Plain English. No legal fog. Last updated June 2026.
You paste a link, we scan it, we forget it. No accounts, no cookies, no analytics, no ads, no logs of what you scanned. These aren't promises in a document — they're enforced in the code, and the code is open source so you can check.
Your link is processed in memory only, for the duration of the scan (a few seconds). It is never written to a database, a file, or a log. When the result is returned, the link is gone. Scans use POST requests, so links never appear in server access logs either — and our access log is switched off entirely.
To check a link we query detection services (Google Safe Browsing, VirusTotal,
PhishTank, URLScan.io). The link is sent to those services for the purpose of the check
and is subject to their policies. URLScan submissions are marked private.
Our AI explanation layer never receives your full link — only the domain and the
detection findings.
Uploaded QR images are decoded in memory and immediately discarded — never saved. Pasted message text and recruiter messages are processed the same way: scanned, answered, forgotten.
Set-Cookie header.Honestly: almost nothing. No URLs, no IPs in logs, no identities. Error logs record only the type of an error — never the request that caused it.
MerkShield is open source — the strongest privacy statement is the code itself. If you spot something that doesn't match this page, please open an issue on GitHub. Reports go through GitHub rather than email, so nobody has to hand over an address to get in touch.