Privacy · Cookies · Advertising · Updated 17 September 2026
What this site collects
Short version: almost nothing, and you can verify that yourself.
Message and prompt text is analysed inside your browser and is never sent anywhere. Not to us, not to a third party, not to an AI model.
Checking a crypto address is a network request. Only the address and the chain you selected are sent to the security data provider — never the message it came from.
No cookies are set. Nothing is stored in your browser by this site.
No account, no sign-up, no wallet connection. There is nothing here to log in to.
1. Who runs this site
SaveSaveSaveSave (savesavesavesave.xyz) is operated by Stefan Tsezarov as an independent project. Contact is through the project's public issue tracker, linked at the end of this page.
2. Scanning a message or prompt
When you paste text into the message scanner, the analysis runs entirely in JavaScript inside your own browser. The text is not uploaded, not logged, not stored, and not shown to anyone. When you close the tab it is gone.
You do not have to take that on trust. Open your browser's developer tools, switch to the Network tab, paste a message and press Scan. You will see no requests at all. That is how this was verified before publishing: a scan of a message containing a marker string, a phishing link, a seed-phrase request and an injection payload produced a full FAIL verdict and zero network requests.
There is also a structural guarantee behind it. The page ships a Content-Security-Policy that restricts outbound connections to the small list of hosts in section 4 and nowhere else. The browser itself enforces it, so the page cannot send your text somewhere else even if its code were changed to try.
3. Scanning a crypto address or token
This part does use the network, because the security data lives elsewhere. When you check an address, the address itself and the chain identifier are sent to a third-party security data provider, and for sanctions checks to a public blockchain node through our own proxy.
What is sent is the address and the chain. What is not sent is the message the address came from, any other text on the page, or anything identifying you beyond the ordinary information any web request carries (your IP address and browser user-agent, which every website you visit receives).
If an address came from a message you pasted, only the address travels. The message stays in your browser.
4. Third parties that receive anything
| Service | When it is contacted | What it receives |
|---|---|---|
GoPlus Labsapi.gopluslabs.io | When you check an address or token | The address and chain id, plus your IP and user-agent |
Our own Cloudflare Worker*.workers.dev | For chains where a direct call is blocked, and for sanctions checks | The address and chain id, plus your IP and user-agent |
Google Fontsfonts.googleapis.com, fonts.gstatic.com | On every page load, to load the typefaces | Your IP and user-agent. No scan data ever reaches it. |
| Cloudflare | On every page load — Cloudflare serves this site | Standard web-server request data |
Cloudflare Web Analyticsstatic.cloudflareinsights.com, cloudflareinsights.com | On every page load, to count the visit | Page URL, referrer, approximate country, browser and device type, page-load timing. No cookie. No scan content — see section 5. |
Each of these operates under its own privacy policy, which this site does not control.
5. Analytics
This site uses Cloudflare Web Analytics to count page views. It is privacy-preserving by design: it sets no cookies, uses no fingerprinting, and does not track you across other websites. It records page URL, referrer, approximate country, browser and device type, and page-load timing.
It never receives the content of a scan. Not the message, not the prompt, not the address, not the verdict, not any finding. Those never leave the part of the page that computes them.
6. Cookies and browser storage
This site sets no cookies and writes nothing to localStorage, sessionStorage or IndexedDB. There is no consent banner because there is nothing to consent to. If that changes — and section 7 explains when it might — this page will be updated before the change ships, and a consent mechanism will be added where one is required.
7. Advertising
There is no advertising on this site today. No ad network is connected and no ad script runs.
Advertising is being considered to cover running costs. If and when it is introduced, these commitments apply and are part of this policy:
- The content of your scans will never be used for ad targeting. Not the message, not the prompt, not the address, not the verdict, not any finding, not any extracted link.
- No advertiser can influence a verdict, and no payment can remove or downgrade a risk finding.
- Ads will be clearly labelled as advertising and kept visually separate from scan results and safety warnings.
- This page will be updated to name the ad provider, what it receives, and what cookies it sets, before any ad code is deployed.
- Where personalised advertising or non-essential cookies require consent, that consent will be requested before the relevant code loads.
8. What is stored, and for how long
This project stores nothing about you. There is no database of scans, no account system, no scan history, no email list. Server logs handled by Cloudflare as part of serving the site are subject to Cloudflare's own retention.
9. Your rights
Rights such as access, correction, erasure and objection apply to personal data that an operator holds. This project holds none, so in practice there is nothing to export or delete. If you believe that is wrong in your case, get in touch and it will be looked at properly.
Requests concerning data held by the third parties in section 4 have to be made to those companies, which this site cannot do on your behalf.
10. Children
This site is not directed at children and does not knowingly collect information from them. It collects no personal information from anyone.
11. Security
The site is served over HTTPS only, with a strict Content-Security-Policy, HTTP Strict Transport Security, and framing disabled. Never enter a seed phrase, private key, password or authentication code into this site — or into any AI system. Nothing legitimate ever needs them, and this site has no field that asks for them.
12. Changes to this policy
Material changes will be reflected here with a new date at the top. Changes that affect what leaves your browser will be described explicitly rather than folded into general wording.
13. Contact
Questions, corrections and privacy requests: the project's public issue tracker.
This page describes how the site behaves. It is not legal advice, and it is not a claim of compliance with any particular law. If you need that assurance for your own use of the site, seek your own advice.