Kloptet Privacy Policy

Last updated: 30 October 2026

Kloptet is a free app that helps you recognise phishing and scams. This text explains which data we use, why we use it and what your rights are. We keep it as simple as possible.

Who are we?

Kloptet is operated by:

• Jelle Quisthoudt
• E-mail: privacy@kloptet.be

We are the data controller. This means we decide how and why data is used in Kloptet.

In short

• You do not need an account.
• There are no ads.
• We do not use any software to track you or to analyse your use.
• We do not sell data. We also do not share it for marketing.
• Our server does not store the text of a check.
• Some features only work if you give your consent.

Having a message checked

You can paste a text or a link, or pick a screenshot. The app sends it over a secure connection (HTTPS) to our server. That is where we assess the message.

Our server does not store the text of your message.

We do keep a log. It never contains the text of your message. It only contains:

• which method assessed the message;
• where the message came from, for example SMS or WhatsApp;
• whether an image was attached;
• how many links it contained;
• the verdict;
• how long the check took.

To prevent abuse, we limit how many checks someone can do in a short time. For this we use your IP address. It is only kept briefly in the server's working memory. We do not store it.

How we check links

Our server assesses the message using fixed rules. We also check links technically:

• We look at how old the domain name is. We ask public registries (RDAP) for this. They only see the domain name.
• If this feature is switched on, we also check the link with Google Safe Browsing. Google then sees the link. This tells us whether the link is already known to be dangerous.

Checks with AI

Sometimes we also use artificial intelligence (AI) to assess a message. This only happens if we have switched this feature on. The AI is provided by the company Anthropic, in the United States.

Before the text goes to Anthropic, our server removes personal data from it:

• names after a greeting, such as "Dear John";
• phone numbers;
• e-mail addresses;
• IBAN and card numbers;
• Belgian national register numbers;
• street addresses;
• the part of a link after the question mark. It often contains personal codes.

Anthropic works for us under a data processing agreement. Anthropic does not use the data to train its AI. Anthropic may keep it for up to about 30 days to detect abuse.

Screenshots. We cannot remove personal data from a screenshot. That is why the app first asks for your consent. It does this once, before your first screenshot is sent to the AI. If you say no, we only check text.

Anonymous statistics

On our server we keep anonymous figures. This shows us which kinds of scams are common right now. We count:

• types of scams;
• brands and organisations that scammers pretend to be;
• verdicts.

For domain names seen in checks and reports, we keep the domain name, how often we saw it and on which dates.

We also want to know how many different people saw a domain name. For this we turn your IP address into a code that cannot be turned back (a "hash"). Every day we add a different secret to it. So the code is different every day. This way nobody can follow you from one day to the next.

We keep these statistics for 90 days.

Warn others

With "Warn others" you report a message to Kloptet. This only happens after you confirm it in a dialog.

Our server first removes the personal data, in the same way as for the AI. Then we keep:

• the text without personal data;
• where the message came from, for example SMS;
• the domain names in the message.

We keep this for at most 30 days. We use it to spot new waves of scams. We review possible waves ourselves. If we approve a wave, the app shows a short, anonymous description. We never show the original message.

Notifications on your phone

You can choose to receive notifications about new waves of scams. Notifications are only on if you switch them on.

If you switch on notifications, we keep:

• your device's push code (a "push token");
• the language you chose.

Notifications go through the push service of Expo (650 Industries, United States). They then reach your device through the Apple Push Notification service or Google Firebase Cloud Messaging.

You can switch off notifications in the app at any time. We then delete your push code from our server.

What stays only on your phone

Some data stays on your phone. We do not receive it:

• your last 30 checks, including the text. This lets you forward a message to Safeonweb later;
• your progress and streak in the quiz;
• whether you gave consent for screenshots.

You delete this with "Clear" in the app, or by removing the app.

Report to Safeonweb

If you tap "Report to Safeonweb", your own mail app opens. An e-mail to suspicious@safeonweb.be is ready. You decide whether to send it. We do not send anything ourselves.

Live warnings

The warnings in the app come from public feeds of Safeonweb, the Centre for Cybersecurity Belgium (CCB) and the FSMA. If you tap a warning, their website opens. Their own privacy policy applies there.

Who receives data?

• Our hosting provider: Hostinger. Our server is in France, in the EU.
• Public RDAP registries: only the domain name.
• Google (Safe Browsing), if this feature is switched on: the link.
• Anthropic (United States), if the AI is switched on: the text without personal data, or a screenshot if you gave consent.
• Expo (650 Industries, United States), Apple and Google: your push code and the notification, if you switched on notifications.

We do not give data to anyone else, unless the law requires us to.

Data outside Europe

Some of these companies are based in the United States. Data only goes there with the protection that European rules require. We rely on the EU-US Data Privacy Framework or on the standard contractual clauses of the European Commission.

Why are we allowed to do this?

The European privacy law (GDPR, Article 6) says when we may use data. We rely on these grounds:

• The service you ask for, and our legitimate interest. On this basis we check your message and your links. On the same grounds we keep the log, make anonymous statistics and keep the service secure.
• Your consent. We ask for it for screenshots sent to the AI, for "Warn others" and for notifications on your phone.

You can withdraw your consent at any time. You switch off notifications in the app. You withdraw your consent for screenshots with "Clear" in the app. What we did before that moment remains valid.

How long do we keep data?

• Text of a check: not stored on our server.
• Log: only the data listed above, never the text.
• IP address to limit abuse: only briefly in working memory.
• Statistics: 90 days.
• Reports through "Warn others": at most 30 days.
• Server backups: 7 days, then deleted automatically.
• Push code and language: until you switch off notifications.
• At Anthropic: up to about 30 days.
• On your phone: until you delete it or remove the app.

Your rights

You have these rights:

• to see your data;
• to have incorrect data corrected;
• to have your data deleted;
• to have the use of your data restricted;
• to object to the use of your data;
• to receive your data in a common file format, to give it to someone else.

Do you want to use one of these rights? Send an e-mail to privacy@kloptet.be. We reply within one month.

Please note: we have no accounts and we do not store the text of checks. That is why we usually cannot link data to you. Sometimes we can therefore not carry out your request. We will then explain why.

Making a complaint

Are you unhappy with how we handle your data? Please tell us first. You can also file a complaint with the Belgian Data Protection Authority:

• Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données)
• Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels
• www.gegevensbeschermingsautoriteit.be / www.autoriteprotectiondonnees.be

Children

Kloptet is meant for everyone. Are you younger than 13? Then in Belgium you need a parent's consent for the features for which we ask consent. These are screenshots sent to the AI, "Warn others" and notifications on your phone.

Changes

We may change this privacy policy. If we change something, we will announce it in the app. The date of the latest version is always shown at the top.

Contact

Do you have a question about your privacy? E-mail us at privacy@kloptet.be.