Privacy Policy

1. Introduction

Home Fraud Defense™ ("HFD," "we," "our," or "us") operates HFD Fraud Scan and the HFD Registry. This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use our services. We are committed to handling your data with transparency, care, and respect.

2. Information We Collect

The free fraud-scanning tools on this site are open and require no consumer account. We do not ask you to register, and we do not store login state for scanner use.

a. Information You Provide

• Scan content: Emails, text messages, screenshots, phone numbers, addresses, and URLs you submit for fraud analysis (subject to the 24-hour retention rule in Section 6)
• Pro account information (Registry, HFDCP™ certified pros, and paid services only): Name, email, phone, and company/license information
• Fraud reports: Property addresses and fraud descriptions submitted to the Registry
• Contact submissions: Name, email, phone, and messages sent through our contact form
• Subscription details: Billing information processed by Stripe (we do not store payment card data)

b. Information Collected Automatically

• IP address and general location (country/state)
• Browser type, operating system, and device type
• Pages visited and time spent on the Service
• Scan usage counts and timestamps

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the fraud detection and registry services
• Process and display scan results using AI-powered analysis
• Manage your account, subscription, and search quota
• Send fraud alerts, service updates, and communications you have consented to receive
• Respond to your inquiries and support requests
• Detect and prevent fraud, abuse, or violations of our Terms of Service
• Comply with applicable laws and legal obligations
• Aggregate and anonymize data to improve fraud detection patterns and publish trend statistics

4. Scan Content & Privacy

Content you submit for scanning (emails, texts, screenshots, phone numbers, addresses, URLs) is processed in-memory to generate a fraud analysis result. We do not sell, rent, or share your submitted scan content with third parties for marketing purposes, and we do not train AI models on it. Submissions are passed to third-party AI and data providers under their own zero- or short-retention terms purely to produce your result. Raw third-party API responses are parsed in-process and discarded — they are not stored on our servers. See Section 6 for the active-database retention schedule.

5. Sharing of Information

We may share information in the following limited circumstances:

• Service providers: Trusted vendors who assist us in operating the Service (e.g., Stripe for payments, cloud hosting providers, AI model providers) under strict data processing agreements
• Sponsors: Sponsors listed on the platform are displayed to all users; we do not share individual user data with sponsors
• Law enforcement: When required by law, court order, or to protect the safety of users or the public
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to you
• With your consent: Any other sharing requires your prior explicit consent

6. Data Retention

We apply two different retention regimes depending on the type of data:

Anonymous tool submissions (open scanners):

• Phone, email, and URL lookups — 24 hours in our active database, then automatically purged
• Message-review submissions (and reviewer outcomes) — 24 hours, then automatically purged
• Scan records — 24 hours, then automatically purged
• Raw third-party API responses — not retained at all (parsed in-process and discarded)
• User-saved deed reports — 30 days, then automatically purged
• Page-view analytics — 90 days, then automatically purged

These periods are enforced by an automated purge job that runs every day plus once on every service start. See our Retention Policy for the technical detail.

Account-bound and legal-defense data:

Pro account records, audit events, transactional email logs, payment records, fraud-registry submissions accepted for public display, and Pro-saved screening records are retained on longer schedules (typically 5–7 years, or indefinitely for accepted Registry entries) for fraud prevention, legal-defense, and regulatory record-keeping. Records on a litigation hold are retained until the hold is released.

Backups note: encrypted database backups roll off on a 90-day rolling window, so anonymous tool submissions may continue to exist in encrypted backups for up to 90 days after the active-database row is purged. Backups are restorable only for disaster recovery.

7. Cookies & Tracking

We use essential cookies and browser local storage to maintain your session and preferences (such as your registry login state). We do not use third-party advertising cookies, tracking pixels, or cross-site profilers.

For website analytics we use Plausible Analytics, a privacy-friendly, cookieless analytics service. Plausible does not set cookies, does not collect or store any personal data or IP addresses, and does not enable cross-site tracking. We use it only to measure aggregate page-view counts and referrer sources so we can improve the site.

8. Your Rights & Choices

Depending on your location, you may have rights including:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Opt-out: Unsubscribe from marketing emails at any time via the unsubscribe link
• Portability: Request your data in a portable format

To exercise any of these rights, please use our contact form. We will respond within 30 days.

9. Security

We implement industry-standard security measures including encrypted data transmission (TLS), hashed password storage, and access controls to protect your personal information. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but are committed to protecting your data.

10. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the effective date and, where appropriate, by email. Your continued use of the Service after any changes constitutes acceptance of the revised Policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out via our contact form or write to: