Privacy · Cookies · Advertising · Updated 18 September 2026
What this site collects
Short version: almost nothing, and you can verify that yourself.
Message and prompt text is analysed inside your browser and is never sent anywhere. Not to us, not to a third party, not to an AI model.
Checking a crypto address is a network request. Only the address and the chain you selected are sent to the security data provider — never the message it came from.
This site's own code sets no cookies. Google's advertising may set them — section 6 says what and when.
No account, no sign-up, no wallet connection. There is nothing here to log in to.
1. Who runs this site
SaveSaveSaveSave (savesavesavesave.xyz) is operated by Stefan Tsezarov as an independent project. Contact is through the project's public issue tracker, linked at the end of this page.
2. Scanning a message or prompt
When you paste text into the message scanner, the analysis runs entirely in JavaScript inside your own browser. The text is not uploaded, not logged, not stored, and not shown to anyone. When you close the tab it is gone.
You do not have to take that on trust. Open your browser's developer tools, switch to the Network tab, paste a message and press Scan. You will see no requests at all. That is how this was verified before publishing: a scan of a message containing a marker string, a phishing link, a seed-phrase request and an injection payload produced a full FAIL verdict and zero network requests.
A Content-Security-Policy restricts the page's outbound connections to the hosts listed in section 4 and nowhere else, and the browser itself enforces that. Be aware that the list grew when advertising was added: it now includes Google's ad hosts, so the policy alone no longer proves that scan text cannot leave. What holds that property today is the code — the scanner makes no network call at all — plus a test that fails the build if anything scan-derived can reach an advertising call.
3. Scanning a crypto address or token
This part does use the network, because the security data lives elsewhere. When you check an address, the address itself and the chain identifier are sent to a third-party security data provider, and for sanctions checks to a public blockchain node through our own proxy.
What is sent is the address and the chain. What is not sent is the message the address came from, any other text on the page, or anything identifying you beyond the ordinary information any web request carries (your IP address and browser user-agent, which every website you visit receives).
If an address came from a message you pasted, only the address travels. The message stays in your browser.
4. Third parties that receive anything
| Service | When it is contacted | What it receives |
|---|---|---|
GoPlus Labsapi.gopluslabs.io | When you check an address or token | The address and chain id, plus your IP and user-agent |
Our own Cloudflare Worker*.workers.dev | For chains where a direct call is blocked, and for sanctions checks | The address and chain id, plus your IP and user-agent |
Google Fontsfonts.googleapis.com, fonts.gstatic.com | On every page load, to load the typefaces | Your IP and user-agent. No scan data ever reaches it. |
| Cloudflare | On every page load — Cloudflare serves this site | Standard web-server request data |
Cloudflare Web Analyticsstatic.cloudflareinsights.com, cloudflareinsights.com | On every page load, to count the visit | Page URL, referrer, approximate country, browser and device type, page-load timing. No cookie. No scan content — see section 5. |
Google AdSensepagead2.googlesyndication.com, *.g.doubleclick.net and related Google ad hosts | On every page load, to serve the ads in the side columns | Page URL, your IP and user-agent, and Google's own advertising cookies. No scan content — see section 7. |
Google consent toolfundingchoicesmessages.google.com | On page load, to show the EU/EEA consent message | Your IP and user-agent, and your consent choice. No scan content. |
Each of these operates under its own privacy policy, which this site does not control.
5. Analytics
This site uses Cloudflare Web Analytics to count page views. It is privacy-preserving by design: it sets no cookies, uses no fingerprinting, and does not track you across other websites. It records page URL, referrer, approximate country, browser and device type, and page-load timing.
It never receives the content of a scan. Not the message, not the prompt, not the address, not the verdict, not any finding. Those never leave the part of the page that computes them.
6. Cookies and browser storage
This site's own code sets no cookies and writes nothing to localStorage, sessionStorage or IndexedDB. Nothing you scan is stored anywhere, in your browser or ours.
