Privacy

What you send us

Messages, links and screenshots you submit for a check.

Screenshots are processed in memory, sent to our AI provider for analysis and then discarded. They are never saved to our servers or storage.

Before anything is stored, we remove phone numbers, account numbers, BVN/NIN, card numbers, one-time codes and email addresses.

What we keep

The redacted text of a check, for 30 days. After that it is deleted and only the result (risk level and reasons) remains.

One-way hashes of phone numbers, account numbers and website domains, so we can tell you when something appeared in earlier high-risk checks. The original values cannot be recovered from these.

A random device identifier in a cookie (stored by us only as a hash), so only you can open your results.

Your email address, only if you buy checks.

If someone gives you a free check, the email address or phone number you enter to claim it — and whether you asked for updates. You can ask us to stop at any time.

Who processes your data

AI analysis: OpenAI (API). We ask that submissions are not stored for later use. Under OpenAI’s API terms, API data is not used to train their models by default, and may be held for up to 30 days for abuse monitoring before deletion.

Hosting: Vercel. Database: Supabase. Payments: OPay and Kora. Email (restore links): Resend. Bot protection: Cloudflare Turnstile. Link reputation: Google Web Risk (paid checks only).

Your choices

You can delete any check from its result page at any time.

Shared warning pages never show what you submitted — only the risk level, reasons and advice.

Questions, corrections or a request to delete your data: hello@guava-group.com. We answer within 5 working days.