Effective July 11, 2026 · Version 1.1
When you submit content — a text, email, link, ad, or description — it is processed in memory to produce your verdict and is not stored by us afterward. We do not keep a history of your checks, and we cannot show them to anyone, because they do not exist after we answer you.
To produce a verdict, your submitted content is sent securely to our AI provider, Anthropic, which analyzes it and returns the result. Under Anthropic’s API terms, content sent this way is not used to train their AI models. If your content contains a web link, we run two safety checks on that link: we look up public registration records for the website (for example, how old it is), and we may check the link against trusted safety databases — such as Google’s list of known dangerous sites — to see if it is already known to be harmful. For these checks we send only the web link, never your message and never other personal details, and we never visit the suspicious link ourselves.
Our hosting provider (Vercel) keeps standard, short-lived server logs — such as IP address, browser type, and request time — used for security and keeping the service running. We currently run no advertising trackers and no third-party analytics on the service.
To use an account we collect what a subscription needs and no more: your email address, your plan, and a count of checks used (a number — not the content of your checks). Payments are processed by Stripe; your card number goes to Stripe, not to us.
Family plans are built so that each person’s checks stay private to them — being on a shared plan never means being watched. When you accept a family invite, you agree that if one of your checks comes back as a likely scam, we let your plan owner know that we caught something — never what you checked, only that a check was flagged. Alerts are on by default with the invite, and you can turn them off at any time in your account.
If you save trusted contacts — for example, phone numbers for a family safe-word or for quick help in an urgent moment — we store those names and numbers so we can show them back to you. We never store a safe word itself.
We do not sell or rent your personal information. We do not share your content except with the service providers named in this policy, and only to answer you. We do not use your content to train AI models. We do not run ads. If any of this ever changes, we will update this policy and tell you first — but our plan is that it never changes, because privacy is the product.
We use a small number of providers to run CheckTwice: Anthropic (AI analysis), Vercel (hosting), Cloudflare (domain and network services), Supabase (accounts and database), Stripe (billing), and Resend (sending account and alert emails). We may also check links against Google’s Web Risk safety database. Each receives only what it needs to do its job, and none receives the content of your checks except our AI provider.
Depending on where you live (including California and other U.S. states with privacy laws), you may have rights to access, correct, or delete personal information, and to know how it is used. Because we keep so little, most requests are simple: email hello@checktwice.app and we will handle it. We honor Global Privacy Control signals where required. We will never treat you differently for exercising a privacy right.
CheckTwice is for adults and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, email us and we will delete it.
All connections to CheckTwice are encrypted (our .app domain requires it). We minimize what we hold — the strongest protection for your data is that we do not keep it.
If we change this policy, we will post the new version here with a new effective date, and notify account holders of material changes before they take effect.
Privacy questions or requests: hello@checktwice.app