Privacy Policy

You do not need an account to use Smells Fishy. When the app first runs, we generate a random device identifier and an API key for your device. We may also receive Apple's per-vendor device identifier, which we use only to avoid registering the same device twice. None of these are hardware identifiers and none can identify your physical device outside of our Service.

If you choose to sign in (optional, and not required for any core feature), we collect your email address through our authentication provider, Clerk. We do not store your password.

We store the following information about each check:

• Risk level classification (HIGH, MEDIUM, LOW, or UNDETERMINED)
• Timestamp of the check
• AI processing token counts (for usage tracking)
• A one-way SHA-256 hash of the image (used to prevent duplicate processing, not reversible back to the original image)

The screenshots you check are sent to our AI provider for analysis and are not stored by Smells Fishy — with one exception: share links, described below.

When you explicitly create a share link for a check, we store a copy of that screenshot and a snapshot of the analysis on our servers so the link can show them to the people you share it with. This happens only when you tap to create a link, never automatically. Shared data is retained as follows:

• The screenshot and analysis stay on our servers only while the link is live. Links expire automatically (90 days by default, with a hard cap of one year), and you can turn a link off at any time from the app — the stored screenshot is then deleted.
• We count how many times a link is viewed. To avoid double-counting we briefly derive a one-way hash from the viewer's IP address; the raw IP address is never stored with the view.
• Messaging and social apps generate their own preview cards for links (the verdict headline and tag — never your screenshot). Those previews are copied into chat threads and third-party servers by those apps, and are outside our control: they can persist even after you turn the link off.

We use IP addresses for rate limiting; that data is held in-memory only and automatically cleared within about an hour. Separately, we keep a log of abuse-related events (such as rate-limit hits or malformed requests) to protect the Service, which may include the IP address and endpoint involved.

Screenshots and extracted text you submit are sent to Google's Gemini API for real-time analysis. Google processes the content to generate the risk assessment. When you run a Deep Dive, the content is also analyzed with Google Search grounding enabled so the model can check claims against current public sources; Google may retain Deep Dive inputs for a limited period (about 30 days) for abuse monitoring under its own terms. See Google's Gemini API Terms.

Our website and API run on Vercel, and screenshots for share links you create are stored in Vercel's private blob storage until the link expires or is turned off. See Vercel's Privacy Policy.

Our database is hosted on Neon and uses encryption at rest. See Neon's Privacy Policy.

If you choose to sign in, we use Clerk to handle registration and sign-in. Clerk receives your email address and manages authentication sessions. See Clerk's Privacy Policy.

If you created an account, you can delete it directly in the app under Settings → Account → Delete Account. You may also request deletion of your device data (and account) at any time by contacting us at ajenglehardt81@gmail.com. You can turn off any share link you created directly from the app, which deletes the stored screenshot.

If you are a California resident, you have the right to: know what personal information we collect and how it is used; request deletion of your personal information; opt out of the sale of your personal information (we do not sell personal information); and not be discriminated against for exercising these rights.

If you are in the EU/EEA, you have the right to: access the personal data we hold about you; rectify inaccurate data; request erasure of your data; restrict or object to processing; and data portability. Our legal basis for processing is legitimate interest (providing the Service) and consent (where applicable). Contact us to exercise these rights.