01At a glance
No selling, no ads
We never sell your data and we run no advertising or tracking pixels.
Reports stay private
Your scan reports are visible only to you and to platform administrators.
Sources are named
When a check asks an outside service, the report says which one.
02Who we are
MyScanner (“we”, “us”) is an online platform and Android app for inspecting links, websites, files, email addresses, domains, IP addresses and QR codes, operated by Ahmed Sairafi in Istanbul, Türkiye. We are responsible for the personal data described here.
Contact: info@myscanners.com.
03What we collect
| Data | Details |
|---|---|
| Account | Username, email address and a one-way (bcrypt) hash of your password. We never store your password itself. |
| Social sign-in | If you sign in with Google or GitHub, we receive your verified email address and display name. We do not receive your password or access to your other data. |
| Scan inputs and results | The links, domains, IP addresses, email addresses and files you submit, and the reports we produce, including page previews for URL scans. |
| Contact messages | Name, email, optional company and phone, subject and message text. |
| Pro waitlist | The email you give on the Pro page, used only to tell you once when Pro opens. We also count Pro page visits by where they came from (for example a LinkedIn link), with no IP address or identifier. |
| Technical data | IP address, request time and basic request details in server and security logs; sign-in activity. |
04How we use it
- To provide the service: run the inspections you request, save your reports and show your history.
- To run your account: sign-in, email verification, password resets and security notices.
- To keep the platform safe: rate limits, daily allowances, abuse prevention and investigating misuse.
- To answer you: reply to contact messages and security reports.
- To explain reports and answer security questions: when you press an AI button or write to the AI assistant, generate a plain-language explanation or an answer.
We rely on performing our contract with you, our legitimate interest in a secure service, and, where needed, your consent (for example, optional checks you switch on). We do not use your data for advertising or sell it to anyone.
05What happens to what you scan
- Links and websites are fetched by our servers from an isolated network, and a page preview is captured in an isolated browser.
- Files are inspected statically and never executed. The uploaded copy is deleted when the inspection finishes; only the report and file fingerprints (hashes) are kept.
- Passwords are analysed for strength and are not stored or included in reports. The breach check is on by default and you can switch it off; it sends only the first five characters of the password's SHA-1 hash from our server (k-anonymity), never the password.
- Email addresses are checked through DNS records. A direct mail-server check runs only if you tick it, and the receiving mail server then sees the address.
- QR codes are decoded in your browser, or on your phone by the app. The camera is used only while you scan, and the camera image never leaves your phone; only the decoded text is sent if you choose to inspect it.
Please do not scan content you are not allowed to share, such as private documents or links containing secrets.
06Services we rely on
Some checks send the specific item being inspected (for example a URL, domain, IP address or file hash) to an outside service. They do not receive your account details.
| Provider | Purpose |
|---|---|
| netcup GmbH (Germany) | Server hosting in the EU. |
| Cloudflare | Domain name service, routing of mail sent to our addresses, and storage of encrypted database backups (only we hold the key to decrypt them). |
| Resend | Delivery of account emails (verification, password reset, notices). |
| Google, GitHub | Optional sign-in. |
| abuse.ch (URLhaus, MalwareBazaar) | Reputation lookups for URLs and file hashes. |
| Phishing databases (e.g. PhishTank) | Phishing reputation of URLs. |
| Google (Web Risk) | Checks whether a scanned URL, a link found inside a scanned file (up to five per file), a page or link found while checking a website (up to thirteen per check), or the domain of a checked email address, is on Google's lists of phishing, malware and unwanted-software sites. Only the URL or domain is sent, never the file. |
| AbuseIPDB | IP address reputation. Network location comes from the DB-IP Lite database on our own server, so the address is not sent anywhere for it. |
| Have I Been Pwned (Pwned Passwords) | Password breach check (on by default, can be switched off) using a hash prefix only. |
| crt.sh, Google Public DNS, registries (RDAP/WHOIS) | Certificate history, DNS and registration data. |
| Google (Gemini API), Groq | Optional AI explanations, questions about a report and the site-wide AI assistant, only when you ask. They receive the report's findings (with secrets and images removed), your questions and the earlier messages of the same conversation, not your account details. On free service tiers, Google may use this content to improve its products, so do not include personal information in questions. |
| Sentry (Functional Software, Inc.) | Error reports when something on our servers breaks: the error type, message and code location. Request contents, cookies, account details and stored values are not sent, though an error message can name the address being checked. |
| Google Fonts, cdnjs | Fonts and icons loaded by your browser when you view our pages. |
Some of these providers are outside Türkiye and the EU. Where data is transferred, we rely on the safeguards those providers offer.
08How long we keep data
- Account and reports: while your account exists. Ask us to delete it at any time.
- Page previews: deleted automatically after 30 days.
- AI explanations and questions: kept with the report for up to 30 days (at most your 50 most recent), then deleted. Conversations with the site-wide AI assistant are not stored on our servers; your browser keeps them until you close the tab or start a new conversation.
- Uploaded files: inspected on our own server, including by the ClamAV antivirus engine that runs there (the file is not sent to an outside antivirus service), and deleted as soon as the inspection finishes.
- Server logs: kept for a limited period for security and rotated automatically.
- Backups: daily database backups are kept for 14 days on our server, and as encrypted copies with our storage provider for 30 days. Data you delete disappears from backups as they roll over.
- Contact messages: kept as long as needed to handle your request.
09Your rights
Depending on where you live (including under the GDPR and Türkiye's KVKK), you can ask us to:
- tell you what data we hold about you and give you a copy;
- correct inaccurate data;
- delete your account and data;
- restrict or object to certain processing;
- withdraw consent for optional checks at any time.
You can delete your account and its data yourself at any time from your profile (Delete account) or in the MyScanner app. For anything else, email info@myscanners.com from the address on your account. We answer within 30 days. You may also complain to your data protection authority.
For people in Türkiye, the Turkish version of this page is our KVKK information notice (Aydınlatma Metni) and sets out your rights under Article 11 of the KVKK.
10How we protect data
Passwords are hashed with bcrypt; connections use HTTPS; scanners run in an isolated network that cannot reach internal systems; reports and previews are served only to their owner; sign-in and password-reset requests are rate-limited; and we change-notify you by email when your password changes. No system is perfectly secure: if you find a vulnerability, please report it.
11Children
MyScanner is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.
12Changes
We will update this page when our practices change and change the effective date above. For significant changes we will notify signed-in users by email or on the platform.
13Contact
Questions or requests about your data: info@myscanners.com · contact form. See also our Terms of Service.