Privacy policy

What SafeOrNah keeps, why and for how long. Your file stays on your device, only its fingerprint goes to the analysis services.

In short

SafeOrNah checks links and files to tell you whether they are safe.

Your file stays on your device, unless you choose to send it to VirusTotal. Only its fingerprint goes to the analysis services. We keep the minimum needed to run the service, meaning your account (through Google, Apple, Microsoft or GitHub), your analyses, your reviews and your preferences.

No ads, no data sold, no tracker from another site. We count our visits ourselves, without cookies or identifiers, and you can turn this counting off.

Data we collect

If you have an account, signed in with Google, Apple, Microsoft or GitHub:

your name, your email address (when the provider confirms it, or the relay address if you hide it with Apple), your profile picture, the ID and the username of your Google, Apple, Microsoft or GitHub account;
the photo you upload, or the one of your Microsoft account, redrawn in a small size without its metadata (place, device);
the creation date of your GitHub account, to decide when your votes count in the score;
the ID of an account you unlinked, so that it cannot reconnect to your account by itself;
your language, your theme and your preferences (email at the end of an analysis, AI review, name shown on your reviews, anonymous statistics);
your history, meaning the links and fingerprints you analyzed, with the name, size and type of your files and what your browser found in them;
the date and type of each of your analyses and AI review requests, for your daily limits and the My usage page;
your reviews (Safe or Nah, and your comment), your "Helpful" votes, your reports, your ideas, your votes and comments in the suggestions, your answers to "Was this article helpful?" and "Was this review helpful?";
your team license and your bonus credits, if you have any;
the device keys you create for the iPhone Shortcut or that the browser extensions receive when you connect them, with their name, the app or browser they serve, the installation code of an extension, their creation date and their last use, the key itself being kept only as a fingerprint;
the limits the team may have set for your account and, if it is suspended, the date and reason of the suspension and who decided it.

Administrators can see your analyses, your history, your reviews, your ideas, your comments, your reports, your AI review requests and your conversations with the team on your account page, but never the name of your files or what your browser found in them. They also see your email address, your linked accounts, your license, your credits, your limits and the details of a suspension.

Moderators see your name, your profile picture, your role, your sign-up date, whether your account is suspended, the number of your reviews and the number of reports received. Of your activity, they only see your reviews, your ideas, your comments and your reports. They do not see your email address, your license, your credits, your limits, the number of your analyses and votes, or the reason of a suspension.

If you use a team license, its manager sees your name (your first name and the initial of your last name), your email address, your profile picture, your daily analysis limit, your activation date, the number of your analyses over 30 days and the date of the last one, counting only since the activation. They never see what you analyzed.

We never receive your password. The token Google, Apple, Microsoft or GitHub gives us when you sign in is only used to read your profile and, for Microsoft, to copy your photo. It is not stored. From a work or school Microsoft account, we do not take the email address, because its organization can set it freely.

For everyone, with or without an account:

your session, stored with your IP address and the name of your browser;
request counters, tied to your account or your IP address, to block abuse;
anonymous visit statistics, detailed in the "Cookies and audience measurement" part;
without an account, the name, size and type of the file you analyze and what your browser found in it, kept in your session;
without an account, a code computed from your IP address with a secret key (HMAC-SHA256), kept with each of your analyses to count your limit, and with your answers to "Was this article helpful?". The address itself is not kept. On an article, the code also depends on the article, so two answers cannot be linked to each other or to your analyses. With IPv6, the code only uses the first 64 bits of the address.

If you write to us with the contact form, we collect your name, your email address, the subject, your message, the link of an analysis if you give one, and your account if you are signed in with that same address. Your replies and those of the team stay in the same conversation, with their date.

If the team writes to you first, it can do so at any address. We then keep this address, the name the team gave, the title and the messages, for as long as any other conversation. The conversation is linked to your account if this address is the verified address of an account.

If you write to us by email, at contact@safeornah.app or by replying to one of our emails, we also keep your address, the name shown by your mailbox, the subject, the text and the result of the SPF, DKIM and DMARC checks. We never keep or open your attachments, only their number is noted. A first email is kept whole, with anything you forwarded or pasted into it. When you reply to one of our emails, we remove what is quoted, and the message shows when another part of the text was not kept.

