SHORT MEMORY. On purpose.
Do I Trust This is operated by Rebellion Systems Inc., incorporated in Delaware, United States. We are responsible for the processing described here. Contact [email protected] about privacy or deletion.
The public checking service is being prepared. The form shows whether checking is enabled. The processing described below applies when checking is available; examples on the website are illustrative.
Visiting the website
Cloudflare hosts and protects the website and processes connection information, such as IP addresses and request metadata. We use Plausible, which we host ourselves on our Hetzner server, for aggregate website analytics, including page views and clicks on selected navigation links. Our analytics integration does not send submitted messages, images, report references or analysis results as event properties. Fonts and the application’s main scripts are served from our domain; the analytics script is loaded from our own analytics server (analytics.rebellion.systems), not from plausible.io.
Checking content
We receive the text, URLs, optional question and images you deliberately submit. This can include personal information about you or other people. Send only content you are entitled to share, and avoid passwords, verification codes, recovery phrases and other unnecessary sensitive information.
Our pipeline reads images and extracts text on servers hosted with Hetzner. It can visit up to 50 supported public URLs found in the original submission, read their pages and extract text from supported images on those pages. Links discovered on those pages or in their images are checked statically but not followed. If a page has almost no readable text, we may load JavaScript in a fresh, isolated browser with strict time, memory and download limits. This can request public scripts, stylesheets and page data using GET. Destination websites, image hosts and those resource hosts receive requests from our server and may record them. We do not reuse your browser’s logins, cookies or storage, and we destroy the temporary browser after each request. We do not submit forms, sign in, click links or send POST requests. Blocked or unfinished content remains a stated limitation. For URL checks, Cloudflare DNS-over-HTTPS receives domain names and the relevant registry RDAP service receives a registrable domain, never the URL path, query, message body or file. Public reference lists are downloaded separately; submitted URLs are not sent to their publishers.
The pipeline attempts to redact common secrets before analysis. Redaction is not perfect. Selected text, image observations, extracted text and page evidence are sent to Jev, provided by Typesafe, to answer the relevant analysis questions. Original image pixels are not sent to Jev by this flow. The result combines those answers and other available evidence. Missing information remains a limitation, not evidence that content is safe.
To avoid repeating file analysis, DITT can reuse completed extraction and model answers across people who submit exactly the same files. Model answers are reused only when the full analysis input also matches. This shared operational cache holds derived evidence and checksums, not original files. It does not expose other submitters’ identities or reports. Entries remain available for at most 24 hours from their creation, with no extension on reuse. Deleting a participating check invalidates its reusable entries; other people’s existing private reports retain their own expiry. URL fetching and content-provenance checks run afresh. The cache is not used for training.
Checking by email
Cloudflare Email Routing receives the message you send to our checking address and relays it to our connector. We process the delivery addresses, subject, selected message headers, message body and supported attachments to run the same checking pipeline. HTML email is read as static text without running scripts or loading remote images. Supported attachments can include images, PDFs, Word documents and forwarded email files; omitted or unreadable parts remain limitations.
We use the delivery sender address and bounded thread references to send an automated assessment through Cloudflare Email Sending. These reply details and the assessment share the check’s 24-hour operational lifetime. The connector does not keep a raw email archive or a separate log of addresses, subjects or message bodies. A small recovery record contains only processing identifiers, expiry and delivery status, and is removed after outcome recording or expiry. Hashed recipient attempt records remain for up to 24 hours to limit repeated replies; these are operational records, not anonymous analytics.
Replies may include non-clickable domain hints for links DITT could not fully inspect, with paths and parameters hidden, and the reason each link was incomplete.
Automatic, bulk and loop-prone messages may be checked without a reply. Delivery can also fail or remain uncertain, so sending an email does not guarantee a response. Email checks do not authenticate the sender’s identity. Your email provider, Cloudflare’s email services and recipients’ mailbox copies have their own retention practices; our expiry or deletion cannot recall a reply or delete those copies.
For early deletion of an email check, contact [email protected] from the submitting mailbox with the approximate submission time and subject. We may need to verify the request. Do not resend sensitive content as proof.
Checking on Telegram
You can send our Telegram bot text, links, photos or supported documents in a private chat, or ask it to check a message in a group with /check. We process the message, its attachments and the details Telegram includes with it, such as user and chat identifiers, names, usernames and app language. When you use /check on someone else’s message, this includes that message and its author’s details. In groups, the bot acts only on messages addressed to it.
The bot replies in the same chat; in a group, members can see the request and the assessment. Message details and evidence share the check’s 24-hour operational lifetime, and our connector keeps no message content. A hashed user identifier and admission times are retained for the 24-hour quota window. Telegram keeps its own copies of messages and replies; our expiry or deletion cannot recall a sent reply or delete those copies.
Checking by Instagram mention
You can mention @doitrustthis in a comment on a public post, or in the caption of your own public post. Through Instagram’s API we read the mentioning comment, the post’s caption, the posting account’s username, timestamps and one still image from the post. For comment mentions, Meta does not tell us who wrote the comment.
We post a public reply to the mention. It uses fixed wording chosen from the result and never includes a score, quotes, links or personal details, but anyone who can see the post can see it. Evidence shares the check’s 24-hour operational lifetime, and our connector keeps no content. For caption checks, a hashed username and admission times are kept for the 24-hour quota window. Meta keeps posts, comments and our replies under its own policies; our expiry or deletion cannot remove them.
First-use messages
For the first eligible private reply on a messaging channel, DITT can send service information, the Privacy Notice and Terms links in a separate message. Result-specific findings and limitations still accompany every assessment. If separate delivery cannot be confirmed, the reply keeps an inline disclosure.
