What Flggd is, how a verdict is produced, and what happens to a message after it is submitted.
Flggd is operated by Flagged PBC, Inc., a Delaware public benefit corporation, registered at 16192 Coastal Hwy, Lewes, DE 19958-3608, United States.
Flggd also operates in the United Kingdom as FLGGD UK LTD, company number 17182784, registered at 64 Wilton Gardens, Southampton, England, SO15 7QR. The registration can be checked on the Companies House register.
A public benefit corporation is legally required to consider a stated public purpose alongside financial return. That structure is a matter of public record rather than a statement of intent.
A message is checked against the signals inside it, against patterns Flggd has seen before, and against a library of documented scams that Flggd maintains.
The result is a verdict and the reasons behind it.
Red means the message looks like a scam. Yellow means there is reason to be careful and the evidence is not conclusive. Green means nothing was found that looks like a scam.
The reasons matter more than the verdict. A verdict says what Flggd concluded. The reasons let someone judge that for themselves, and let them explain it to the person they are worried about.
Flggd does not claim to catch every scam. No scam detection service does, and any service that says otherwise should be treated with suspicion.
A verdict is an assessment, not a guarantee. A message Flggd does not flag may still be a scam. A message Flggd flags may occasionally be legitimate.
Flggd publishes no accuracy figure. Figures of that kind are easy to state and hard to substantiate, and the honest position is that the work to evidence one has not been completed.
Flggd cannot recover money that has already been sent. No service can. Where money has moved, the bank or payment provider is the first call, and speed matters more than anything else.
Message text and screenshots are kept for no longer than seven days, unless they are needed to investigate a fault.
Details that identify the people running a scam, such as sender addresses, phone numbers and web addresses, are kept. That is the point of submitting: it is what allows the same scam to be recognised when it reaches someone else.
Submissions are not tied to the person who made them. Account holders are known to Flggd because they have an account, and a submission is not linked back to an individual in the library.
Data is stored on Google Cloud infrastructure with encryption and access controls. No system is completely secure, and Flggd does not claim otherwise.
Flggd does not sell personal information.
Flggd sells and shares scam intelligence only in aggregated and anonymised form, with institutions such as banks, researchers and commercial partners. That is Flggd's business model, and aggregated intelligence is what makes the same scam recognisable to a bank before it reaches the next person. Aggregated data does not reasonably identify an individual.
Both of those statements are in the privacy policy and the terms of service, and they are stated here together because they are more useful read together than apart.
Email scanning is off until it is switched on. It requires an explicit consent step before a mailbox is connected for the first time.
Where a Gmail account is connected, Flggd requests read-only access. It cannot send, delete or change email, and it cannot reach anything else in a Google account.
From each message, Flggd reads the sender, the subject line and a plain-text excerpt of the body. Attachments are not opened or stored.
Email is analysed by Flggd's own systems. Email content is never sent to OpenAI or to any other third-party AI provider.
Scan results are stored only on the device, in an encrypted local database, and never on Flggd's servers. They are deleted automatically after 30 days, or after 90 days for people who have opted in to helping improve the detection. They can be deleted at any time in the app, and a mailbox can be disconnected at any time.
Browser Shield reads the page in the browser, on the device. It does not send the text of pages back to Flggd.
It does not collect passwords, login details, typed form values, cookies or clipboard contents, and it does not keep a record of browsing history.
The address of the current site may be sent to a public domain-registration lookup, which is how the age of a site is checked. The content of the page is not included in that lookup.
Contributing scam examples to improve Flggd's detection is off by default and switched on by choice.
While it is on, anonymised copies of emails identified as likely scams are used for training. Personal details are removed automatically before anything is uploaded: names, addresses, phone numbers, account and card numbers, government identifiers, order and tracking numbers, and signatures.
It can be turned off at any time. Material already uploaded has been anonymised and cannot be individually retrieved or withdrawn, which is a consequence of anonymising it properly rather than an oversight.
Donating a complete scam email is separate, requires confirmation each time, and cannot be undone once sent.
You can ask what data Flggd holds about you, and you can ask for it to be deleted.
Email scan records are on the device and can be deleted in the app at any time. Contribution can be switched off at any time. Marketing email can be unsubscribed from using the link in any message.
For anything else, including access and deletion requests, email privacy@flggd.com.
This page is written in plain language. The privacy policy and the terms of service are the binding documents.
Privacy policyTerms of serviceCheck a message and Flggd shows the verdict and the reasons behind it.
Check a message free
Or get the Flggd app
Reviewing Flggd for an institution? Thirty minutes with the Flggd team.
