Is it a scam? exists to protect people, so we hold ourselves to the same standard we check others against. This page says what we collect, what we do with it, and what we never do — in plain English.
Is it a scam? is operated by Treacy Enterprises, Sunshine Coast, Queensland, Australia. When this page says “we”, that's who it means.
We only see what's forwarded to us. When someone forwards a text or email to their Is it a scam? number or address, we analyse that message to give a verdict. We never have access to anything else on anyone's phone — not their other messages, contacts, photos, or location. Nothing is installed, so there's nothing else we could see.
After a check, we keep the verdict, the reasons for it, and a scrambled fingerprint (hash) of the message — not a readable copy. A copy of the message itself is kept encrypted and deleted within 30 days, automatically; we keep it that long only so we can review mistakes when someone tells us a verdict was wrong, and every time anyone at Is it a scam? reads one, that access is logged. Messages checked on our free web checker are never stored at all — though we briefly record the network address (IP) they came from, purely to stop one person overloading the free service. We protect what we hold with encryption in transit and at rest, access controls, and an audit log of any staff access to message content. We keep the details you give us at sign-up: names, mobile numbers, and email addresses of your family members, and your billing details are held by Stripe, our payment provider — we never see card numbers.
Family members never see the content of anyone's messages. Alerts and the family view show only that a message was checked, when, and what we advised — for example, "Dad forwarded a scam this morning; we flagged it." What was actually in the message stays between the person who forwarded it and us.
A forwarded message often includes someone else's details — the sender's number, a name, an email address. We use those details only to check whether the message is a scam and to protect other families from the same scam (for example, adding a scam sender to a blocklist). We handle all personal information in line with the Australian Privacy Principles.
We never sell personal information. We never use your family's messages to advertise to you. We never share message content with family members, and we never claim to know things we can't observe — we can tell you we sent a warning; we can't tell you what someone did after reading it.
Some scams are aimed at the heart — romance scams, and blackmail emails built on shame. When we catch one of those, the full warning goes to the person, and to nobody else: no family alert, nothing on the family dashboard, no mention in weekly counts. It stays between us and them unless they reply TELL and choose to share it. We built it this way because shame is exactly what stops these scams being checked at all — and a check nobody dares make protects no one. We never tell a family against the person's wishes.
Only the services that make Is it a scam? work: our SMS carrier (to send and receive texts), our email provider (to send and receive email), our payment provider Stripe, our AI provider Anthropic, and our hosting provider Cloudflare. Each receives only what it needs to do its job, and none may use your information for their own purposes.
Four parts of our service send message content to Anthropic's AI, which processes it on servers outside Australia, including in the United States: reading a photo or screenshot when someone sends one; reading a photographed contract, quote or signup confirmation to pull out what it commits you to; giving a second opinion on a verdict; and putting the verdict into friendly words. The AI's second opinion is one-way by design: it can only ever make us more cautious. It can raise a warning our own rules missed, but it can never produce an all-clear — a “looks fine” can only come from our own code, checking details against sources the AI has no say over, and nothing in a message can talk the AI into one. By using Is it a scam? you consent to this overseas disclosure. We take reasonable steps to ensure your information is handled appropriately overseas, but overseas providers may be subject to foreign laws, and the protections in Australian Privacy Principle 8.1 may not apply in the same way. If you report a scam, we log the scam's details — never yours — and file confirmed scams with Scamwatch, the reporting service of the ACCC's National Anti-Scam Centre, as part of our weekly review.
You can ask for a copy of the personal information we hold about you, and ask us to correct it if it's wrong. Email privacy@getforwardit.com and we'll respond within 30 days, free. If we can't give you access — for example because it would reveal another person's information — we'll explain why.
If information we hold is lost or accessed without authorisation and it's likely to cause serious harm, we'll notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. If you think we've mishandled your information, tell us at privacy@getforwardit.com and we'll respond within 30 days. If our answer doesn't satisfy you, you can complain to the OAIC at oaic.gov.au or 1300 363 992.
Each month we publish aggregate numbers: how many messages were checked, what the verdicts were, which scam patterns we saw most, and how many campaigns we detected. Counts under ten are shown as "fewer than ten". Private categories are excluded. The free checker still stores nothing about your message; we keep only a daily count of how many free checks ran and their verdicts.
If you subscribe to our weekly email, we keep your email address to send it and for nothing else; you confirm by clicking once, every issue has a one-click unsubscribe, and unsubscribing stops it. If you join through an organisation's sign-up link, we hold your name and mobile as pending until you reply YES to our one text; if you reply NO we keep only a note never to message you again. The organisation sees how many people joined — never what anyone sends us.
Is it a scam? is for adults. We don't knowingly collect information about children, and everyone added to a family account must be an adult. If you believe we hold a child's information, contact us and we'll delete it.
Our website uses Google Analytics to see which pages people find useful. It sets cookies and records anonymised usage data. We don't use advertising trackers, and we never connect website analytics to the messages your family forwards. Blocking these cookies in your browser won't affect the service.
Reply STOP to any of our texts to stop receiving them, and every weekly email carries a one-click unsubscribe link that works without signing in. Ask us to delete your family's data at any time and we will, within 30 days. To ask anything about your data, email privacy@getforwardit.com.
Effective August 2026. If our practices change, this page changes first, and we'll tell account holders by email.