Privacy at Gmork

Gmork Scam Guard, the browser extension

Gmork Scam Guard is a browser extension for Chrome and Edge that warns you about scams. Its built-in rules run on your computer.

What it reads, on your computer

• The email you have open in Gmail or Outlook on the web: sender, subject, text and links of that one email.
• The chat you have open in Facebook Messenger, WhatsApp Web or Google Voice: the latest incoming messages and their links. Never what you type, and never other chats.
• Sign-in and payment pages: the structure of the page (its address, title, logo text, which kinds of boxes it has and where the form sends your details) to spot fakes. It never reads the values you type, such as passwords or card numbers.
• Other pages: visible text, headings and buttons, to spot fake support pop-ups, look-alike addresses and gift card buy or send pages.
• Downloads: the file name and the address of a download, to spot remote-control apps (like AnyDesk or TeamViewer) pushed by scam pages. Gmork can pause such a download and asks you before it continues. It never opens or uploads the file.

What the optional AI check sends

The AI check is off until you turn it on and agree. When it’s on, Gmork sends a cleaned-up copy of only the open email, the latest incoming messages of the open chat, or a short summary of a sign-in or payment page, through gmork.com to our AI provider (OpenAI) for a second opinion. Email addresses, phone numbers and long numbers are removed first. Links are cut down to their domain name, and names Gmork can recognize (the sender’s name and names after greetings and sign-offs) are replaced too. Questions you type into Ask Gmork are cleaned the same way.

Using your own AI key

Advanced option: if you choose “Your own OpenAI-compatible key” in Settings, the same cleaned-up text goes directly from your browser to the service address you entered, under your account with that service, instead of through gmork.com. gmork.com doesn’t see it, and that service’s own privacy policy applies. Your key is stored only in this browser.

Sender website check

For emails from senders Gmork doesn’t already know (not free email providers like gmail.com, well-known companies, sites on Gmork’s verified list or senders you marked as trusted), Gmork Scam Guard sends gmork.com only the sender’s bare domain name (for example, example.com). It never sends the email, your address, the sender’s name or any link path. gmork.com looks the domain up in public DNS, opens its home page the way a visitor would, and checks public registration records through rdap.org (which receives the domain name) to tell you whether it exists, has a working website, forwards to a different website, or was registered recently. gmork.com keeps the domain and that result for up to 7 days so repeat lookups are fast, without any install ID or other information about who asked. Your browser keeps the result for up to 24 hours. You can turn this check off in the extension’s Settings under “Sender website check”. In HIPAA-safe mode these bare-domain lookups are the only lookups Gmork makes.

What gmork.com stores

• A random install ID and a hashed install token (we can’t read the token itself), the extension version and when it was last used.
• Daily counters per install: how many checks and questions, how much AI time they used, and how many failed. Unless you turn it off in the extension’s Settings, also how many warnings Gmork showed (by level and type) and how often you tapped “helpful”, “annoying” or “I changed what I was going to do”, with the extension version, language and plan. Never which websites, senders or messages they were about.
• If you connect a paid plan, we link that install to your account email so we can support you.
• Nothing else: gmork.com doesn’t store your messages, the pages you visit, your answers or your questions.

OpenAI may keep a request for up to 30 days to check for abuse, then deletes it. It doesn’t use these requests to train its models.

Family alerts (optional, Family plan)

If you add a helper, Gmork Scam Guard sends gmork.com the kind of alert, how serious it is, the website's domain (you can turn this off), your language and the time, so we can email your helper. We keep your helper's email address, whether they confirmed, and daily counts of alerts sent. We don't keep the domain or any message or page content. Your helper can stop the alerts with the link in every email.

IT alerts (optional, Workplace plans)

If a Workplace plan owner adds IT contacts, browsers on that license send gmork.com the kind of warning (a red warning, continuing past a warning, or agreeing it was risky, with a broad category such as “fake sign-in page”), the time and the time zone, so we can email those contacts. They never send the email, its subject or sender, web addresses or page text, and this is the same with HIPAA-safe mode on. We keep the contacts' email addresses and whether they confirmed, a short send log for rate limits (2 days) and daily counts per alert type. Contacts can stop the emails with the link in each one.

What stays on your computer

Your settings, your skip list and a short history of the warnings Gmork showed you (kept for 30 days or less, you choose) stay in your browser. No browsing history, no screenshots, never passwords. Removing the extension deletes them.

What we never do

• We don’t sell or rent your data, and we don’t use it for advertising.
• We don’t read what you type into pages or chats.
• We don’t share data with anyone except the AI provider above, only when you’ve turned the AI check on, and public DNS and registration lookups of bare domain names for the sender website check.

HIPAA-safe mode

HIPAA-safe mode (Workplace plans): when the plan owner turns it on, browsers on that license make no AI requests, and gmork.com refuses AI requests from them. The only things they send are bare domain names for sender and link checks, the license check, the daily warning counts and, if the owner added IT contacts, IT alerts (the kind of warning and the time, nothing from the message or page). This mode is not a HIPAA certification and doesn’t make an office compliant on its own.

Gmork Scam Guard’s use of information it receives through the Chrome extension APIs follows the Chrome Web Store User Data Policy, including the Limited Use requirements. We use that information only to provide and improve Gmork Scam Guard’s scam warnings, we don’t transfer it except as described above, and we never use it for advertising, credit or lending decisions.

Gmork website monitoring

Gmork’s website monitoring service checks websites you run, from the outside, the way a visitor or a search engine would.

• Account data: your name, email address and a hashed password, your organization, team members and plan.
• Check results: for the websites you add, the results of checks (availability, timings, changes, SEO, security headers, signs of a hack), with screenshots and page fingerprints. Journeys stop before payment and never fill card or password fields.
• Free public checks (hacked check and security headers checker): the address you checked and the result, with a hashed IP address used only to limit abuse.
• Email: alerts, reports and invitations are sent through our email provider, Resend, which receives the recipient address and the message.
• We don’t sell this data or use it for advertising. You can ask us to delete your account and its data at any time.

Ads on gmork.com

Our public web pages use Google Tag Manager and Google Ads tags to measure how our ads perform, for example whether a visitor who clicked an ad added Gmork Scam Guard or started a trial. Google may set cookies for this. We send Google only the event (like “started a trial”), the page and the plan: never your email, your name or anything you type, and we don’t use enhanced conversions. In the European Economic Area, the UK and Switzerland these ad cookies are off by default. The tag isn’t used in the Scam Guard extension, your dashboard or your account pages.

Contact

Questions, or want your data deleted? Write to security@gmork.com. For Scam Guard, you can also remove the extension at any time, which deletes everything it kept on your computer. See how Gmork Scam Guard protects your privacy.