Privacy notice

Last updated: November 2026. This notice explains what ScamSteps keeps about you, why, for how long, and what you can ask us to do.

Who we are

ScamSteps (scamsteps.com) is run by Armidale Pte. Ltd. (UEN 202513778M), a company in Singapore. We are responsible for the information described here.

You can write to us at [email protected] about anything in this notice.

Our data protection officer is Leslie Falvey. You can write to them at [email protected]. You can also reach them through [email protected].

The short version

You can use ScamSteps without giving us your name, phone number or email address.
Your answers are multiple choice. There is no box for you to type a story, a name or a number to us.
We keep your email address only if you ask for the two check-in emails, and only until those emails are sent or you stop them. If you ask only for the checklist email, we send it and do not keep your address.
We use no cookies and no tracking or advertising tools.
We do not keep anything from anyone who tells us they are under 18.
We never sell your information. We use your answers only to help you and, as totals, to warn others.

What we keep when you use the site

When you answer the questions, we keep a short record of your visit. It holds:

the day of your visit (the date only, never the time)
your country
your age group
the boxes you ticked about what has happened, for example "Money has gone from my account"
the kind of scam, where it started, and the app they moved you to, if any
how the money left, for example "Bank transfer or PayNow"
what a code or password was for, whether a banking or payment app was on a phone a scammer controlled, and which account you were locked out of
the banks, payment apps, crypto exchanges, gift card companies or phone companies you chose, or "not listed"
your answers to the optional questions, if you give them: how much you lost (as a range), and whether you have told the police or your bank

Each record has a random number instead of your name. It does not hold your IP address or anything else that says who you are.

If you are in a country we do not cover yet, we keep only the day and your country, so we know where to build help next.

If you tell us a phone number on our site did not work, we keep the day, the country, which number it was, and which of four problems you picked.

What we keep if you ask for your checklist by email

If you type your email address and ask us to email you the checklist:

If you pressed "Just send my checklist", we send the email and do not keep your address. (Resend, the company that sends our emails, keeps its own record of the email for 30 days. See below.) We keep only a random code, a note that a checklist was sent and when, linked to your visit record.
If you pressed "Send my checklist and check on me", you asked for check-ins. We keep your email address, a random code that links our emails to your visit record, when each email is due and when it was sent, and whether you asked us to stop. If an email cannot be delivered, we keep a count of the failed tries and the error message, with your address removed.

The check-in emails (one after 2 days, one after 7 days) ask a few questions. Each answer is one tap on a button in the email. We keep the answer you tap and the day you tapped it, linked to your visit record by the random code. Some email services open every button in an email to check it is safe. To tell that apart from you, we also keep the time of your first tap on each question for 10 minutes, then delete it. If two different answers to the same question arrive within those 10 minutes, we keep neither. One of the questions asks how you are feeling, on a scale of 1 to 5.

When we delete your email address

We delete your email address at the first of these:

straight after the checklist email, if you pressed "Just send my checklist"
straight after we send the 7 day email
when you tap "Stop these emails" in any of our emails
when our emails to you keep failing (after 3 refused tries, or 12 tries when the email service is busy)

After that we no longer know who you are. The random code stays with your visit record, so if you tap an answer in an old email we still count it. Only someone who has that email can use the code.

What stays on your phone and never reaches us

The ticks you make on your checklist page are kept in your phone's browser storage and in the checklist link. They are not sent to us. You can clear them by clearing your browser's site data.
Anything you type into "Keep your evidence" stays on your phone. We never see it. If you choose to email it to your bank, it goes from your own email app, not through us.
"Send to myself on WhatsApp" opens WhatsApp on your phone. We do not keep anything from it.

Why we keep it

To send you the checklist and the check-ins you asked for.
To count how scams happen, so we can warn others. We publish these counts as totals only (see below). They may also appear on Scamstats (scamstats.org), Armidale's website that measures scams in each country, in their own section, kept apart from its survey figures.
To keep the site working and correct: to find phone numbers that no longer work, and to stop people and robots from misusing our forms.

When you give us your email address and ask for the emails, you agree to us using it for these emails only. We will not send you anything else, and we will not use it for marketing.

