Privacy Policy

1. Our Privacy Commitment

At InboxRisk, we are dedicated to building a safer email ecosystem while strictly safeguarding user privacy. We build technologies that help detect scam emails, temporary disposable addresses, and high-risk senders. This Privacy Policy details how we handle information collected through our website, free checking tools, developer APIs, and our community scam report platform.

2. Information We Collect and Process

Depending on how you interact with InboxRisk, we collect and process the following categories of information:

• Scam Report Submissions: When you submit a report on our community board, we collect the reported identifier (e.g., email address, phone number, social handle), the scam category, subject lines, descriptions, and uploaded screenshots.
• Checker Tool Inputs: Emails or domains you input to run checks are processed instantly to calculate threat scores. These queries are mapped to reputation indicators and checked against abuse blocklists.
• API Request Data: Developers using our API submit queries containing domains or email addresses for verification. We process these request parameters to deliver real-time risk status.
• Account Details: When you sign up for credits or subscribe, we collect authentication data (e.g., Google login info via OAuth) and transaction history logs.

3. Data Anonymization and Cryptographic Hashes

To protect privacy and comply with global standards (such as GDPR and CCPA), we apply strict sanitization policies:

• Hashed Values: Scam email addresses, phone numbers, and handles are normalized and stored as one-way SHA-256 cryptographic hashes. We never store original plaintext identifiers of scam reports in our public databases.
• Masked Display: When displaying public community data, we redact identifiers (e.g., displaying sc***@ex***.com instead of the full email address) to prevent scraping and protect identity.
• Screenshot Privacy: Screenshots uploaded as scam evidence are stored in secure buckets. We advise users to redact any personal identifiers or private information before uploading.

4. Cookies and Analytical Trackers

We utilize minimal cookies to facilitate user login sessions, secure transaction processing, and perform non-identifying aggregate analysis. We employ web analytics wrappers (such as Google Analytics) to observe general traffic trends, helping us improve platform loading speeds and search optimization.

5. Data Disputes and Removal (Right to be Forgotten)

If your email address or domain has been reported to our database in error or you believe a false positive exists, you have the right to request deletion or update. You can initiate a resolution file through our Dispute Center or contact our support team. Verified false positives are immediately blocklisted from threat ratings and removed from community feeds.