What happens to what you check
A product that asks you to paste a suspicious message has to be clearer about its own handling than the thing it is warning you about. Here is all of it.
What TrustLens does
- Checks the text you paste, on the server, to run the rules and the link analysis.
- Keeps your reports in this browser so they open offline and without an account.
- Fetches a page you explicitly asked it to check, if you turn live link checks on.
What it does not do
- Read your messages automatically. There is no notification access in this web version.
- Upload your message text to the campaign network. Only you can share indicators, and only deliberately.
- Export your contacts, track your location, or use your text to train a model.
- Sell anything, or show advertising based on what you check.
What it genuinely cannot do
The limits are part of the product, not fine print.
It cannot read WhatsApp
WhatsApp messages are end-to-end encrypted. No website can read them, and any product claiming otherwise is either wrong or doing something it should not. Paste or share the message instead.
It cannot find where a sender is
A phone number’s country code is not a location. Nothing in a message reveals where the person physically is, so TrustLens says "physical origin not established" rather than guessing.
It cannot certify that something is genuine
No warning signs means our rules did not match — not that it is safe. The report always says which checks ran and which did not.
It cannot recover money
If a payment has gone, TrustLens points you at 1930 and your bank fast. It has no power to reverse a transfer, and will never suggest it does.
On encryption, precisely
Traffic to TrustLens is encrypted with HTTPS, and your saved reports sit in your own browser. That is not end-to-end encryption, and we will not call it that: when you ask the server to analyse text, the server can read that text. Saying otherwise would be the same overclaiming this product exists to catch.
Your data, and deleting it
Everything stored on this device, with a delete button that really deletes.
If you ever share to the campaign network
It would be a normalised domain, a keyed token standing in for a number, a payment handle and a wording signature — never your message. That sharing is opt-in and is not switched on in this build.
If money has already moved, privacy is not the priority — call 1930 and your bank first, then come back.