Skip to content
typoscan

Privacy

What we keep, and why

The scanner needs no account and doesn't save what you scan. If you sign in to watch domains, we keep your email address and the domains you watch, and use them only to run the checks and email you about them. No ads, and nothing is sold or shared for marketing.

Scanning without an account

The registration and email checks on a scan run in your browser, which asks Cloudflare's DNS-over-HTTPS service (and Google's, if Cloudflare doesn't answer) about each lookalike. Those services see the names looked up.

Whois, certificate, safety and risk checks go through our server, which asks domain registries, the lookalike sites themselves and Google Safe Browsing. Answers may be cached so repeat lookups are quick, but none of it is tied to you or written to our database.

When you sign in

Signing in is only needed for the watchlist. We store:

  • Your email address, and your name and profile picture link if you sign in with Google.
  • Your sessions: a sign-in token with the IP address and browser it came from, kept until you sign out or it expires.
  • Sign-in links, stored hashed and valid for 15 minutes.
  • The domains you watch, whether emails are on, and when we last emailed you.
  • Short-lived request counts by IP address, to stop sign-in abuse.

What a daily check finds (which lookalikes are registered, which handle email, how risky they look, and the domain's own DMARC policy) comes from public DNS and websites. It's kept per domain and shared by everyone watching it, so it isn't personal data and stays when you leave.

Emails

We email you sign-in links, a first report when you start watching a domain, alerts when a daily check finds something new, and a short summary in quiet weeks. Nothing else, and no newsletters. Every watchlist email has a one-click link to turn them off, and so does your account page.

Google sign-in

“Continue with Google” asks Google only for your name, email address and profile picture. We use them to sign you in and to know where to send your emails, never for anything else. Google also hands us sign-in tokens, which we store and don't use.

TypoScan's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who else handles it

  • Vercel hosts the site. Its logs record requests, IP addresses included, for a short time. Its Web Analytics and Speed Insights count page views and page speed without cookies; page addresses, scanned domains in /scan/ links among them, show up there.
  • Neon runs the database that holds the account and watchlist data above.
  • Resend sends our emails, so it sees your address and what we send.
  • Google, if you sign in with it, and for Safe Browsing checks.

Cookies

One cookie, and only on app.typoscan.in once you sign in: it keeps you signed in. The light or dark theme you pick is remembered in your browser's local storage. No advertising or tracking cookies.

Deleting your data

Delete your account on your account page removes your email address, name, sessions, Google link, watched domains and email settings straight away. It can't be undone.

Questions

Reply to any email we've sent you. If this page changes, the date below will too.

Last updated 26 October 2026.