Privacy & governance
This is the Learn & Govern layer of TRACE Shield: what the system commits to, and an honest account of what is built today versus what is designed for later.
Commitments
No sensitive credentials are ever collected
TRACE Shield never asks for, stores, or transmits your OTP, PIN, password, CVV, or account recovery codes. The check fields are for the suspicious message's content, not your own credentials.
The check runs entirely in your browser, with one clearly-labelled exception
Risk detection is a deterministic rule engine that runs entirely on the page you're using, including all link analysis (domain reputation, typosquat and homoglyph checks) and Call Shield's call-risk assessment. Nothing you paste into the check, message, link, sender, number, or call notes, is ever sent to a server or an external service of any kind, with one exception: the optional 'see where this link actually goes' button, which you must click yourself, makes a real, sandboxed connection to that one link to find its final destination after redirects. Only the link itself is sent for that specific check, never the surrounding message, sender, or your own device or location. The connection is restricted to public web addresses only, blocked from reaching any internal or private network, and returns only the final address and standard risk signals, never the page's actual content.
Explainable, not a black box
Every risk level is traceable to named signals (an OTP request, urgency language, a lookalike domain, an install request) and a small number of explicit override rules, not an opaque score.
No public accusation
TRACE Shield assesses messages and links, not people. It does not name, publish, or accuse any individual of fraud, and any future community-reporting feature will follow the same rule.
No nationality or IP-based attribution
A VPN, proxy, or shared connection can make an IP address point anywhere in the world, and a genuine person from any country may use one for entirely legitimate reasons. TRACE Shield never infers a scammer's identity, nationality, or guilt from an IP address, VPN use, or country, and does not show IP geolocation to users. Risk is assessed from corroborating behavioural, technical, and payment signals only, geography is at most one weak, contextual factor in a professional cross-border payment review, never a standalone basis for suspicion.
No caller-identity inference from a phone number
A phone number can be spoofed, recycled, registered to someone else, or routed through internet calling, so it proves nothing about who is actually calling. Call Shield never says 'we traced this caller' or 'this caller is a fraudster'. If you choose to enter a caller's number, it is kept local to that field for your own reference only (for example, to note before blocking or reporting) and is never read by the risk assessment. Call risk is assessed only from the claimed identity, the channel used, what was asked for, and what was said, weighed against known impersonation patterns.
Unsolicited contact is a risk factor, even from a real organisation
A message or call being from a genuine, verified company does not make an unprompted 'click here' or 'verify now' safe. Identity and consent are different questions: who they claim to be says nothing about whether this specific contact, one you never asked for, deserves your trust. That's why the check asks whether you contacted them first, not just what the message claims. Saying you never reached out raises the risk level on patterns like a 'ready for verification' claim or a single vague action button, and saying you did lowers it, independent of whether the sender's brand is real.
Human judgement stays central
The system explains risk and suggests next steps. It does not act on your behalf, make a payment, or contact anyone. Decisions, especially about money, stay with you or the trusted person you choose to involve.
Honest about limits
Rule-based detection will miss novel scam wording it hasn't been designed to catch, and can occasionally flag legitimate messages. It is a decision-support aid, not a guarantee, and is not a substitute for your bank, the police, or professional advice.
It reads text, it cannot verify what actually happened to you
TRACE Shield analyses the wording you paste, exactly like a spam filter analyses an email, it has no way to confirm you actually received that message or call, and it never claims to. A scam message scored Critical is Critical because of the patterns in the text, not because TRACE Shield investigated and confirmed a real event. It also means a message entirely reworded in the scammer's own words, with no recognisable trigger phrase at all, can score Low even if the underlying scheme is real, that needs genuine language understanding, which this engine deliberately doesn't have. And because results are instant, free, and unlimited, a bad actor could in principle paste draft scam wording here repeatedly to see what scores Low and refine it, the same limitation any public rule-based or AI classifier has. None of this is hidden: treat a Low result as 'no known pattern matched', not as 'confirmed safe'.
Designed, not yet built
- Persistent audit trail of checks, signals triggered, and outcomes (currently each check is stateless and cleared when you leave the page).
- A dispute or correction pathway if you believe a risk label was wrong.
- The Safety Circle as a real, consent-based feature that sends a case to a trusted contact (currently shown as guidance text only).
- Aggregated, anonymised scam-pattern intelligence shared across users (no data is collected or shared across sessions yet).
- Tracked false-positive/false-negative rates from real usage over time. The engine is currently validated against a hand-built regression suite of 75 example messages and calls, plus adversarial and malformed-input testing, not live usage data.
Questions about this policy or a risk label you believe is wrong: contact [email protected].