If you subscribe to incidents or to the blog, from the Status page, the blog or your settings, we collect your email address, your language, your choices (alert level, kinds of articles) and the date you agreed for the blog. If an address fails for good or marks our emails as spam, we note that date. We then stop sending it the incidents and the articles, and the end-of-analysis email if it belongs to an account. Our sending service also keeps its own list of blocked addresses, and it can refuse our other emails to it, such as a reply from the team.

Analyzed files

Your file never leaves your device. Your browser computes its SHA-256 fingerprint, then runs a few checks on the spot, for example macros in a document, JavaScript in a PDF, an encrypted archive or the signature of a program.

It only sends us the fingerprint, the size, the detected type, the type reported by your browser, the result of these checks and the name of the file. Only the fingerprint goes to the analysis services.

All of this, except the fingerprint, stays private. It is kept in your history if you are signed in, otherwise in your session, and replaced if you submit the file again. It is never sent to the services nor to the AI, it does not show on the public page and it does not change the score. The size and type everyone sees only come from the services. The "disguised file" alerts are computed in your browser.

There is one exception, at your request. If VirusTotal does not know a file, a signed-in account can choose to send it (32 MB at most). The file goes through our server without being kept, named after its fingerprint. It then becomes visible to the paying customers of VirusTotal, so never send a personal document.

Analyzed links

For a link, we keep its cleaned address, without username or password, without the part after "#" and without the ad tracking parameters (utm_*, fbclid, gclid…). The other parameters stay.

On a shared platform (GitHub, Google Drive, Dropbox…), the page stands for the content and not for the exact address. The full address you submitted is kept for two days at most after the analysis, so that a service that did not answer can be asked again, and is then erased. It never shows on the page, and no one else can see it.

We look up the IP addresses of the domain, to check that it leads to a public server, then the address of the link goes to the compatible services. Our application does not open the page itself. It is opened by VirusTotal (if it does not know it yet and the analysis comes from an account), by URLScan.io, by ScanMalware and by the AI tool, which fetches it from our server. The analyzed site can see these visits.

An address can hold personal data, such as a password reset link, a private sharing link or an access token. It is sent as is to the services and shown on the analysis page, which anyone who has its address can open. Do not analyze a private link.

Browser extension

The SafeOrNah extension for Chrome and Firefox has its own privacy policy. The sites you visit never leave your browser. Only an analysis you start sends a link, with the device key of the extension, and then follows this policy.

Third-party services

Each analysis asks independent security services, which apply their own privacy policy. What we send them is about the link or the file, never about your account.

VirusTotal (Google) receives the fingerprint of a file, and the address and domain of a link. An address it does not know is submitted to it when the analysis comes from an account, except on a shared platform (GitHub, Google Drive…). The one of a visitor without an account is never submitted. Once submitted, it joins its database, visible to its paying customers. Its policy
Google Safe Browsing receives the address of a link, checked again when the analysis page is opened or when a device sends that link again, at most once every half hour, or as soon as one of its warnings expires. Its policy
URLhaus, MalwareBazaar and ThreatFox (abuse.ch) receive the fingerprint of a file, and the address, domain and host name of a link. Their policy
AlienVault OTX (LevelBlue) receives the fingerprint of a file, and the address and domain of a link. Its policy
CIRCL hashlookup receives the fingerprint of a file. It counts the fingerprints it is asked about and publishes the most frequent ones. Its policy
MalShare receives the fingerprint of a file. Its terms
URLScan.io receives the address of a link. It opens the page in its browser, as a private scan, and sends us back a screenshot, kept in our storage and shown on the analysis page. Its policy
ScanMalware receives the address of a link, only when this service is turned on, and its card then shows in the results. It opens the page as an unlisted scan, visible to anyone who has the link of the scan, and sends the address and the text of the page to an AI service located in China. Its policy
AbuseIPDB and IPWhois.net receive the IP address of the server of the analyzed site, never yours. AbuseIPDB policy, IPWhois.net policy
PhishTank (Cisco Talos) receives nothing, because we download its list four times a day and the comparison happens on our side.
The public blocklists of uBlock Origin and HaGeZi receive nothing either: we download them every four hours from their official sources, and the comparison happens on our side.
Domain name registries (RDAP) receive the domain name of a site, to give its creation date.

