Privacy · Cookies · Advertising · Updated 23 October 2026

What this site collects

Short version: almost nothing, and you can verify that yourself.

1. Who runs this site

SaveSaveSaveSave (savesavesavesave.xyz) is operated by Stefan Tsezarov, Bulgaria, as an independent project. He decides what this site processes and why, and is the controller of that processing under the EU General Data Protection Regulation (GDPR). Contact for anything in this policy: savesavesavesave@tuta.io.

2. Scanning a message or prompt

When you paste text into the message scanner, the analysis runs entirely in JavaScript inside your own browser. The text is not uploaded, not logged, not stored, and not shown to anyone. When you close the tab it is gone.

You can check this part yourself. Open your browser's developer tools, switch to the Network tab, paste a message and press Scan. Your text is not in any request. The one request you will see is the scan count to our own Worker (section 5), and it is not sent at all if your browser uses Global Privacy Control. That is a check of one visit, not a proof about every possible visit.

No third-party script runs on the scanner page. The page that holds your message and its result loads no advertising, no consent tool and no analytics script. Its Content-Security-Policy lets scripts come only from this site and lets the page connect only to the address and package services in section 4 and our own Worker; the browser enforces that. Code from other sites could otherwise read what is on the page, so keeping it off this page is the control, not a promise about what that code would do. Browser extensions with permission to access this site may be able to read information entered here.

Spot the Trap. On the challenge pages, the answer you select stays in the page while it is open. It is not sent, not written to browser storage, and not included in a shared link or card; reloading starts the round again. The individual challenge pages load no advertising, analytics or third-party script. The challenge list at /spot-the-trap carries Google advertising in the side columns on wide screens (section 7); it holds no challenge and no answer. Like every page, they are delivered by Cloudflare, which receives ordinary request information such as your IP address.

2a. The spyware check

On the spyware check page, what you check stays in your browser: a pasted message, and an Android collection you select, are read and compared in that tab only. They are not uploaded, not stored in the browser, and not sent to us or anyone else. A result is downloaded only when you press "Save this result". The page has no analytics, ads or scan counter.

When you press "Load the lists", your browser downloads the published indicator lists from this site. That request reaches Cloudflare, our hosting provider, with the connection metadata of any page request (your IP address, browser user-agent, time, and the list files requested), and is handled like any other request (section 8). It contains nothing you check. No other site is contacted, and no address that matches a list is ever opened.

Cloudflare also adds a standard "Network Error Logging" instruction to its responses. If a connection to this site fails, your browser may report that failure (the address it tried, the error, timing and your IP address) to Cloudflare at a.nel.cloudflare.com. Successful requests are not reported. This is part of the hosting, not of the spyware check, and never contains what you check.

3. Scanning a crypto address or token

This part does use the network, because the security data lives elsewhere. When you check an address, the address itself and the chain identifier are sent to a third-party security data provider, and for sanctions checks to a public blockchain node through our own proxy.

What is sent is the address and the chain. What is not sent is the message the address came from, any other text on the page, or anything identifying you beyond the ordinary information any web request carries (your IP address and browser user-agent, which every website you visit receives).

If an address came from a message you pasted, only the address travels. The message stays in your browser.

Checking an npm package. When you check a package, its name (and the version, if you give one) is sent from your browser to the npm registry and npm's download counter (registry.npmjs.org, api.npmjs.org) and to OSV.dev (api.osv.dev), Google's open vulnerability database. Like any web request, these carry your IP address and browser user-agent. Nothing else is sent, the package's code is never downloaded or run, and nothing about the check reaches an advertiser.

4. Third parties that receive anything

Who is responsible for what. Cloudflare (site delivery, our Worker, Web Analytics) processes request data for this site on the operator's behalf, under Cloudflare's data processing terms; requests about that data come to us (section 9). GoPlus, PublicNode, npm, OSV.dev and Google receive a request directly from your browser, or from our Worker for the checks you start, and decide for themselves what they keep; each does so under its own privacy policy, which this site does not control.

