ScamBusterKE

Privacy Policy

Last updated: February 2026

Overview

ScamBusterKE is designed with privacy at its core. We allow anonymous scam reporting and take measures to protect the identity of reporters. This policy explains what data we collect, how we use it, and your rights.

Data We Collect

Scam Reports

When you submit a report, we store the scam identifier (phone number, paybill, etc.), scam type, your description, any evidence URLs, and the amount lost. Reporter phone numbers (if provided for verification) are stored as one-way SHA-256 hashes with a salt — we cannot reverse these to recover your actual number.

IP Addresses

We collect a hashed version of your IP address solely for anti-fraud detection (identifying coordinated false reports). The raw IP address is never stored.

Search Queries

When you search for an identifier, we log the search query for analytics purposes (e.g., tracking which numbers are most frequently looked up). These logs are not linked to your identity.

What We Do Not Collect

  • We do not use tracking cookies or third-party analytics
  • We do not require account creation or login
  • We do not sell, share, or trade any user data with third parties
  • We do not store raw IP addresses or device fingerprints

Data Storage

All data is stored securely on Supabase (PostgreSQL) with Row Level Security (RLS) enabled on all tables. Data is hosted on servers with industry-standard encryption at rest and in transit. We retain report data indefinitely to maintain the scam database, except for Tier 1 (unverified) reports which expire after 90 days.

Your Rights

Under Kenya's Data Protection Act, 2019, you have the right to:

  • Know what data we hold about you
  • Request deletion of your data
  • Dispute a report made against your phone number or business
  • Object to the processing of your personal data

Since reports are anonymous and reporter data is hashed, we may not be able to identify specific reports tied to you. If you believe you have been falsely reported, please use our dispute process.

Contact

For privacy-related inquiries, please reach out to us through our platform. We are committed to responding to all data protection requests within 30 days as required by the Kenya Data Protection Act.