Several of these services are located outside Switzerland and the European Union, especially in the United States.

The site, its database and its files are hosted by Laravel Cloud (Frankfurt, EU).

To spot outages and slowness, we use Laravel Nightwatch, by Laravel Holdings (United States). For a share of the pages and tasks, and for each error, it receives the pattern of the address without the identifier of the analysis page or the parameters, the durations and the response code, the queries sent to the database without their values, the names of the tasks and the type of the emails, the cleaned message of the error with an extract of our code and, if you are signed in, the internal number of your account. It does not receive your IP address, your name, your email address, the names of your files, the links you analyze or the content of your messages. This data is hosted in the European Union and kept for 90 days at most. Its policy

AI review

The AI review is written by Mistral Large, from Mistral AI (France). Our server calls its API directly.

The AI receives the analyzed address or fingerprint, the domain and its IP addresses, the creation date of the domain, the size and type of the file when a service gives them, the public names the services give it and the results of the services. It never receives the name of your file, nor what your browser found in it, nor anything about your account.

To investigate a link, our server opens the analyzed page and reads the registration record of the domain from its registry. It also looks at public GitHub repositories when the link leads there, and the AI can ask it to do so for a file. The title, the text and the forms of the page, along with the results of these lookups, then go to Mistral.

To look for reports online, our server sends the search API of Brave Software (United States) the domain of the link, or the fingerprint of a file the services already know. It never receives the full link, the name of your file or anything about your account. The results go to Mistral for the investigation, and the published review keeps no link to them. According to its privacy policy, Brave keeps queries for at most 90 days. Brave's privacy policy

Our server does not keep these exchanges, only the review published on the analysis page. According to its privacy policy, Mistral AI keeps each request and its answer for 30 days to monitor abuse.

The same AI translates each review once, right after it is written, into the other languages of the site. When needed, it also translates the texts written by the team, meaning the incidents, the banner, the maintenance message, the blog articles, the partner descriptions and the team notes on analysis pages. It does the same for the title and description of the ideas published in the suggestions, without the name of their author. Comments and community reviews are not sent to it for translation. Mistral AI privacy policy

What is public

An analysis page is public. Anyone who has its address can open it, and someone who analyzes the same link or the same file lands on the same page. It shows the link or the fingerprint, the results of the services, the screenshot of the page, the AI review and the community reviews. It never says who ran the analysis, nor the name of the file, nor what their browser found in it. Only the admins can see which account ran an analysis or asked for an AI review, not the moderators.

Your reviews, your ideas and your comments are public, with your first name and the initial of your last name, and your profile picture on reviews and comments. If you turn off "Show my name on my reviews" in your settings, they show without your name or picture. "Helpful" votes and votes on ideas are only shown as numbers.

Profile pictures from Google and GitHub are loaded from their servers, which then see the IP address of the person viewing the page. A photo you upload, or the one from Microsoft, is kept in our storage. Without a photo, your account gets a picture of our mascot, which also replaces the pattern GitHub gives to accounts without a photo. The team can remove an inappropriate photo.

Emails

SafeOrNah only writes to you in these cases:

the end of an analysis that lasted at least 60 seconds, if you are signed in and turned this option on in your settings (it is off for new accounts);
the incidents of the Status page, if you subscribe, at the level you choose. Without an account, you first get a confirmation email. Then every email has a link to choose what you receive and a link to unsubscribe;
the new articles of the blog, if you follow it, with the same confirmation and the same links;
the removal of your team license by its manager;
a notice when a new way to sign in is added to your account;
an acknowledgement when you use the contact form, without the content of your message and at most one per address and per day;
the messages of the team in a conversation, including when it writes first, and a new link to it if you ask for one.

A message sent with the contact form reaches the site, where all the correspondence stays. Administrator accounts only get an alert, without the content. Our emails hold a private link to the conversation, valid for 90 days, and anyone with this link can read it and reply to it. If you are signed in, your conversations are also in "My messages". We note whether our emails are sent, delivered, rejected or marked as spam.