Transfers outside the EU. Several of these providers are established, or process data, outside the European Economic Area, including in the United States. Where the operator transfers data to a provider acting on its behalf, the transfer relies on that provider's data processing terms, which include the European Commission's standard contractual clauses, or on the EU–US Data Privacy Framework where the provider is certified under it.

5. Analytics

This site uses Cloudflare Web Analytics to count page views on every page except the scanner. Cloudflare describes it as setting no cookies and not tracking you across sites. It records page URL, referrer, approximate country, browser and device type, and page-load timing.

It is not loaded on the scanner page, so it is not present where a message or result is shown.

Scan counts. When a scan finishes, the page sends one small request to our own Cloudflare Worker naming the kind of scan (address or message; for addresses, token or wallet and the chain) and the verdict it reached. The Worker adds one to a daily total. The stored total contains only those words: never the address or text you scanned, and no cookie, ID or IP address. While Worker logging was on, the request itself was logged with your IP address and other request details. Routine request logging for our Worker was switched off on 20 October 2026, found switched back on by a later deploy, and switched off again on 23 October 2026. The deploy configuration now keeps it off, and a test fails if it is changed. Records from before 23 October expire under Cloudflare's retention period. A browser that sends Global Privacy Control does not send the counting request.

The totals are public. The homepage shows how many scans ran in the last seven days, and anyone can read the same summary, split by kind and verdict, at our Worker's public stats address. To show that line, the homepage asks our Worker for the number when it loads; that request carries nothing about your scans. The logging history and current settings are described in section 8.

Warning cards. After a FAIL or CAUTION result you can make a "Share this warning" image. It is drawn in your browser from the result already on your screen and is never uploaded to us. A card for a message scan does not contain the message text, only fixed descriptions of what was found. Where the image goes after that is up to you.

6. Cookies and browser storage

This site's own code sets no cookies and writes nothing to localStorage, sessionStorage or IndexedDB. Our code does not save your scan input in browser storage. Message analysis runs locally, and our code does not transmit or store the message text. Address checks can involve storage outside your browser, including the short-lived edge cache and request logs from before 23 October 2026, described in sections 4 and 8.

Google's advertising is a different matter. Ad serving, and the consent dialogue that goes with it, can set cookies in your browser. Those are under Google's control, not ours. Nothing on this page reads them.

If you are in the EU or EEA, Google's consent tool will show you a message before personalised advertising runs, and will record your answer. You can change it later through the same dialogue.

An ad blocker removes all of it. We do not detect one, do not ask you to turn it off, and the scanner works identically either way.

7. Advertising

Some guide pages and the Spot the Trap challenge list carry advertising. The scanner never does. The provider is Google AdSense, publisher ID ca-pub-7192453271158919, shown in two labelled columns at the sides of wide screens. It is not shown on phones or narrow windows at all.

Advertising is switched off entirely on the scanner and on the pages where it could do harm, and on those pages the advertising hosts are removed from the page's own Content-Security-Policy as well as from its markup, so nothing can load even by accident:

• The Twelve Words, Read It From the Right, The Instruction You Didn't Write, The Text You Can't See and The Address You Can't Pay — someone may be reading these while being defrauded, and a commercial link beside that warning could be mistaken for our recommendation.
• The scanner itself — advertising code running on the page that holds your message could read it, so it is not there at all. Until 20 October 2026 the scanner did carry ads in its side columns.
• This page and the Terms — a commitment should not be surrounded by advertising.

Between 18 and 20 September 2026 every page carried the ad code, including those four. That was a default rather than a decision, and it has been corrected. The full list of which pages carry advertising and why is in apply-ads.js in the public repository.

At the time of writing the site is still under review by Google, so the remaining ad slots are usually empty, and a slot that has nothing to show now stays hidden rather than displaying an empty labelled box.

What Google receives is the page URL, your IP address, your user-agent, and whatever its own cookies tell it — the same as on most advertising-supported sites. Google processes that under its own policies, which this site does not control.

These commitments are part of this policy:

• No advertiser can influence a verdict, and no payment can remove or downgrade a risk finding.
• Ads are labelled as advertising, kept out of the scan result area, and kept off the guides that explain scams.
• Scan data is never sold, shared, or aggregated for anyone else's use.
• No sponsorship will be accepted from a project this scanner would reasonably need to assess.

