Your privacy.

Who we are

SecureSmarter (securesmarter.com) is a free site of scam and security games and tools, based in Queensland, Australia. When this page says “we”, “us” or “our”, it means SecureSmarter.

This page explains what happens to your information when you use the site. Our terms of use cover everything else.

What we don’t collect

• No accounts. You never need to sign up, log in or give us your name to play or use the tools.
• No cookies from us. More on cookies below.
• No ad trackers. No Facebook or Google ad pixels.
• No IP addresses. Our code never saves your IP address (the number that identifies your internet connection). Two features keep a scrambled code made from it, to stop spam. That’s explained below.
• No passwords. The password checker never sends your password anywhere, not even to us.

And we never sell, rent or trade your information.

Your game progress stays with you

When you play, your browser remembers which rounds you’ve seen, your stars, the levels you’ve opened and your best streaks. It keeps this in its own storage on your device (called local storage). It never comes to us, and we can’t see it.

Your browser also remembers the country you pick on This week’s scams, and the report form uses it as its first guess.

Your browser uses your device’s time zone to pick rounds from your part of the world, and to make a first guess at your country on This week’s scams, the report form and the teams page. Your time zone isn’t sent to us.

To clear all of this, clear this site’s data in your browser’s settings. Private or incognito windows forget it when you close them.

The counts behind our live dashboard

Our live dashboard shows what’s happening on SecureSmarter as it happens. To make it, your browser sends our server a few small counts:

• A page opened: the page’s address (without anything after a ? or #), the time and your country.
• Still here: a ping once a minute while a page is on your screen, for up to an hour, so we can show how many people are on the site right now. It carries nothing else.
• A button tapped: the name of the button or link, like “Play” or “Check it”, and the page it’s on. Never anything you type, and never your answers in a game or the security checkup.
• A game answer: the game, the round, whether you got it right, the time and your country.

Cloudflare, which runs our server, works out your country from your IP address. We don’t save the IP address, and we add no cookies, names or IDs, so we can’t tell who did what.

What anyone can see. The dashboard shows totals, the most opened pages, the most tapped buttons (only names from our own site), the countries people visit from, the hardest rounds, and the latest page opens and game answers, with the country and how long ago. For example: “Someone in Canada won a round of HOAX”.

How long we keep them. We keep the daily totals. The minute by minute numbers are deleted after two days, and the list of the latest page opens and answers only keeps the newest 300 or so.

Cloudflare Web Analytics

We also use Cloudflare Web Analytics to see which pages people visit and how fast they load. We only see totals, like page views, top pages, countries, the sites that sent people here and the kinds of devices they use.

Cloudflare says it doesn’t use cookies or local storage for this, and doesn’t track people over time by their IP address or browser details.

When you report a scam

When you send a report from Report a scam, we get:

• the message you paste, or what you tell us happened
• a screenshot, if you add one
• how it reached you: text, call, email, website, social media or something else
• your country, which the form guesses from your time zone. You can change it.

To stop anyone flooding the form, we also keep a scrambled code made from your IP address, the date and a random key that changes every day (called a hash). We use it to limit reports to six an hour from one place, and we wipe it after a day. Each day’s key is deleted after two days, so an old code can never be traced back. We don’t keep the IP address itself.

Who sees it. Only us. We read reports to learn which scams are going around, and we may write about the scams we see. The site only ever shows counts, like how many scams were reported in a country this week. We never publish your report or your screenshot, and we never sell them.

Where, and for how long. Reports and screenshots are stored with Cloudflare. They’re deleted automatically after two years. Want yours gone sooner? Email us.

Before you send. Crop out your name, your number and anything private. A screenshot is better than a photo, because photos can carry hidden details, like where they were taken.

After you send a report, we point you to your country’s official scam service. That’s a separate site with its own privacy rules.

The free tools: what goes where

Most of our tools work right on your device. Here’s each one, and exactly what leaves your device, if anything.

