data is stored and who processes it

  • The database and website run on Cloudflare. The database is currently hosted in the Western Europe region, i.e. outside Saudi Arabia.
  • The scanning server runs inside the Kingdom of Saudi Arabia.
  • Google: for sign-in only (name, email and picture).
  • Paylink: the licensed payment gateway, which processes card details and issues the invoice.
  • Public lookup services that receive only the domain name (no data about you): domain registries (RDAP), certificate transparency logs (crt.sh), the Internet Archive, open phishing lists (OpenPhish, URLhaus and Phishing.Database), and a network information service (Team Cymru).

Why we collect it

  • To sign you in and protect your account.
  • To apply usage limits and prevent abuse of the service.
  • We never sell your data or share it for marketing.

How long we keep it

  • Account data: until you delete your account.
  • Usage counters: deleted automatically after 30 days.
  • Payment records: kept for the period required by accounting and tax regulations.
  • Sign-in session: ends after 30 days of inactivity, or when you sign out.

Your rights

  • You can permanently delete your account and all of its data from the “My account” page at any time.
  • You can request a copy of your data, or a correction, by emailing support@allsitey.com.

What we never do

  • We never reveal anyone's identity or address.
  • We never publish public lists of names or numbers.
  • Results are technical indicators about links and identifiers, not judgments of people.