Privacy policy

Last updated: 9 October 2026

ScamChk is a Chrome extension that checks emails in Gmail for scams and phishing. This page says, in plain words, what it reads, what leaves your browser, who sees it, and how long we keep it.

ScamChk is a product of 2morrow.ai, LLC, 2730 S Wadsworth Blvd Ste B # 1013, Denver, CO 80227, USA ("we"). Questions: info@scamchk.app.

The short version

• ScamChk reads an email only to check it: the one you open, the ones you select, or the page you're looking at when Auto-check is on. Auto-check is off by default.
• For a check, a summary of that one email goes to our checking server. We don't store the email. We store the answer.
• When the free checks can't decide, an AI service reads the email's text to judge it.
• No ads. We never sell your data.

What ScamChk reads in your browser

On your Gmail page, ScamChk reads the email being checked: its headers (sender, reply address, Gmail's own sender checks), its links, the names of images and attachments, and its visible text.

Before anything leaves your browser, ScamChk:

• replaces your own email address with a placeholder, everywhere it appears;
• removes everything after the "?" in every link, and masks parts of links that look like personal codes;
• leaves out the email's raw source and HTML;
• caps the text at 8,000 characters.

What leaves your browser, and where it goes

Our checking server (Supabase, United States) receives, for each check:

• the sender's and reply addresses and names, the subject and date;
• Gmail's results for the sender checks (SPF, DKIM, DMARC) and other technical header results, such as which domains signed the email and how many mail servers it passed through;
• the links (visible text and destination, without the part after "?");
• image descriptions, attachment names and types;
• the visible text, with your address replaced;
• your language and time zone, so we can judge whether the story fits you;
• a one-way code for the email (a hash of Gmail's message id, not the id itself), so the answer can be found again.

Checks on domains and links:

• Google Web Risk receives the link addresses, to see whether Google lists them as dangerous.
• rdap.org receives domain names, to find out how old a domain is. It forwards the lookup to the registry that runs the domain's ending (for example .com).
• Cloudflare's DNS service receives domain names, to read their public email settings.

AI analysis, only when the free checks can't decide: the email's text and the facts above go to one of these AI providers: OpenAI (GPT models), Google (Gemini models) or Anthropic (Claude models). Which one depends on which model gives the best results at the time. We use their paid APIs. Under those terms, they don't use the content to train their models. We ask OpenAI not to store it. Each provider may keep requests for a limited time to detect abuse, under its own terms.

Google sign-in: you sign in with your Google account. We receive your email address, your name and profile picture as Google shares them, and Google's account id. We don't receive your password, and ScamChk gets no access to your Gmail through Google's APIs. It works only on the Gmail page open in your browser.

Email list (Zcope): if you join the beta or the waitlist, your email address goes to Zcope, the service we use to email you about your waitlist place and the beta, with the date you joined and whether you're in the beta or on the waitlist. These are service emails; we'd ask before sending you marketing. Every email has an unsubscribe link.

What we keep, and for how long

Shared sender library. When a sender is verified and its emails look clean, ScamChk adds the sender's domain to a library shared by all users: the domain, its usual link domains, and how many users have seen it. To count users without naming them, it keeps a one-way code per user and domain, which is deleted with your account. It never records what the emails said.

In your browser, ScamChk keeps a list of recently checked emails with their colours (at most 2,000) and your settings, in Chrome's extension storage. Whether you've seen the first-run notice is synced by Chrome across your browsers.

What we never do

• We don't sell your data, and we don't show ads.
• We don't use your emails to train AI models.
• We don't read emails that you or Auto-check didn't ask us to check.
• We don't share your data except with the services listed above, which we use only to run ScamChk.

If ScamChk itself is ever sold or merged into another company, your data goes with it under this policy, and we'll tell you before anything changes.

Chrome Web Store and Google user data

ScamChk's use of information received from Google, and of the email content it reads in your browser, is limited to checking emails for scams and phishing, the extension's single purpose. It complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We don't transfer this data except as described here, we don't use it for advertising, and people don't read it except to investigate abuse or a problem you report, or as the law requires.

Your choices and rights

• Stop checking: turn Auto-check off, or remove the extension. Nothing more is sent.
• Delete your data: email info@scamchk.app from the address you signed in with, and we delete your account and everything linked to it within 30 days. A delete button in your account page is on the way.
• Unsubscribe from beta and waitlist emails with the link in any of them.
• Depending on where you live, you may have more rights: to see, correct, move or delete your data, or to object to how we use it. Write to info@scamchk.app. You may also complain to your data protection authority.

Children

ScamChk isn't meant for children under 16, and we don't knowingly collect their data.

Changes

If we change this policy in a way that matters, we'll say so on this page and email signed-up users before it takes effect.