Privacy

There are two different things happening on this site, and they have very different privacy consequences. Reading it is anonymous. Sending us something is not.

If you only read

The guides are static pages. There is no account, no newsletter, no form, and nothing to fill in. We set no cookies, run no analytics, load no tracking scripts, and carry no advertising or affiliate code. The search box runs inside your browser against files served from this site; what you type in it is never sent anywhere.

The site is served by Cloudflare, which processes standard web request data (IP address, browser type, page requested) to deliver pages and block attacks. We do not tie that to anyone's identity.

If you send us something

We invite you to send a suspicious message, call or file so we can tell you what it is. That is a real transfer of personal data, so here is exactly what happens to it.

What we receive. Whatever you choose to send, plus whatever the channel reveals: your phone number if you use WhatsApp, your email address and display name if you email. Screenshots often carry more than people intend, account numbers, balances, names of other people in a chat.

Who can see it. Sai Samarth and Ashok Kamat, and the companies that carry the message. Email reaches us through Gmail, so Google stores it. WhatsApp is operated by Meta, which carries and backs it up. We cannot see inside their systems and we cannot delete it from them on your behalf. If that matters to you, use the channel you are most comfortable with, or send less.

What we use it for. Answering you. Nothing else. We do not build a database of victims, we do not sell or share anything, we do not pass it to police unless you ask us to, and we do not publish what you send. If something you send later informs a guide or an investigation, it is described in general terms, with identifying detail removed, and never with your name attached.

How long we keep it. We delete what you send within 30 days of finishing the conversation. You can ask us to delete it sooner and we will.

The scam checker

The checker on the check page splits what you paste into two parts, and treats them differently.

Your message is analysed in your browser. The wording, the sender, the phone numbers, anything you typed: none of it is uploaded, none of it is stored, and we never see it.

Web addresses are sent to a malware-scanning service automatically, up to three per check, so that more than 90 security vendors can be checked at once. This happens as soon as you press the button; the page tells you so above the box, before you paste anything. The address travels through our server, which holds the credentials, and neither the address nor the result is stored by us.

We only ever look a link up. We never submit one. That distinction matters: submitting a URL to a scanning service publishes it onward to that service's partner vendors, and scam links often carry a code identifying the specific person being targeted. A lookup discloses nothing. Even so, if a link contains something personal, leave it out of what you paste.

The contact form

The form on the contact page sends what you write to the same inbox as an email would, through a form-delivery service that passes it on and does not keep it. We hold it under the same rule as everything else: deleted within 30 days of the conversation ending, sooner if you ask.

It asks for three things and nothing more: what happened, a way to reply, and optionally your name. There is no account, no tracking pixel and no marketing use. If you would rather not use a form at all, WhatsApp and email reach exactly the same place.

Please do not send intimate images

This matters enough to say on its own. If someone is threatening to leak photos or video of you, do not send us the images. Describe what you received, send the threatening messages, the profile, and the account details, that is what identifies the scam pattern. The pictures tell us nothing we need and would put another copy of them in another inbox. Our sextortion guide covers what to do with them instead.

Your rights

If you have sent us something, you can ask us what we still hold, ask us to correct it, and ask us to delete it. Write to scamnextstep@gmail.com and say what you want done. The same address is where to raise a complaint about how we handled your data. India's Digital Personal Data Protection Act, 2023 gives you these rights and a route to escalate to the Data Protection Board if we do not resolve it.

Links to other sites

Guides link to government portals, news reports and official advisories so you can check what we say rather than take our word for it. Those sites have their own privacy practices, which we do not control.

Changes

If what we do with your data changes, this page changes first and the date at the top changes with it.