You can also reply to these emails. The emails we receive go through Resend, which keeps a copy for 30 days, then their text is stored here. The reply address belongs to the conversation, and we note when a message comes from another address than yours. Resend keeps its own list of blocked addresses after a permanent rejection or a spam report. Its policy

Emails are sent through Resend.

Notifications on your devices are for accounts only, and you turn them on one device at a time. We then keep the subscription address given by your browser, its encryption keys, a device name (for example "Chrome · Android") and your choices. The message goes through the notification service of your browser (Google, Apple, Mozilla or Microsoft), encrypted, without the name of your files. The subscription goes away when you sign out of that device, remove it, or delete your account.

Your browser can also notify you at the end of an analysis, if you allow it. The notification is created by the page itself, without any third-party service.

Cookies and audience measurement

SafeOrNah only uses the cookies it needs, for the session, form protection, sign-in, the theme and the language. The details are on the Cookies page.

We count our visits ourselves, without any third-party service and without a statistics cookie. These are counters per day, read only by the admins, with one line per figure, for example "120 views from a phone". A line does not say who you are, and the lines cannot be cross-checked to find a person or their path.

For each page view, we add 1 to these counters:

the page by group (home, blog, suggestions…), the nature of an analysis page (file or link) and, for a published article, its public address, never the identifier of an analysis page;
the page with the type of device, the only combination kept for views;
on the first page of a visit, the domain name of the site you come from, without the rest of its address, and the utm_source, utm_medium and utm_campaign parameters of the link;
the country given by Cloudflare, which our host goes through, when it gives one. We never look up your country from your IP address;
the main language of your browser and the language of the site;
the family of your browser and of your system (Chrome, Windows…), without the full text or the version;
the type of device and the width of the screen, by ranges;
the theme really shown, whether motion is reduced, and whether WebGL relief is available;
the type of connection and the memory of the device, by ranges, if your browser gives them;
the state of the visitor (no account, signed in or with a team license), never the account;
the hour, in Zurich time.

For each visit, meaning each load of a tab followed in memory by the page, without writing anything on your device, we count when the tab goes to the background or closes:

the first and the last page;
whether the visit stopped at a single page;
the number of pages and the length of the visit, by ranges, in visible time only;
the time spent and the scrolling on each page, by ranges;
on the home page, the sections reached and those scrolled to the end;
the speed of the page (LCP, INP, CLS and TTFB), rated good, to improve or poor, by page and by type of device.

We also note whether the visit is new or returning, through a single date kept in your browser (safeornah:seen, the date of your first visit, with no identifier). It is described on the Cookies page, it expires after 13 months, and it is erased when you turn the statistics off.

Some gestures are counted the same way, with no link to you: link pasted, file dropped, sign-in window opened, sharing, click on a button of the home page, change of language or theme, page not found and server error.

To estimate the number of visitors per day, the server computes a code from your IP address, the name of your browser and a random salt of the day (HMAC-SHA256). This code only goes into an approximate counter (HyperLogLog), kept in memory, from which it cannot be taken back out. The salt is erased at the end of the day. The counter is erased shortly after midnight, once its total is copied to the database, and at the latest two hours after the end of the day. Only this total of the day remains.

So that one script cannot fill the list of sites and campaigns, the server also counts how many new names an address adds in a day, under a code computed from that address and the salt of the day (HMAC-SHA256). This count stays in memory and is erased at the end of the day.

We never keep your IP address in these statistics, the full text of the name of your browser, the full address of the pages, a visitor identifier, a device fingerprint, your path nor a link with your account.

Your choice. None of this is counted from your browser if you turn off "Anonymous statistics" on the Cookies page or in your settings. For an account, the choice in the settings wins and is copied to your browser. The "Do Not Track" and "Global Privacy Control" signals do not turn it off.

What stays counted. Some actions are counted by our server when they happen, whatever your choice, because they do not come from following your browser: account creation, sign-in, sending a link or a file to analyze, limit reached, rescan, upload to VirusTotal, AI review request, review posted, "Helpful" vote, idea proposed, vote on an idea, contact message, answer on an article, incident subscription and blog subscription. Only a total per day goes up, with nothing about you.

