Privacy policy

Fakee investigates job and internship postings for scam signals. This page explains exactly what the website and the Chrome extension read, send and keep — and what they never do.

Last updated 12 October 2026 · website and Chrome extension

1. What the extension reads

The extension only acts when you give it a posting. From the text you paste it derives company names, domains and contact details, turns those into search queries, and then runs those searches and fetches the result pages using your browser and your connection. It does not read your browsing history, your bookmarks, other tabs, or pages unrelated to the investigation it is running.

The extension requests broad host permissions (<all_urls>) because it must be able to fetch result pages from arbitrary sites, which is what allows the investigation to run without a paid search API. Those fetches happen only during a run you start.

2. What leaves your computer

When you run an investigation, the following is sent to the backend you have configured:

• the posting text you pasted (or typed into the website panel);
• the readable text of each page the crawler captured, together with its URL;
• the search allowance the run spent, whenever it searched with Brave: the numbers Brave itself returned in that reply's rate-limit headers — how many searches the window allows, how many are left, and how long until it resets. Three numbers, no text, no URLs, and nothing that identifies you or what you searched for.

The search engine you select is contacted directly by your browser; the backend then uses the content above as follows. Each item is a separate party, disclosed here because it is part of how a verdict is produced:

• Search engine you select (Brave, DuckDuckGo, TinyFish, SERPdive). The queries the extension built from the posting — a company name, a domain, a phrase to look up — go from your browser to whichever engine you selected. The posting text itself is not sent with them. Choosing self-hosted SearXNG instead sends the queries to an instance you run, rather than to a search engine's API from your browser.
• LLM provider (Groq). The posting text and the captured page evidence are sent for extraction and summarisation — the "what the user reported" and "what the investigation found" steps. If the deployment has no LLM key configured, no such request is made and deterministic heuristics run locally instead. Data sent to a provider is handled under that provider's own terms.
• Domain lookups. The domain named in the posting is checked against public sources — registry (RDAP), DNS and HTTPS. Only that domain is looked up.
• Search provider (Exa) — off by default. Server-side search is disabled unless the operator explicitly enables it. The extension never uses it, because your own browser performs the search.

3. What is stored

On your machine

The extension keeps a few things in Chrome's local extension storage (chrome.storage.local): your settings (backend API base, site URL, search provider, and an optional search API key if you added one), and the last posting you pasted so it is still there when you reopen the side panel. If you sign in so you can report postings, the extension also stores the session the website hands it — your account id, email address, display name and a short-lived access token — so the side panel can file a report as you. Signing out in the side panel deletes it, and clearing the extension's data or uninstalling the extension removes everything.

On the backend

• Investigations are not stored. Storage is opt-in and off by default, so running a check leaves no record of what you pasted.
• Reports are stored — with your account attached. If you press "Report as scam" while signed in, the description you submit is stored and linked to a company record so repeated reports can be correlated. The report is also stored with your account id, the email address and display name on your Google account, the date, and the verdict you were looking at when you filed it. This is the only path that persists what you wrote, and it only happens when you ask. You can see every report you filed, and its review status, on the website's My reports page.
• Allowance readings. One row per provider window records how much of each free allowance is left: the search allowance the extension reported, and the allowance read from the backend's own LLM replies. It is not tied to a person — there is no user, session or client column — so every visitor sees the same reading, it cannot be traced back to whoever ran the search, and a new reading for that window replaces the old one.
• Company-level cache. A finished result may be cached for up to 24 hours so a repeated check of the same company does not re-run the whole pipeline. The cache holds public intelligence only — your raw text is stripped before anything is cached.
• Rate limiting. Your IP address is counted in memory for a rolling window to keep the service available. It is not written to the database.
• Logs and metrics. Each request produces an access-log line with method, path, status, duration, client IP and a generated request id. Request bodies are not logged. Metrics are process-local counters by route and status.

4. What is never done

• No account or sign-in is needed to investigate a posting — only to report one.
• No identity data is collected beyond what the sign-in provider returns: your account id, email address and display name.
• No tracking cookies or cross-site tracking.
• No advertising SDKs, and no behavioural or cross-site analytics. The website counts page views in aggregate, cookielessly (section 7).
• No selling or renting of personal data.
• No report about you: the allowance reading is numbers, not your queries, the pages you visited, or a usage history of any kind.
• No reading of pages unrelated to a run.
• No sharing beyond the providers in section 2.

5. Use of data and Chrome Web Store compliance

Data the extension handles — the posting you paste and the pages it captures — is used only to produce the investigation you asked for. Its use is limited to that purpose, and it complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is not transferred to third parties except as described in section 2, and never for advertising, creditworthiness, or lending purposes.

6. Retention and your controls

• Clear the last pasted posting from Settings in the side panel, or clear the extension's storage — it is gone.
• Withdraw a report from My reports on the website (or from "My reports" in the side panel). It stops counting towards that company's history immediately; the record is kept in a withdrawn state so an administrator cannot resurrect it.
• Sign out at any time. That ends the session; it does not delete reports you already filed, which you can withdraw first if you wish.
• Point the extension at your own backend. The API base is a setting, so you decide which server receives anything at all.
• Do not paste more than the posting. A job message is all the investigation needs; there is no reason to include identity documents, bank details or other personal records.
• Cached company results expire on their own within 24 hours. Stored reports can be removed on request through the contact channel below.

7. The website

The landing page is a static site. It sets no cookies of its own, and the only thing it measures is aggregate page views through Vercel Web Analytics, which is cookieless: visitors are identified by a hash derived from the incoming request that is discarded within 24 hours, so there is no persistent identifier and no way to follow you across other sites. What is recorded per view is the timestamp, the page path, the referrer, filtered query parameters, coarse geolocation (city level), and your device, browser and operating system families — aggregated statistics, not a profile of you. Any content blocker or browser tracking protection stops it. It loads its two typefaces from Google Fonts, which means Google receives your IP address and user-agent when the page loads.

If you have the extension installed, the page can open a local connection to it so a check runs inline. In that case the text you type is handed to your extension and the resulting verdict is rendered on the page — the website itself never receives or stores it.

The account pages do talk to the backend, and only when you are signed in. My reports lists the reports you filed and lets you withdraw one; the admin dashboard is restricted to the operator's own administrator address and shows the report queue — including the reporter's email address and display name and the review note — so reports can be accepted, rejected, or sent back to the queue. Signing in is handled by Neon Auth with Google as the provider. The website sends your browser to Neon Auth for the sign-in itself and receives back a session; your Google password is never seen by us. Reporting requires that session, and the backend verifies every request's signed token before accepting a report or serving an account page.

8. Self-hosted and other deployments

Fakee is open source, and anyone may run their own copy. This policy describes what the software does. If you are using a deployment operated by someone else, that operator is the data controller for anything stored on their backend, and their contact details apply. If you run your own, you are the operator.

9. Children

The service is not directed at children under 13, and it does not knowingly collect personal information from them.

10. Changes to this policy

Material changes will be published on this page with a new "last updated" date. Continued use after a change means you accept the updated policy.

11. Contact

Questions, corrections or a deletion request? Open an issue at github.com/muddassir-2025/Fakee/issues.