This page describes what the platform stores, what it never shows publicly, and the separation between business and public data. It is a description of how this application actually behaves[cite: 23].
Every business has its own workspace. Investigations, evidence, notes, brand profiles, verification records and team memberships are associated with that workspace and are readable only by its authorised members[cite: 23].
Access is enforced on the data layer, not by hiding interface elements: changing a case identifier, workspace identifier or request parameter does not grant access to another company's records[cite: 23].
A business is listed publicly only if it explicitly opts in. The published record is a separate, sanitised copy containing only the fields the business approved: name, industry, logo, website, official accounts, support and purchasing channels, and its accurate verification status[cite: 23].
Internal notes, evidence, risk assessments, investigation history, employee details, private contact details and unpublished payment information are never part of that public record[cite: 23].
A published community report shows the title, scam type, platform, the account or address reported, the description and the display name the reporter chose. Anonymous reporting is supported[cite: 23].
Reporter contact details and uploaded screenshots are stored privately and are visible only to the moderation team. They are never shown in the public feed[cite: 23].
Sensitive-looking content in a submission or comment is held for human review rather than published automatically[cite: 23].
A safety check shows its result to the device that ran it. For abuse prevention the platform stores a one-way fingerprint of the submitted target and the result category — not the text of a message you submitted[cite: 24].
Results are kept in the browser session only, so closing the tab clears them[cite: 24].
Private uploads are stored in private storage. They are not given permanent public links; access is granted through time-limited signed links to authorised users[cite: 24].