8. What is stored, why, and for how long

There is no account system, no scan history and no email list. What is kept, and by whom:

• Message text: never sent, so never stored.
• Daily scan totals (section 5): kind, chain and verdict only, kept as public totals.
• Cloudflare request logs for our Worker. Routine request logging for our Worker was switched off on 20 October 2026, found switched back on by a later deploy, and switched off again on 23 October 2026. The deploy configuration now keeps it off, and a test fails if it is changed. Records from before 23 October expire under Cloudflare's retention period. While it was on, records included the request URL (which can contain a checked address), your IP address, user-agent, referring page, language, Cloudflare-provided location estimates and timing. Location estimates are not evidence of access to your device's GPS. Error and trace logging for the Worker is off as well. This applies to the address-check Worker, not to separate site-delivery or upstream-provider logging.
• Cloudflare edge cache: GoPlus answers fetched by our Worker, keyed by the address, for up to 15 minutes.
• Third parties in section 4 keep what they receive under their own policies.

Why each kind of processing happens (legal basis under GDPR Article 6):

• Delivering pages and protecting the site and Worker (request data at Cloudflare, including your IP address): legitimate interests, Article 6(1)(f). A website cannot be delivered or defended against abuse without it.
• Address, wallet, token and package checks you start: legitimate interests, Article 6(1)(f), in giving you the result you asked for. Nothing is sent until you press a check.
• Scan counts and Cloudflare Web Analytics: legitimate interests, Article 6(1)(f), in knowing in aggregate whether the site is used. A browser sending Global Privacy Control does not send the scan count.
• Advertising cookies and personalised advertising on guide pages: your consent, collected by Google's consent tool where the law requires it. You can withdraw it at any time through the same dialogue; withdrawing does not affect anything before it.
• Emails you send us: legitimate interests in answering you; for a data-protection request, the legal obligation to respond, Article 6(1)(c). Emails are deleted 12 months after the matter is closed, unless they are needed to establish or defend a legal claim.

No decision with legal or similarly significant effect is made about you by automated means. A verdict describes an address, package or message, not you.

9. Your rights

Under the GDPR you have the right to ask for access to your personal data, its correction or erasure, restriction of its processing, and a portable copy where that applies. You can object at any time to processing based on legitimate interests (section 8), and withdraw consent at any time where processing relies on it.

Send requests to savesavesavesave@tuta.io. You will get an answer without undue delay and within one month; if a request is complex and needs longer, you will be told why within that month. We will only ask for information needed to find the data concerned, never an identity document by default. Because the site has no accounts, we may need details such as the address you checked and the approximate time to find any record. Do not include a recovery phrase, password, private key or authentication code in your request.

This covers data processed for this site by Cloudflare on our behalf, including historical Worker request logs: we handle the request and obtain Cloudflare's help where needed. Data that a provider in section 4 received directly and holds as its own controller is outside our access; we will tell you which provider holds it and how to contact them.

You also have the right to complain to a data-protection authority. In Bulgaria that is the Commission for Personal Data Protection (cpdp.bg); you can also complain in the EU country where you live or work.

10. Children

This site is not directed at children. The request metadata and storage described above can nevertheless include personal data, so the absence of an account system does not mean that no personal data is processed.

11. Security

The site is served over HTTPS only, with a strict Content-Security-Policy, HTTP Strict Transport Security, and framing disabled. Never enter a seed phrase, private key, password or authentication code into this site — or into any AI system. Nothing legitimate ever needs them, and this site has no field that asks for them.

12. Changes to this policy

Material changes will be reflected here with a new date at the top. Changes that affect what leaves your browser will be described explicitly rather than folded into general wording.

13. Contact

Questions, corrections and privacy requests: savesavesavesave@tuta.io.

Anything that does not concern your own data — a factual correction, a bug, a suggestion — is also welcome in the open at the project's issue tracker. The email address above is the route that does not require a GitHub account, and it is the one that will always work.

This page describes how the site behaves. It is not legal advice, and it is not a claim of compliance with any particular law. If you need that assurance for your own use of the site, seek your own advice.