• Is this a scam?What you paste goes to our server, which asks an AI model run by Cloudflare (Workers AI) and sends you its answer. We don’t store the text. Cloudflare says it doesn’t keep it once the answer is sent, and doesn’t use it to train AI. To stop overuse, we keep the time of each check for about a week, and the same daily scrambled code as the report form, wiped after a day. Leave out names, card numbers and passwords.
• Email checkerYour browser looks up the domain’s public email settings with a public DNS service: Cloudflare’s, or Google’s if Cloudflare’s doesn’t answer. They see the domain you check and your IP address. Nothing comes to us. If you type a whole email address, only the part after the @ is looked up.
• Password checkerYour password is checked on your device and never sent anywhere. For the leak check, your browser turns it into a scrambled code (a hash) and sends only the first 5 characters of that code to Have I Been Pwned. It sends back a list of leaked codes that start the same way, and your browser looks for a match. The strength checker (zxcvbn, made by Dropbox) is downloaded from cdnjs, a public code library hosted by Cloudflare.
• Password generatorPasswords are made on your device. Nothing is saved or sent.
• Link checker and fake link finderEverything happens on your device. Links are never opened, fetched or sent anywhere.
• QR code checkerYour picture is read on your device and never sent anywhere. If your browser doesn’t have its own QR reader, it downloads a free one (jsQR) from jsDelivr, a public code library.
• Family safe wordMade on your device. Never saved or sent.
• Security checkupYour answers stay on your screen. Nothing is saved or sent.

Prices in your money

On For teams, your browser asks our server which country you’re in, so it can show prices in your own money. Cloudflare works this out from your IP address. Our server sends back the country and saves nothing.

Our emails

We use Kit (kit.com) for our weekly email, and for the waitlists for team plans and our Chrome extension. If you join one:

• Your browser sends your email address, and nothing else, straight to Kit, which stores it and sends our emails.
• We only use it to send what you asked for: the weekly email, or a note when team plans or the extension are ready.
• Like most email services, Kit can tell us when an email is opened or a link in it is tapped. We use that to see which stories people like.
• Every email has an unsubscribe link. Or email us and we’ll take you off.
• We never sell your email address, or give it to anyone else to use.

Cookies

We don’t set any cookies. Your game progress uses your browser’s local storage instead, which stays on your device.

Cloudflare, which runs our site, may set a small security cookie if it needs to check that you’re a person and not a bot. Cloudflare says these cookies are strictly necessary and aren’t used to track you from site to site.

Other companies involved

These companies help run SecureSmarter. Each one handles data under its own privacy policy.

• CloudflareRuns our website, our server, our database, our media and the AI behind the scam checker. Like any web host, it handles your IP address to deliver pages and protect the site from attacks. It also runs Web Analytics, cdnjs and one of the DNS services the email checker uses. Privacy policy
• GoogleGoogle Fonts sends the fonts on every page, so Google gets your IP address and basic browser details. Google says no cookies are used for this. Google’s public DNS is the email checker’s backup. Privacy policy
• Have I Been PwnedGets the first 5 characters of a scrambled code when you use the password checker, and your IP address, like any website. Privacy policy
• jsDelivrSends the QR reader to browsers that need it, and gets your IP address to do that. Privacy policy
• KitStores your email address if you join our email list or a waitlist. Privacy policy

The photos on our true stories pages and in BOT come from Wikimedia Commons, but we serve our own copies, so Wikimedia only sees your visit if you tap a photo credit.

Links and sharing

We link to official sources, news stories and other sites. When you tap through, their privacy rules apply, not ours.

Share buttons use your device’s own share menu, or copy the text for you to paste. Challenge links carry the round numbers and your score, nothing else. We don’t see what you share or who you send it to.

Children

Anyone can play the games and use the tools without giving us any personal details. If you’re under 16, please ask a parent or carer before you join our email list or send us a report. If you think a child has sent us personal details, email us and we’ll delete them.

If you’re outside Australia

We’re based in Australia, but the companies we use handle data around the world, including in the United States. Cloudflare, for example, runs data centres in many countries. By using SecureSmarter, you understand your information may be handled outside your own country.

See it, fix it or delete it

Email hello@securesmarter.com to:

• ask what we hold about you
• fix something that’s wrong
• delete your report or your email address
• ask anything about this page

We don’t have accounts and we don’t save IP addresses, so to find your report we may need a few details, like roughly when you sent it and what it said. The counts behind the dashboard aren’t linked to anyone, so there’s nothing there we could find or delete.

We’ll reply within 30 days. Depending on where you live, you may have more rights under your local privacy laws. If you’re not happy with our answer, you can contact the privacy regulator where you live.

Keeping it safe

Everything travels over a secure, encrypted connection (HTTPS). Reports and screenshots are stored in our Cloudflare account and never shown on the site. No system is perfectly safe, so please never send us passwords, card numbers or anything you’d hate to see leaked.

Changes to this page

We’ll update this page when the site changes, like when we add a new tool or team plans go on sale. The date at the top shows the latest version. If we make a big change, we’ll say so on the site.