Privacy Policy

This policy covers fakewatch.pro, the FakeWatch dashboard, our Telegram and Discord bots and the emails we send. "FakeWatch", "we" and "us" mean the team that runs the service. "You" means anyone who uses it.

What we collect

Your account

• Email address and a hashed password (we cannot read your password).
• Two-factor settings, if you turn them on: the secret is stored encrypted, recovery codes are stored hashed.
• Sign-in records: time of last sign-in and failed attempts, used to protect your account.
• For each active session: IP address and browser name, so you can see and end your sessions.
• Your answer to "How did you hear about us?" at sign-up, if you choose one.

Your workspace and projects

• Workspace name, team members, their roles and invitations (the invited email address).
• Project details you enter: name, ticker, description, logo, official websites, social accounts, token contracts, keywords and whitelist.
• Your team members' public names, usernames and photos, if you add them so we can spot fake admins.
• An activity log of actions in the workspace (who did what and when, with IP address).

Takedown reports

To file a report, we need a brand owner profile: name, role, work email and official website. This information goes into every report we prepare for you to send, because registrars and platforms need to know who is complaining.

If you order a takedown or turn on auto-takedown, we keep the letter of authorization you sign: its text, your name, role and work email, the time you signed and your IP address. We attach the letter to the reports we send for you, so the registrars, hosts and blocklists we write to see it.

Payments

You pay with USDT or USDC from your own wallet or exchange. We record the network, amount, sending address and transaction hash. This data is public on the blockchain anyway. We never ask for, receive or store private keys or seed phrases.

Visits to our public pages

We count visits to our public pages per day and per page, grouped by where they came from: a search engine, an AI assistant, a crawler such as Googlebot or GPTBot, or another website. We keep only these totals. We do not store your IP address or browser details for this and do not set a cookie, so the counts cannot be linked to you.

We also run our own copy of Umami, an open-source statistics tool, on our server. For a visit to a public page or the sign-up page it records the page address, the site you came from, your browser, operating system, device type, screen size and language, and an approximate location (country, region, city) worked out from your IP address. The IP address itself is not stored, no cookie is set and nothing is sent to a third party. Visits are grouped by an anonymous code that changes every month and cannot be turned back into your IP address. If Do Not Track is on in your browser, this tool records nothing. It is not used in the dashboard.

Our bots

If you add our bot to your Telegram group or Discord server, it reads new messages there to check links, contract addresses and names that look like your admins. We store only the messages the bot flags (the text, the sender's public username and ID, and the time) and the public names and IDs of your admins and moderators, so we can spot copies of them. We do not store your chat history.

Data about suspected fakes

To find impersonators, we collect public information from the open internet: websites and their screenshots, domain and certificate records, public social media profiles and posts, public Telegram channels, token listings and scam blocklists. Some of it may relate to people, for example the owner of a fake account.

We use this data only to detect fraud and impersonation and to report it. If you think your website or account was flagged by mistake, write to [email protected] and we will review it.

How we use data

• To run the service: scans, risk scores, alerts, reports and your public verification page.
• To keep accounts secure: sign-in protection, rate limits and fraud checks.
• To send service emails: sign-in links, alerts, receipts and plan reminders. We do not send marketing emails without your consent.
• To answer support requests.
• To find and fix bugs: when something breaks, an error report goes to our own error tracker on our server, not to a third party. It holds technical details such as the page address and the error, never your password, cookies, form contents or IP address.

Who we share it with

We share data only with the services we need to run FakeWatch, and only the part they need:

• Server hosting. Our database and application run on a rented server.
• Cloudflare for DNS and for receiving email sent to our addresses.
• Resend for sending our service emails: sign-in links, alerts, receipts and reminders.
• Google (Gemini API) and OpenRouter for AI checks of borderline findings. OpenRouter passes the request on to the model's provider. We send only public data about the suspected fake (page text, screenshots, public profiles) and your brand's public name and logo. We never send your email, wallet addresses, payments or team data. Google may use content sent through its free tier to improve its products.
• X, Telegram and Discord, where we search for accounts and servers using your project's public names and handles.
• YouTube. FakeWatch uses YouTube API Services to search YouTube for channels and streams that use your project's public names. Google receives these search terms and your project's public YouTube channel, never data about you. Google's use of data is described in the Google Privacy Policy.
• Bluesky, whose public API receives the search terms (your project's public names), never data about you.
• Security and archive services, such as Google Web Risk and the Wayback Machine, which receive the addresses of suspected fakes, never data about you. The full list is on the data sources page.
• Report recipients. We do not send reports. When you send one yourself, the registrar, host, platform or blocklist you choose gets your brand owner profile, links to the fake and the evidence.
• Public blockchain nodes, which we query to confirm your payment.

Anything you mark as official on your verification page is public by design. We may also disclose data if the law requires it, or to protect people from fraud.

Cookies

We use only the cookies the site needs to work: a session cookie that keeps you signed in, a security cookie that protects forms from cross-site attacks and a one-minute cookie that shows a message after a page change. If you open a partner's link (fakewatch.pro/r/...), a cookie remembers that partner's short name for 60 days, so we can pay them a share if you sign up. It holds nothing about you. No advertising, analytics or third-party tracking cookies.

How long we keep it

• Account, workspace and project data: while your account exists.
• Session records, including IP address and browser: deleted when the session ends or expires.
• Sign-in links, password reset links and invitations: deleted 7 days after they are used or expire.
• Activity log: 12 months.
• Error reports: 30 days.
• Data from YouTube about suspected fake channels and streams (names, descriptions, subscriber counts): refreshed on every check and deleted after 30 days without one. Only the channel or video ID stays, so the alert still links to it.
• Data from Bluesky about suspected fake accounts and posts (names, bios, post text, follower counts): deleted as soon as the account or post is deleted on Bluesky, and after 30 days without a check. Only the account or post ID stays.
• Daily visit counts: about 13 months.
• Anonymous page statistics: while we need them to compare periods. They hold no name, email, IP address or cookie.
• Payment records: as long as we need them for accounting and tax rules.

When you ask us to delete your account, we delete your data within 30 days, except payment records we must keep.

Your rights

You can ask us to show, correct, export or delete the personal data we hold about you, or to stop using it. Most project data can be edited in your dashboard. For everything else, email [email protected] from the address on your account. We reply within 30 days. Depending on where you live, you may also complain to your local data protection authority.

Security

All traffic uses HTTPS. Passwords are hashed, two-factor secrets are encrypted, sign-in attempts are rate-limited and every workspace is separated from the others. No system is perfectly secure. If we learn of a breach that affects your data, we will tell you without undue delay.

Other points

• Age. FakeWatch is for adults acting for a project or business. It is not meant for anyone under 18.
• International transfers. The services we use may process data in other countries, including the United States.
• Changes. If we change this policy, we update the date at the top. For important changes, we also email account owners before they take effect.

Contact

Privacy questions and requests, reports about fakes or wrong findings: [email protected]. You can also find us on X: @FakeWatchPro.