How long we keep data

Your account and what is tied to it (photo, history, reviews, votes, ideas, comments, license, credits, device keys) stay until you delete it. Your ideas go with the votes and comments they received.
A device key is deleted sooner after 180 days without use, or when you sign out in the extension that holds it. The connection code an extension exchanges for its key expires after 5 minutes.
After your account is deleted, the date and type of your analyses and AI review requests stay, detached from you, with no time limit for now. Your reports also stay, with no link to you, with the reason and the details you wrote. Your conversations with the team are no longer linked to an account, but they keep your name, your email address and all the messages until the end of their retention period, unless you ask us to delete them sooner. So that an account cannot be created again at once to reset the daily limits, we also keep for 24 hours, in the cache, a fingerprint of your Google, Apple, Microsoft or GitHub identity (HMAC-SHA256). Your sessions on your other devices end at once, and the reason of a suspension leaves the admin log.
Reports stay as long as the reported review does, with no separate period, and they go with it.
Analysis pages have no time limit for now, because they do not say who ran the analysis and they avoid asking the services again for a link or a file already known. A new screenshot replaces the old one.
The code derived from a visitor's IP address is erased from their analyses after 24 hours. The one on an answer to "Was this article helpful?" stays with the answer, so that a visitor answers only once per article.
The session, with what a visitor submitted about their file, expires after 2 hours without activity, then it is erased.
Abuse counters disappear after one hour at most.
Conversations with the team are erased 730 days after their last message. A closed conversation stays until then, and the team can delete one for good, for example at your request. To send only one acknowledgement a day to the same address, and to limit the emails received from one sender, we also keep a code computed from this address with a secret key (HMAC-SHA256) for 24 hours at most.
Unconfirmed subscriptions to incidents and to the blog are erased after 7 days. A confirmed subscription stays until you turn everything off, your address is then erased. It also goes away with your account. To send only one confirmation email a day, per address and per topic (incidents or blog), we also keep a code computed from that address with a secret key (HMAC-SHA256) for 24 hours at most.
Status page measurements (response times of the services, without personal data) are kept for 31 days.
Visit statistics (totals per day, without personal data) are kept for 25 months, then erased. The visitor code is never written down, and the salt of the day lasts no longer than a day.
The admin log, which records the actions of the team (hiding a review, suspending an account…), has no time limit for now. It keeps the name of the team member who acted, even after their account is deleted, so that each action can still be traced back to someone.
Failed background tasks, which can contain your e-mail address when a message could not be sent, are erased after 30 days.

The technical logs of the application, which mostly record the errors of the services, and the access logs of our host, which can hold your IP address and the address of the pages visited, are erased after 30 days at most.

Who is responsible

The data controller is Ethan Geuggis.

Your rights

At any time, from your settings, you can:

download your data in JSON format (profile, preferences, limits, suspension with its date, its reason and the internal number of the person who decided it, linked and unlinked accounts, history, reviews, "Helpful" votes, reports, answers to "Was this review helpful?", analyses, AI review requests, licenses, credits, ideas, comments, votes on ideas, blog answers, conversations with the team, subscription to incidents and to the blog, device keys with the app or browser they serve, devices that get notifications and your choices for these notifications);
correct your name and choose whether it shows on your reviews;
change or remove your profile photo;
unlink a Google, Apple, Microsoft or GitHub account, if you have another one left;
delete your account, which is immediate and final.

You can also remove an analysis from your history from your dashboard.

For any other request (access, correction, deletion, objection), write to us at contact@safeornah.app or with the contact form, subject "My personal data". Your sessions, with their IP address and the name of the browser, are not in the downloaded file. You can get them the same way.

We process this data to run the service you use and protect it against abuse, and, with your consent, to answer a message, send a file to VirusTotal, send you the incidents and the articles of the blog, or notify you by email or notification. The anonymous statistics help us understand how the site is used and improve it, and you can turn them off at any time. SafeOrNah applies the Swiss Federal Act on Data Protection (FADP) and, for people located in the European Union, the GDPR. You can also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the European Union, the data protection authority of your country.