Privacy policy

When you sign up, Argus keeps your name and email address, and your password in scrambled (hashed) form. If you sign in with Google, Google shares only your name, email address and profile picture.

Whatever you check is sent to Argus's scanning engine, which answers and doesn't keep it afterwards. When you're signed in, your history keeps a short preview (up to 200 characters) and the verdict, including the evidence behind it, such as the links found in a message. Delete any scan from your History page.

To check a link, Argus visits the page from its own server, never from your device, and may look the link up on VirusTotal, Google Safe Browsing, URLhaus and AlienVault OTX. For a site whose registry publishes no age, Argus may look up its public certificate records on crt.sh. Files are inspected on Argus's server; only the file's fingerprint (a hash), never the file itself, is looked up on VirusTotal, MalwareBazaar and AlienVault OTX. For an email, the address of the server that sent it may be looked up on AbuseIPDB. Numbers you look up in Caller ID may be checked against IPQualityScore's spam and fraud reports, and US and Canadian numbers against the FCC's public complaint records.

Screenshots and QR codes are read on your device, and the image never leaves it: only the words or link read from it are checked, like anything you paste. The first time you read a screenshot, your browser downloads the reading software from jsDelivr, a public file server. The camera, when you scan a QR code, is only used while the scanner is open, and nothing is recorded.

A password you check never leaves your device. Argus sends only the first 5 characters of its scrambled fingerprint (a SHA-1 hash) to Have I Been Pwned, which answers with hundreds of possible matches that are compared on your device. Nothing about it is saved.

If you install Argus on Android and share something to it from another app, it opens on the Scan page. A shared image is held on your device only until the Scan page reads it.

The quick check on the home page needs no account and saves nothing. To stop it being overused, Argus counts checks under a scrambled code made from your internet address, never the address itself, and deletes the count within a day.

If you report a phone number, the number, the kind of call and any name or note you add are shown to other signed-in users, without your name. Phone numbers found in high-risk messages you check are counted the same way, as “seen in scam messages”. Nothing else you check is shared.

If you connect Gmail, Argus gets read-only access: it can never send, delete or change anything. Each time you open the Inbox page, it reads your 12 latest emails (inbox or spam) and checks them. It keeps each email's subject and sender with the verdict in your history. The key Google issues for this is stored encrypted. Disconnecting removes it and revokes Argus's access at Google.

Argus's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Your Gmail data is used only to check your emails for you, is never used for ads, and is never read by people.

Contacts you add are kept with the name you give them. If a contact connects on Telegram, Argus keeps their Telegram chat ID so it can message them. Alerts say what kind of thing was risky and how risky, never what a message or email said.

Supabase stores accounts and history. Vercel hosts the website and counts visits without cookies (Vercel Analytics). Render runs the scanning engine. Argus also asks VirusTotal, Google Safe Browsing, abuse.ch (URLhaus and MalwareBazaar), AlienVault OTX, AbuseIPDB, crt.sh, IPQualityScore (for phone numbers), Have I Been Pwned (for password checks), Google (for Gmail and Google sign-in), Telegram (for family alerts), the FCC's open data, and public threat lists (OpenPhish, Phishing.Database) as described above. jsDelivr serves the screenshot reader.

Delete scans from History, remove family contacts on the Family page, and disconnect Gmail on the Inbox page at any time. To delete your whole account and everything in it, email the support address shown on Argus's Google sign-in screen from the address you signed up with.