Privacy Policy

How this preview handles your information.

Last updated: September 23, 2026

On-device and optional AI checks

On-device checks analyze email text and URL patterns in your browser. Screenshot text recognition runs on your device; the image itself is not uploaded. Review the extracted text before choosing an AI check.

When available, selecting the AI consent checkbox and Run AI check sends the submitted text or website URL, plus any reference domain, to our server and OpenAI for an AI risk assessment. Do not include passwords, verification codes, payment details, private links, or information you do not have permission to share. AI checks require internet access and may be limited or unavailable.

Website inspection

For AI website checks, our server visits the supplied public page and may follow up to three redirects. The destination receives the requested URL, our server IP address and checker user agent. Retrieved page text, title, links, form destinations and logo descriptions may be sent to OpenAI. We do not log in, submit forms, execute website scripts, or render a screenshot of the page. This is not a malware scan or proof of ownership.

Analysis data and retention

The analysis application does not save submitted content, retrieved pages or AI results in a database or content log. They are processed in memory for the request and displayed in your active browser page. OpenAI requests use store=false; this does not eliminate any provider abuse-monitoring retention. OpenAI processes API data according to its API data controls. Ordinary hosting security and access logs may retain connection metadata separately.

We store short-lived hashed IP identifiers and request counters to limit abuse and API usage. These counters expire within two days and are removed during subsequent checks. A secure session cookie protects analysis requests from cross-site submission. Copying a result places it on your clipboard. Clear this check removes the active input and result.

Accounts, inbox addresses and billing

If you use the account portal, we store your sign-in email, verified inbox addresses, account identifiers and billing references on our server. Inbox address verification does not authorize access to mailbox messages. One-time sign-in links expire after 15 minutes. We queue account and billing notifications in our support email system. Delivery status records are retained for up to 30 days after acceptance; pending or failed messages remain until resolved. Contact support to request account-data deletion, subject to any records we need to retain for billing.

When billing is enabled, Stripe handles checkout and payment information. Our application uses Stripe customer, subscription and invoice identifiers to show your billing history and send service notifications. Card details are entered on Stripe, not stored by this application. The current portal is in test setup and live subscriptions remain disabled.

Preferences and offline storage

Local storage remembers your privacy choice and accessibility settings. A service worker caches site files for offline use, and screenshot-recognition resources may also be cached. These caches are for application resources, not an email archive. See our Cookie Policy for details and deletion instructions.

Hosting and external resources

Loading this site sends normal connection information, such as your IP address, browser information, and requested URLs, to the hosting provider. The private preview may require hosting-provider authentication, which is separate from this checker.

Google Fonts provides typefaces. Screenshot recognition downloads software from jsDelivr and language data from Project Naptha. These providers receive connection information when your browser requests their resources. The checker does not include your email text or screenshot in those requests. Their processing is governed by their own policies.

Analytics, advertising, and sales

No advertising or analytics trackers are installed in the checker. We do not sell submitted email content or use it for advertising. Optional AI processing is described above; submitted content is not used for advertising.

Connected mailbox monitoring

Mailbox connection controls are being prepared; they stay disabled until the provider setup is complete. When available, you must verify an address, explicitly consent to ongoing analysis, and authorize Google or Microsoft. Address verification alone does not grant message access.

For an authorized, eligible connection we periodically retrieve new incoming message identifiers and message content for phishing analysis through OpenAI. Gmail monitoring covers new incoming messages; Microsoft monitoring covers the Inbox folder. Historical mail is not scanned on first connection. We do not request permission to send, move or delete messages, and do not download attachment contents.

Access and refresh tokens are encrypted at rest. We retain encrypted message subjects and assessments for up to 30 days, plus message identifiers and processing status for up to 90 days to prevent duplicate scans. Expired records are cleared by the scheduled worker. Message bodies are processed in memory and are not retained by the monitoring database. Assessments may contain short excerpts from messages. OpenAI processing follows the API data controls described above. We do not use connected mailbox data to train or improve general-purpose AI models, sell it, or use it for advertising. Google API data use and transfers must adhere to the Google API Services User Data Policy, including Limited Use requirements.

Risk alert emails go to your account email and direct you to the authenticated dashboard without copying the suspicious message body. You can disable risk alert emails; connection and service notices remain enabled. Disconnecting deletes stored tokens, assessments and message jobs, and requests Google token revocation. Microsoft grants and any unsuccessful Google revocation should also be removed in your provider’s connected-app settings. An already in-flight analysis request or email delivery may finish. Disconnecting does not cancel your subscription or delete mail from the provider.

Monitoring requires eligible paid capacity and current billing confirmation. Provider outages, analysis limits, expired authorization and history gaps may delay or prevent checks. Live subscriptions remain disabled until end-to-end service testing is complete.

Your choices

Use “Clear this check” on the checker to clear the active email and result. Use Cookie preferences or Accessibility to manage saved choices. Delete this site’s data in your browser settings to remove preferences and offline files; you may need to load the site again before offline features work.

Changes to this notice

This notice describes the current preview. Material changes in how the service handles information will be reflected here, with an updated date.

Contact us

For privacy questions or requests, email support@isthismailreal.com. Messages you send to this address are received and stored in our support mailbox, separately from the on-device checker. Include only the information needed for your request; do not send passwords, verification codes, or payment details.