Privacy policy

What you choose to share

The checker accepts pasted text and descriptions of calls. Image checking is currently blocked because this deployment cannot verify in-process OCR and permanent pixel redaction. TrustBuddy will not send an uploaded image to Google Gemini while that protection is unavailable.

Continue to remove passwords, one-time codes, full card numbers, identification numbers, and personal information that is not needed to understand the situation.

Automatic text redaction

Before text is sent to Google Gemini, TrustBuddy performs server-side detection and replacement for supported email addresses, valid phone numbers, payment-card numbers, recognizable bank or account numbers, supported government identifiers, passwords, verification codes, recognized API keys and authentication tokens, reliably formatted physical addresses, contextually identified personal names, and some ambiguous long numeric identifiers. Replacements describe the removed category, such as [REDACTED_PHONE], so the scam pattern remains understandable.

Detection uses deterministic validation and maintained validation libraries. Names, addresses, uncommon identifier formats, multilingual text, misspellings, and intentionally disguised information may be missed or incorrectly redacted. TrustBuddy verifies the sanitized text again and blocks processing when it cannot complete the privacy check safely.

How a check works

The processing sequence is validation, personal-information detection, redaction, verification, and then AI analysis. Only sanitized text, TrustBuddy’s system instructions, and the required response format are sent to Google Gemini. There is no fallback that forwards the original text or an original image when privacy processing fails.

Storage and service providers

This app has no analysis-history database and does not intentionally write scam-check text or results to files or application logs. Your current input and result remain in the page’s memory until you clear them, leave the page, or reload. Hosting providers may process technical request information such as IP addresses, timestamps, and request metadata.

Google’s handling of sanitized content depends on the API project’s service tier and settings. Unpaid services may use submissions and responses to improve Google products and may involve human review. Paid services have different data-use terms; abuse-monitoring, security, legal, optional project logging, or dataset retention may still apply. See Google’s Gemini API terms.

Feedback information

The feedback form stores your name, email address, usefulness, accuracy and recommendation answers, optional comments, and a creation timestamp. Result ratings store the thumbs-up or thumbs-down choice, general risk level, scam category, and a timestamp. They do not store the suspicious message or image.

Configurable retention controls are available for feedback and ratings. Until the site owner chooses and configures a retention period, records are not automatically deleted. TrustBuddy does not currently offer a self-service deletion screen; deletion requires authorized database administration.

After a successful feedback-form submission, this browser stores a completion setting so the form does not appear again on the same device. Clearing browser data may remove that setting.

Accounts, cookies and measurement

Account registration and sign-in are not enabled, and we do not collect login details. TrustBuddy uses Google Analytics and the Google tag for audience and Google Ads measurement. Google may receive information about visits and interactions with the site and may use cookies or device identifiers according to your browser settings and Google’s policies. See Google’s Privacy Policy.

The app does not use browser storage for your scam-check history.

Check limits and abuse prevention

The free version allows five submitted checks per day, resetting at midnight India time. A signed, secure, HttpOnly browser cookie identifies guest browsers across tabs. Where hosting supplies an authenticated account identity, that identity is used instead. Shared-network limits, short request windows, duplicate detection, an in-flight lock, and a site-wide daily budget help protect the service from automated usage. Submitted checks may count even when the AI provider fails.

Rate-limit buckets and short-lived request locks contain hashed identifiers and timestamps, not the original IP address or suspicious text. Duplicate detection uses a secret-keyed digest rather than storing the message. Expired records are cleaned up during later requests. Clearing cookies may change your guest identity but does not bypass network safeguards. Limits cannot perfectly distinguish people sharing a connection or stop every distributed bot.

Detected attempts to override the AI’s instructions are rejected before analysis. Remaining input is isolated as untrusted evidence, and generated guidance is checked before display. These safeguards reduce risk but cannot guarantee detection of every prompt injection.

Your choices

You can browse without submitting content. Remove unnecessary personal information before checking. Use “Check another” to clear the current input and result. Clearing the page does not delete records already retained by a service provider.

Who is behind TrustBuddy?

TrustBuddy is created by Prashant Singh Tewatia. A dedicated privacy contact has not yet been provided. Contact information and deployment-specific processing details should be added before a broader public launch.

Changes to this notice

We will update this page when the app’s data handling changes. The date above identifies the current notice.