Privacy
What happens to what you paste.
Short version: we mask personal details first, keep the masked report for 30 days and show it only to you, unless you choose to share it. You can delete it any time.
SI Check is run by the operator (name to be completed). Questions about your data: hello@sicheck.com.
What we collect
- What you submit (a message, link or phone number), only for the time it takes to check it, in memory. Before anything else reads it, we mask card numbers, bank-account numbers, ID numbers, email addresses (keeping the domain), phone numbers (keeping the country code and last two digits), one-time codes and long digit strings.
- The masked text and the report, so you can reopen them. Only you can see them. Stored for 30 days, then deleted. You can delete them earlier from the report page.
- A public link, only if you ask for one. Sharing a report is your choice, and we ask you to confirm it first. It creates a separate random link that lets anyone who has it read the report and the masked text. It isn’t listed or searchable. You can switch it off at any time, and it ends when the report is deleted or expires.
- Your answers to “Was this right?” — stored without the report or its text, so deleting a report leaves no trail back to its content.
- Your IP address is counted in memory to limit abuse and to back up the daily free allowance. It is never written to our database as is; only the keyed hash described below.
- A daily check count for your browser and your device, so we can offer free checks each day without a private window or a second browser starting the count again. For the browser we store a one-way, keyed hash of a random browser id. For the device we store a one-way, keyed hash of your network address together with your operating system (for example “Windows” or “Android”, from what your browser tells every site it visits). Neither names you or can be turned back into your address, and each count is deleted after two days.
- If you subscribe to Plus: your email address and your subscription status. Payment is handled by Stripe; we never see or store your card. Reports you run while signed in are linked to your account so you can find them again, and are still deleted after 30 days.
We can’t reliably mask names and street addresses. Paste only what you need.
What SI sees
SI sees the masked text, plus measurements about links and numbers, and, for a link we visit, a short excerpt of the page it leads to. SI runs on Google (Gemini API)’s infrastructure, and we only send what is needed to produce the judgment. We don’t use what you submit to train our own models. SI currently runs on Google’s free Gemini tier, where Google’s terms allow it to use content sent to the API to improve its products, and where people may review it. That is why the text is masked first. We will update this page if that changes.
Screenshots and voice notes (Plus) are the exception: a file can’t be masked before it is read, so SI sees the image or hears the recording as you sent it. It is held in memory only while it is read and is never stored. What SI reads from it is then masked like pasted text, and only that masked text is kept with your report. If a screenshot shows details you don’t need checked, crop them out first.
Who processes data for us
| Provider | For |
|---|---|
| Google (Gemini API) | Producing the judgment from masked text, and reading screenshots and voice notes (Plus) |
| Hosting and database provider (to be named here) | Running the site and storing masked reports |
| Stripe | Taking Plus payments and managing subscriptions. Only for subscribers. |
| Resend | Sending the sign-in link a Plus subscriber asks for. Only your email address and the link. |
| Domain registries (public RDAP servers) | Looking up the age of domains found in your message. Only the domain name is sent. |
| The sites behind links you check | Receiving a visit from our server, identified as SICheckBot. See SICheckBot. |
Cookies
Only cookies the service needs to work, none of them readable by scripts:
- sc_vid: a random id for your browser, so we can count your free checks for the day. It isn’t linked to who you are.
- owner: set when you run a check. It proves your browser ran that one check, so only it can open, share or delete that report. It expires with the report.
- sc_session: only if you sign in to Plus. It keeps you signed in for up to 90 days, or until you sign out.
There are no advertising or tracking cookies, and no third-party scripts or fonts.
Your text-size preference and the “Your recent checks” list are kept in your browser’s local storage and never sent to us. You can clear the list from the home page.
Your choices
- Delete a report from its page, using the browser that ran the check.
- Do nothing: every report deletes itself after 30 days.
- Cancel Plus from your account page. To have your account and email deleted, email hello@sicheck.com.
Children
SI Check is for adults and teenagers checking things they’ve received. We don’t knowingly collect information from children.
Changes
If this page changes in a way that matters, we say so on the page and in the Charter’s change history.