Privacy Policy

This explains what PhishCore collects, why, who else sees it, and the choices you have. PhishCore is a student project from Politeknik Brunei, and we have tried to collect as little as we can.

1. What we collect

• Account details: your name, email address and a hashed password, plus an optional profile photo.
• What you scan: the link, sender address, message text, phone number or screenshot you submit, and the results (verdict, risk score, checks and date). Screenshots you upload are stored on our server.
• Site information found during a scan: for example a site's IP address and hosting details. This is about the site you checked, not about you.
• Sign-in sessions: a record of your devices (browser and system type) so Settings can show where you are signed in.
• Activity in the app: your Phish Lab progress, notifications and any investigation requests you make.
• AI chat messages: what you type to the chat adviser, only while you use it.

2. How we use it

• To run scans, show your history and analytics, and let you export them.
• To keep the service secure, apply limits and prevent abuse.
• To send account emails such as password resets.
• To build the public threat feed from scans judged Suspicious or Phishing.
• To measure and improve detection for our project evaluation, using results and not your identity.

We do not sell your data and we do not show advertising.

3. Who else receives data

To do their job, some outside services receive part of what you submit:

• Google Safe Browsing and VirusTotal receive the links you scan.
• urlscan.io receives a link only when the optional page preview is switched on and you click "Show page preview", so that a picture of the page can be taken. The scan is unlisted, which keeps it out of urlscan's public search. Our copy of the picture is kept for a few days and then deleted.
• An OCR service receives screenshots so the text in them can be read.
• AI providers (Google Gemini for the optional AI text check, and Groq for the chat adviser) receive the message text or chat messages when those features are switched on.
• Domain lookup and IP information services receive the domain or address being checked.
• Brevo delivers our emails, so it receives your email address and the message.
• Our hosting provider (DigitalOcean) stores the data on our server.

Please do not submit anything you are not comfortable having checked by these services, such as private messages with passwords or bank details.

4. What is public

Scans judged Suspicious or Phishing can appear on the public Threat Reports page and in the downloadable feed with the reported link, the date, a status and a username. Your name, email address and risk scores are not shown. A scan is shared by link only if you create a share link, and you can switch it off at any time.

5. How long we keep it, and deleting it

We keep your data while your account exists. When you delete your account from Settings, your account and your scans are deleted from our database. Copies already held by the outside services above, and entries that have already been included in public feed downloads, are outside our control.

6. Cookies

PhishCore uses only the cookies it needs to keep you signed in and to protect forms against forgery. We do not use advertising or tracking cookies.

7. Security

Passwords are stored hashed, traffic is meant to travel over HTTPS, and scan pages are private to their owner unless a share link is created. No system is perfectly secure, so please use a strong, unique password.

8. Your choices and contact

You can view and change your details, export your scan history, and delete your account from the app. To ask a question or request help with your data, email phishcorebn@gmail.com. If we change this policy we will update the date above.