Safe practice. Clear about privacy.

No. A link in a practice email leads to a short lesson on our own site or, if your company has turned on practice sign-in pages, first to a practice sign-in page. Either way, nothing you type is ever sent or stored: it never leaves your device, and we never see it. We only record that something was entered, never what. We never ask for real bank details or money. Before any practice email is sent, our system checks it and throws it away if it contains a real web address, email address or phone number.

Only people who agreed to it. Employees get an invitation explaining the training, and accept it themselves, before anything is sent to them. Nobody can say yes on someone else's behalf.

Yes, at any time. Withdrawing consent stops all practice emails for that person straight away, and the personal details used to write them are deleted at the same moment.

No. We only see an email when you report it yourself, with the Report a Canary button in Outlook or by forwarding it to our report address. For practice emails we only know how you responded: whether you reported it, clicked it, or did nothing yet. When you report a practice email with the button in Microsoft 365, the button moves that one email to a Reported folder in your own mailbox, with permission you or your organisation gave. It does not read your other emails.

If it isn't one of our practice emails, our system gives it a quick check with fixed rules: does the sender pass email authentication, does the name match the address, do links go where they say, is there a risky attachment. No AI is used for the check, so the email is not shared with any AI provider for it. (The one exception: if you send the report to your admins and they confirm it is phishing, they can press “Make a practice exercise”. Only then do its subject and an excerpt go to our AI, with addresses, links, numbers and the names in greetings and signatures removed first. The AI writes a short theme from it, an admin checks and edits that theme, and only then is it used for new practice emails to the rest of the team, never to you.) You immediately see which warning signs we found, and that check is yours alone: your company's owner and admins only get the report if you choose to send it to them. If you don't, nothing personal is kept once the report window closes (within an hour). If you do, we keep the subject, sender, the first part of the text and the check's result for 90 days. If your admins confirm it's phishing, they can warn the rest of the team about it: that email quotes the subject and sender, never who reported it. Attachments are never stored.

Yes, and it only rewards reporting. You earn points for reporting practice emails (more for harder ones), and for real emails once your admins confirm they were phishing. Nobody ever loses points or appears on it for clicking. After reporting you briefly see the top five and your own place. Your company decides how others appear there: by first name and the initial of their last name, as “Colleague”, or not at all, with the leaderboard switched off. The same choice applies to the season leaderboard and the weekly games on your dashboard. It only counts the last 90 days. Whatever the company chooses, its owner and admins see the top ten by name on their Reported emails page.

For your account: your name, email address and password (stored only as a secure hash, so nobody can read it). To make practice emails realistic you can add optional details: your job or situation, city, employer, the services you use, an age group and a short note. For each practice email we store when it was sent and how you responded. For companies we also store the company details the owner enters. Your account's security log (sign-ins, failed sign-ins, password and two-step changes) and your company's audit log (what the owner and admins changed) record the IP address each entry came from, and are kept for one year. To stop abuse we also count requests per IP address for up to an hour, in memory only. Our hosting and network providers keep ordinary access logs, with IP addresses, under their own terms.

Yes, if it chooses to. A Microsoft 365 admin approves it and picks one group, for example all staff. scamcanary then sees the names of the company's groups, so the admin can pick one, and once a day reads who is in the chosen group: name, work email address, job title, department and whether the account is switched on. Someone new gets an invitation, and no practice emails until they accept it; someone who leaves the group is paused. Only the people who end up on the team are stored, nothing else from the company's directory, and scamcanary gets no access to anyone's mailbox. The company can stop it at any time, in scamcanary or in Microsoft.

You can always see your own results. At a company, the owner and the admins they appoint see each employee's results (sent, reported, clicked) for coaching, and can see and edit the details used to personalise that person's practice emails. Nobody else at scamcanary's customers can see your data.

The personal details used to write practice emails are wiped automatically 90 days after they were last updated; practice emails then continue without them until they are filled in again. Account details and results are kept while the account is active. You can ask us to delete everything at any time.

They see which modules you have finished and when, and the points that come with finishing. They never see what you answered inside a module, because that is not stored at all. The questions are there to help you learn, and getting one wrong first is part of how the modules work.

No. We don't sell or rent data, we show no ads and we use no advertising trackers. To see how our website is used, we count visits ourselves, without cookies and without an outside analytics service: the page, the website you came from, your country, the type of device and the language. Counting visits never stores your IP address. A code that changes every day lets us count unique visitors for that day only, so nobody can be followed from one day to the next. We don't count signed-in people or anything inside the dashboard, and we skip browsers that ask not to be tracked (Do Not Track or Global Privacy Control). Visit counts are kept for 13 months. When you sign up, we note with your new account which website or campaign that visit came from, so we know what brings people to scamcanary. Even our fonts are served from our own website, so your visit isn't shared with third parties.

Railway hosts the application and its database in its European region (Amsterdam). Microsoft 365 hosts our [email protected] mailbox, so an email you forward there passes through Microsoft on its way to us. Cloudflare protects the website and network traffic. Resend delivers our emails from its European sending region (Ireland). Anthropic's AI writes the text of practice emails. For that it receives the recipient's first name, job title and department, the optional details above, the company's name and sector, and the names, job titles and departments of up to twelve colleagues (and of people at sister companies the recipient works with), so an email can come from or mention a real colleague. Never passwords or results. When an admin turns a reported phishing email into a practice exercise, Anthropic receives its subject and an excerpt, with links, email addresses, phone numbers, account numbers and the names in greetings and signatures removed first. When an admin asks scamcanary AI for a summary or a question, Anthropic receives only totals for the company and its departments, with the departments renamed, plus the question itself with anything that looks like an email address, phone number or web address removed: no names and no email content, and we do not store chat conversations. Otherwise Microsoft is only involved when a company uses it with us: the Outlook add-in, the Microsoft 365 sync and signing in with Microsoft. Signing in with Google goes through Google. Some of these providers are based in the United States.

Send us a message through the contact page and we will handle your request. Withdrawing consent in your settings already deletes your personal details immediately.

All traffic is encrypted and browsers are told to only ever use a secure connection. Passwords are stored as strong one-way hashes. Repeated failed login attempts temporarily lock the account, new accounts confirm their email address, and resetting your password logs you out on every device. Login sessions and reset links are stored in a form that is useless if someone copied our database.

Every page and action checks that you are allowed to see that company's or person's data. The website sends strict security headers that block injected scripts and prevent other sites from framing our pages. Sending is limited per account to prevent abuse, and we regularly review the code for security issues.

Please tell us through the contact page and don't share it publicly until we've fixed it. We take every report seriously and will get back to you.