Privacy Policy

Last updated: September 30, 2026

This Privacy Policy describes how Phish Detector ("we", "our", or "us") collects, uses, and safeguards information when you use our Chrome Extension and associated backend API services.

1. Information We Collect

Account Information: When you sign in using Google OAuth, we receive your email address, display name, and unique Google account ID to authenticate your session and manage your usage tier. We do not receive or store your Google password.
Security Scanning Data: When browsing with the extension enabled, the extension analyzes the URL and page structure of visited sites to detect phishing indicators. Web addresses are checked against local cached threat indicators or transmitted securely via TLS to our backend service for real-time risk assessment.
We Do Not Collect Personal Form Data: We do not log or store private personal information, credit card numbers, passwords, or form inputs entered into web pages.

2. How We Use Information

To detect, evaluate, and warn you about phishing and fraudulent web domains.
To manage your account, authentication tokens, and rate limits.
To maintain, protect, and improve our security detection algorithms.

3. Data Sharing & Third Parties

We do not sell, rent, or trade your personal data or browsing history with advertisers or third parties. URL checks may be cross-referenced with public threat databases (such as PhishTank and URLhaus) solely to verify known malicious infrastructure.

4. Data Storage and Security

All network communications between the browser extension and our servers use HTTPS/TLS encryption. Passwords and authentication tokens are securely hashed and stored in encrypted databases.

5. User Rights and Data Deletion

You can remove the extension at any time to halt all website analysis. To request deletion of your account and associated session data, contact us at noreply@clockhash.com.