To avoid repeating these notices, we retain a protected sender identifier scoped to the channel and service account, the notice version, delivery status, a bounded retry count and operational timestamps. The receipt expires 365 days after the last eligible reply. It contains no raw address, handle or message. It is pseudonymous personal data, is not used for Training or marketing, and does not link identities across channels.
Deleting a check does not remove this separate notice preference. To remove it, request deletion of the notice record from [email protected] using the same channel identity. We verify the request. Random identifiers for already reserved sends may remain for up to 24 hours to prevent their replay, without a link to the erased recipient. A later use may receive the notice again.
A recorded delivery means provider acceptance, not proof of receipt, reading, consent or agreement to the Terms. A material notice update can trigger one further notice on a subsequent use; changes requiring advance information are communicated before the processing change.
Private session and retention
Checking uses an essential cookie named __Host-dit_web to authorize access to your reports. It is renewed before each new check and expires 24 hours after that renewal. It is inaccessible to page scripts, and is not an advertising identifier. Your tab’s session storage holds only the current report reference so a reload can resume it. Clearing cookies removes access; a report reference alone does not grant access.
- Pending input and uploads are kept only while needed to capture the evidence, with a maximum access window of 24 hours from the check’s creation. Originals are discarded after capture or failure.
- Operational evidence and results are accessible for up to 24 hours from submission. Expired content is scrubbed by scheduled cleanup, normally within five minutes. Content-free deletion and expiry records can remain for seven more days to prevent duplicate processing.
- You can delete a check from its result page before expiry. Deletion stops later analysis requests; a request already sent to a provider cannot be recalled.
- Content-free operational metrics, such as request counts, durations, module outcomes and a random telemetry reference, are kept separately. These metrics do not contain submissions or reports.
These are limits for our operational store. TypeSafe’s published Privacy Policy says it does not train or fine-tune models on API inputs, and describes retention by purpose rather than a fixed deletion period. We do not claim that Jev deletes inputs within our 24-hour window. Its legal documentation lists zero data retention as an enterprise option; we have not assumed that option is enabled for DITT. Destination websites have their own retention practices. Operational service content is excluded from our durable training-corpus backups.
Accounts and credits
Creating an account is optional for the website checker. The Mac app, email checks from your own address and Telegram checks can be linked to an account.
While your account exists, we store your verified email addresses, one of which is primary; passkey public keys and labels; signed-in browser and device sessions, with labels and last-used times; and linked Telegram identities, stored only as a one-way hash. We never store passkey biometrics or private keys; those stay on your device.
We also keep a credit ledger for as long as your account exists: grants, charges per check with the date, channel, credits and number of images or documents inspected, refunds and manual adjustments. The ledger never contains checked content. Checked content is still deleted within 24 hours as described above.
Sign-in and verification codes are sent by email through Cloudflare Email Service and expire after 10 minutes.
To attribute email checks to your account, we read the authentication result our email provider, Cloudflare, adds to forwarded messages: whether DMARC, SPF and DKIM passed. We compare it with the sender address. We do not keep these headers.
The Do I Trust This team can see account addresses and credit usage in an internal administration tool to operate the service, answer support requests and prevent abuse.
Closing your account immediately deletes your addresses, passkeys, sessions, linked identities and pending codes. We keep the credit ledger, without addresses, for accounting and abuse prevention for up to 13 months after closure.
To access or delete account data, contact [email protected].
Language and answers
The interface uses a supported browser language on the first visit, or English otherwise. A language choice is saved in the dit_language preference cookie for one year. Only the chosen language is stored there; it does not grant access to reports. The chosen language applies to new checks. Assessment wording comes from reviewed, versioned catalogs on our backend and is saved once with the result. Existing answers do not change language. We do not use an external translation service or translate submitted evidence for this feature. An unavailable translation is shown in English with a visible note.
Email assessments have a configured limit, currently 50 per recipient in a rolling 24-hour window. Above that limit, no paid assessment runs and a branded notice explains when to try again. Hashed recipient identifiers and admission times are retained for the quota window so deleting a report cannot reset the allowance.
Training is separate
Ordinary website, email, Telegram and Instagram checks are not added to DITT’s training corpus. Accepting the Terms or receiving a result does not opt you into training. Deliberate team contributions use a separate, restricted flow with their own contribution records and retention rules.
Why we process information
We use submissions to provide the check you request and the private result, and connection information and operational metrics to operate, troubleshoot and protect the service. Where European data-protection law applies, providing the requested service relies on performance of our agreement with you; proportionate security and operational monitoring rely on our legitimate interests. We assess other information, including information about third parties, according to its purpose and applicable law.
Recipients and international processing
Relevant providers include Cloudflare (website delivery, access, email routing, email sending and routing of Instagram notifications), Hetzner (hosting, including our self-hosted website analytics), and Typesafe/Jev (analysis). Telegram and Meta (Instagram) deliver messages, mentions and posts to us and publish our replies under their own terms and privacy policies. Authorized team members may access service information where necessary to operate the service or respond to a support or privacy request. We are a US company. TypeSafe’s published policy states that its services are hosted in the United States. Its Data Processing Addendum describes processor obligations and standard contractual clauses for relevant international transfers. Other providers may also process information outside your country. Contact us for information about applicable processing terms and transfer arrangements; no EU-only processing or zero-retention service is promised here.
Your choices and rights
Depending on where you live, you may have rights to access, correct, delete or obtain a copy of personal information, object to or restrict processing, and complain to your data-protection authority. Contact [email protected]. We may need information sufficient to verify a request; do not send passwords or sensitive content as proof. Because checks have short retention, we may no longer hold or be able to identify the checked content you ask about.
Results are decision support. We do not make legal or similarly significant decisions about people through this service. We will update this notice as the service changes and show the current date here.