How we publish totals

Nothing we publish or share can point to one person. Every figure follows these rules:

A figure that fewer than 5 people are behind is never shown.
Figures are by quarter of a year, never by day or week.
Figures are broken down one way at a time (for example by age group, or by how the scam started), never several ways at once.
A figure about other banks or services is shown only as an average of at least 3 of them.

Later, banks, phone companies and online platforms may sponsor ScamSteps. A sponsor will only ever see totals made under these rules. A sponsor will never see your record, your answers or your email address. Sponsors cannot change the help you see.

Cookies and tracking

We use no cookies. We use no tracking, advertising or social media tools. We count visits with Cloudflare's web analytics, which does not use cookies and does not follow you from site to site.

To stop robots, our forms use Cloudflare Turnstile. It checks your browser when you send a form. Cloudflare sees your IP address and some details about your browser to do this. Our server reads your IP address only for that moment, to pass it to Turnstile and to make the code described next. We never store it.

To stop one person from flooding our forms, we keep a scrambled code made from your network address and the day, using a secret key. We never turn the code back into your address. We delete these codes after 2 days.

Who handles your information for us

We use two companies to run the site. Both handle your information only to provide their service to us.

Cloudflare runs the website and the database where your visit record, your answers and your email address (if we keep it) are stored. It also tells us which country you are in, so we can show the right help.
Resend sends our emails. It receives your email address and the content of each email we send you, which includes your checklist. It keeps a record of each email, including its content, for 30 days, then deletes it.

Both companies may process your information outside Singapore, in the United States and in other countries where they or their suppliers work. We make sure they are bound by contract to protect your information to a standard comparable to Singapore's Personal Data Protection Act.

We do not give your information to anyone else unless the law requires us to.

How long we keep your information

Your email address: as set out above. With check-ins, that is until your 7 day email is sent, so usually 7 days. Without check-ins, we do not keep it.
Network codes used to stop misuse: 2 days.
Your visit record and answers: 24 months from your visit, then we delete them. Totals we have already published stay. Once your email address is deleted, we can no longer tell who you are. Until the record is deleted, the links in emails we already sent still work, so anyone with those emails can still add answers.
A report that a phone number did not work: 24 months, then we delete it.
Messages to [email protected]: 12 months, then we delete them.

How we protect it

Your information is stored on Cloudflare's systems, which encrypt it. Only the people at Armidale who run the site can reach the database. Links in our emails carry a random code, not your email address. The link that reopens your checklist holds the boxes you ticked and the bank you chose, so the checklist opens without asking us. Anyone who has that link can see them, so keep it to yourself.

If we believe your information has been leaked, lost or seen by someone who should not see it, we will look into it at once and decide whether the law requires us to report it. If it does, we will tell the Personal Data Protection Commission as soon as we can, and within 3 days of deciding. If the breach is likely to cause you significant harm, we will also tell you.

If you write to us

Messages and replies to [email protected] are forwarded to Armidale's own mailbox. Armidale reads them only to answer you, and deletes them 12 months after your last message. The mailbox is run by an email provider that may store messages outside Singapore. Please do not send us passwords, card numbers or bank details.

What you can ask us

You can ask us:

what information we hold about you, and how we have used it
to correct it
to stop emailing you and delete your email address (the stop link in any email does this at once)
to withdraw your agreement to us using your information. If you do, we stop the emails and delete your email address, and you will not get the remaining check-ins. Your visit record and answers stay, without your email address, and are used only for totals. If you tap an answer in one of our old emails, it still counts.

Write to [email protected]. We will reply within 30 days. Because we do not keep your name, we need a way to find your record: write from the email address you gave us, or send us a link from one of our emails.

If you are not happy with our answer, you can complain to the Personal Data Protection Commission in Singapore (pdpc.gov.sg).

Children

ScamSteps is for adults. If you tell us you are under 18, we show you help and keep nothing at all. If you prefer not to give your age, we ask you to confirm you are 18 or over before we email you.

Changes to this notice

If we change this notice, we will put the new version on this page with a new date. If a change affects how we use an email address we already hold, we will not apply it to that address without asking.