Privacy notice

• The photos you upload. We resize them, remove embedded metadata, and send them to a reverse image search provider to find public pages where the same image appears. We also read the metadata before removing it, to note whether editing software was recorded.
• The optional name you type. Used only to compare against names found on public pages. It is stored with the report and never written to logs.
• A hashed form of your IP address. Used for rate limiting and abuse prevention. The raw address is never stored; the hash uses a salt that changes daily.
• Payment. Handled entirely by Stripe. We receive a confirmation and a session reference, never your card details.

Our lawful basis under UK GDPR is legitimate interests: helping people avoid romance fraud, which is a recognised and serious harm. We have balanced this against the interests of people whose photos may be checked, which is why we keep nothing that identifies them.

• Uploaded photos: deleted as soon as the check completes, and in any case within one hour by an automatic storage rule.
• Reports: the headline, the public URLs found, page titles, and an image fingerprint (a perceptual hash, not the image) are kept for 30 days so your link keeps working, then deleted.
• Fingerprints and public URLs are cached for 30 days so the same photo is not re-searched needlessly.
• Misuse reports you send us are kept until resolved.