Phishy is a Chrome browser extension that detects phishing and malicious websites in real time. This privacy policy explains what data Phishy collects, how it is used, and how it is protected.
What data we collect
Phishy collects and processes the following:
URLs visited — the URL of the webpage currently open in your active tab is sent to our backend server for phishing analysis.
Anonymous installation ID — a randomly generated identifier (not tied to your name, email, or any personal account) is created when you install the extension and stored locally in your browser. This ID is used solely to keep your scan history and settings separate from other users of the extension.
VirusTotal API key (optional) — if you choose to provide your own VirusTotal API key, it is stored on our backend, associated only with your anonymous installation ID, so the extension can perform secondary phishing checks using the VirusTotal service.
Whitelisted domains — any domains you choose to whitelist are stored, associated only with your anonymous installation ID.
What we do not collect
Your name, email address, or any personally identifiable information
Page content, text, images, or files from the websites you visit
Passwords, form data, or any information you type into websites
Your location, IP address for tracking purposes, or device information
Keystrokes, mouse movements, or other user activity data
How we use your data
The URL of each page you visit is sent to:
Our own backend server, which runs a machine learning model to classify the URL as safe or malicious.
The VirusTotal API (only if you have configured an API key), as a secondary check.
Scan results are stored so that Phishy can instantly show you the safety status of a page you've visited before, without re-scanning it every time.
Data sharing
We do not sell, rent, or share your data with third parties, except:
URLs are sent to VirusTotal (a third-party service) solely to perform the phishing check you have opted into by providing an API key.
We do not use your data for advertising, profiling, or any purpose unrelated to phishing detection.
Data storage and security
Your scan history, API key, and whitelist settings are stored on our backend server, associated only with your anonymous installation ID — never with your name or any other personally identifying information.
Your choices
You can clear your scan history at any time from the extension's popup.
You can remove your VirusTotal API key at any time.
Uninstalling the extension stops all further data collection.