Google's advertising is a different matter. Ad serving, and the consent dialogue that goes with it, can set cookies in your browser. Those are under Google's control, not ours. Nothing on this page reads them.
If you are in the EU or EEA, Google's consent tool will show you a message before personalised advertising runs, and will record your answer. You can change it later through the same dialogue.
An ad blocker removes all of it. We do not detect one, do not ask you to turn it off, and the scanner works identically either way.
7. Advertising
Some pages carry advertising. Several deliberately do not. The provider is Google AdSense, publisher ID ca-pub-7192453271158919, shown in two labelled columns at the sides of wide screens. It is not shown on phones or narrow windows at all.
Advertising is switched off entirely on the pages where it could do harm, and on those pages the advertising hosts are removed from the page's own Content-Security-Policy as well as from its markup, so nothing can load even by accident:
- The Twelve Words, Read It From the Right, The Instruction You Didn't Write and The Text You Can't See — someone may be reading these while being defrauded, and a commercial link beside that warning could be mistaken for our recommendation.
- This page and the Terms — a commitment should not be surrounded by advertising.
Between 18 and 20 September 2026 every page carried the ad code, including those four. That was a default rather than a decision, and it has been corrected. The full list of which pages carry advertising and why is in apply-ads.js in the public repository.
At the time of writing the site is still under review by Google, so the remaining ad slots are usually empty, and a slot that has nothing to show now stays hidden rather than displaying an empty labelled box.
The content of your scans is never used for advertising. Not the message, not the prompt, not the address, not the verdict, not any finding, not any link extracted from your text.
The ad code receives the address of the page you are on, and nothing else. It sits outside the part of the page that displays results and is never given anything the scanner computed. An automated test fails the build if that stops being true.
What Google receives is the page URL, your IP address, your user-agent, and whatever its own cookies tell it — the same as on most advertising-supported sites. Google processes that under its own policies, which this site does not control.
These commitments are part of this policy:
- No advertiser can influence a verdict, and no payment can remove or downgrade a risk finding.
- Ads are labelled as advertising, kept out of the scan result area, and kept off the guides that explain scams.
- Scan data is never sold, shared, or aggregated for anyone else's use.
- No sponsorship will be accepted from a project this scanner would reasonably need to assess.
A correction, recorded rather than quietly edited.
An earlier version of this page promised it would be updated to name the ad provider before any ad code was deployed. The ad code went live on 18 September 2026 and this page was updated a few hours later, not before. The order was wrong and the promise was broken, by us, and this note stays here so the record is accurate.
8. What is stored, and for how long
This project stores nothing about you. There is no database of scans, no account system, no scan history, no email list. Server logs handled by Cloudflare as part of serving the site are subject to Cloudflare's own retention.
9. Your rights
Rights such as access, correction, erasure and objection apply to personal data that an operator holds. This project holds none, so in practice there is nothing to export or delete. If you believe that is wrong in your case, get in touch and it will be looked at properly.
Requests concerning data held by the third parties in section 4 have to be made to those companies, which this site cannot do on your behalf.
10. Children
This site is not directed at children and does not knowingly collect information from them. It collects no personal information from anyone.
11. Security
The site is served over HTTPS only, with a strict Content-Security-Policy, HTTP Strict Transport Security, and framing disabled. Never enter a seed phrase, private key, password or authentication code into this site — or into any AI system. Nothing legitimate ever needs them, and this site has no field that asks for them.
12. Changes to this policy
Material changes will be reflected here with a new date at the top. Changes that affect what leaves your browser will be described explicitly rather than folded into general wording.
13. Contact
Questions, corrections and privacy requests: savesavesavesave@tuta.io.
Anything that does not concern your own data — a factual correction, a bug, a suggestion — is also welcome in the open at the project's issue tracker. The email address above is the route that does not require a GitHub account, and it is the one that will always work.
This page describes how the site behaves. It is not legal advice, and it is not a claim of compliance with any particular law. If you need that assurance for your own use of the site, seek your own advice.