Honest about what we do, and don't.

When you press Analyze, two things run inside your browser tab: a set of transparent pattern rules (including an India pack for UPI, KYC, “digital arrest” and Hinglish/Hindi phrasing), and a small machine-learning model. There is no external AI service, and the same message always gets the same result.

The model is a logistic regression trained on real, publicly licensed SMS datasets plus fictional messages. It is 56 KB, ships with the app, and works by adding up weights for readable features such as words, word pairs, phone numbers and money amounts. That means every result can still be explained: SafeClick shows which words pushed the model's score up. Rules and model are combined into one score, and both can be wrong.

Screenshots are read by an open-source text-recognition engine (Tesseract) running in your browser. The image goes from your device's memory to a background worker in the same tab and is never uploaded. The engine and its English language file (about 7 MB) are served by SafeClick itself, not a third-party CDN, and are cached on your device after first use. Recognition can make mistakes, so the text is placed in the box for you to check before analyzing.

Sharing from another app (after installing SafeClick on Android): the shared text or image is received by SafeClick's service worker on your device, held in memory for at most a minute, handed to the page once, and never written to storage. If the service worker isn't active yet, the share is sent to SafeClick's server, which redirects without reading it, and you are asked to paste instead.

Conversation mode uses the same local rules, plus a check across messages for friendly build-up followed by a request.

No. The analysis code makes no network requests. In production the site also sends a Content-Security-Policy with connect-src 'self', which tells your browser to block page scripts from contacting any other website.

Like any website, the server hosting SafeClick receives ordinary requests when you load its pages (for example, your IP address and the page requested). Message text is never part of those requests.

Not stored: pasted messages, analysis results, checklist ticks and learning answers. These are kept in memory only while the tab is open. SafeClick does not use localStorage, cookies or any database for them. The only things saved in your browser are your colour theme, if you choose one other than “System”, and Simple mode settings if you set them: the language, whether the app opens in Simple mode, and one family name and phone number for its call button. They stay on that phone.

Stored for offline use: after your first visit, a service worker saves copies of SafeClick's own pages, scripts, styles and fonts (and, once used, the screenshot reader) in your browser's cache so the app can open without a connection. This cache contains no messages or images. You can remove it by clearing site data for this website in your browser settings.

Copy and download: the “Copy summary” and checklist buttons only act when you press them. The copied summary lists the warning types and next steps, not your message.

Messages are displayed as plain text, never interpreted as HTML, so pasted code cannot run. Links are shown as text, not as clickable links. Input is limited to 5,000 characters.

Each rule has a fixed weight. To avoid counting the same tactic twice, related rules are grouped into families:

• The strongest rule in a family counts in full; others add 40% of their weight.
• Families combine with diminishing returns, so the score rises with each extra tactic but never exceeds 100.
• A few combinations that are typical of scams add a small, fixed bonus.
• Under 20 is lower apparent risk, 20–49 needs caution, and 50+ is high concern.

Combination bonuses: asks for sensitive details while applying pressure (+10); asks for money while discouraging checks or demanding secrecy (+10); asks you to pay in order to receive a benefit (+8); pushes you to open a link quickly (+6); asks for sensitive details alongside a link (+8); friendly build-up followed by a request (+8); claims authority while asking for data or money (+6).

The score is not a probability. It was not calibrated against a dataset of real scams, so “70” does not mean a 70% chance of fraud.

We tested SafeClick on real SMS scams and genuine texts it had never seen, following an evaluation plan we published before running it. Results from the most recent run:

• New real-world scams

  107 smishing and 2,393 genuine texts, held out

  85.0%

  of scams flagged (95% CI 77.1%–90.6%; v1 engine: 14.0%)

  0.3%

  of genuine messages wrongly flagged (95% CI 0.1%–0.6%)

• India set (Hinglish & Indian)

  47 scam and 40 genuine messages by an independent author

  85.1%

  of scams flagged (95% CI 72.3%–92.6%; v1 engine: 66.0%)

  2.5%

  of genuine messages wrongly flagged (95% CI 0.4%–12.9%)

Caveats: the real-world data is mostly older UK and international SMS, and the India set is small, so read the confidence intervals. Neither is a random sample of the scams people receive today. The full report, including the evaluation plan, before/after numbers and model calibration, is in eval/RESULTS.md in the source code (measured 2026-10-25).

False positives: genuine messages sometimes use urgent wording, mention payments, or include unusual links. A real bank alert can score as “needs caution”.

False negatives: a careful scammer can write a message that avoids every pattern here, especially a conversation that builds trust slowly. A low score is never a guarantee of safety.

The rules currently focus on English-language messages.

Sender names, phone numbers and email addresses can be faked, and logos or wording can be copied exactly. SafeClick only sees the words you paste. It cannot check who sent a message, whether a link is currently harmful, or whether an account problem is real.

The reliable test is independent verification: contacting the organization through details you already have, such as its official app or the number on your card.