Last updated: October 12, 2026
We built ThouShaltNotClick to protect people, not to exploit them. In the ThouShaltNotClick browser extension, your email is analyzed on your device and the content never leaves it. You may also opt in, per email, to deeper AI analysis; our AI partner stores nothing. We keep body text in four narrow cases — a report you submit, an email the AI judges dangerous, an admin telling us we scored one wrong, and short phrases lifted out of confirmed phishing so our detector learns them — each described in detail below. When AI catches a phishing attack, only the sender and subject are shared with your organization. If you use the support chat on this site, what you type goes to our AI provider to compose the reply and the transcript is stored — that too is described below. We use one privacy-first analytics tool, configured cookieless and anonymous, and signed-in student sessions are excluded. We will never sell your data to anyone, ever. This isn't a legal loophole — it's a promise.
Footnote: we also publish a separate Outlook add-in, currently in beta. Microsoft's add-in platform cannot run our analyzer on the device, so it sends up to 3,000 characters of the open email to our servers to be scored. The on-device statement above describes the browser extension; details on the add-in are below.
| Data | Why | Stored Where |
|---|---|---|
| Name & email | Your account | Our secure servers (encrypted at rest) |
| Password | Authentication | Bcrypt hash only — we never see your password |
| Simulation results | Track if you caught or clicked the phishing test | Our server |
| Training progress | Know which courses you completed | Our server |
| Extension install status | Help admins see who has protection active | Our server (yes/no + last seen) |
| Online Kindness stats | Aggregate counts of polite language signals | Your device + server (aggregate only, daily sync) |
| AI Analysis data (opt-in only) | Deeper phishing analysis when you click the AI button | Sent to our AI service in real time; it stores nothing. We log the score and verdict. Body text is kept only when the AI scores the email below 30 — see “AI-Enhanced Analysis” below. |
| Reported emails (you press Report) | So your admin can judge what you flagged | Sender, subject, link URLs, message headers, and a 500-character body excerpt. The excerpt is erased after 30 days. |
| Phishing samples (AI score below 30) | Learn how attacks are written; improve detection | Up to 3,000 characters of body, with your own name and addresses stripped out. Filed under the sender. Visible only to TSNC platform admins. Erased 30 days after that sender was last flagged. |
| “You missed this phish” reports | Admin-only: tell us our scoring got one wrong | Sender, subject, and a 500-character body excerpt — only when an admin chooses to send it. Excerpt erased after 90 days. |
| Learned phishing phrases | Teach the detector the wording attackers reuse | 3-to-5-word fragments of the subject and 500-character excerpt of reports an admin confirmed as phishing, kept with the IDs of the source reports and organizations — no sender, no recipient, no reporter. Identifying details are removed before the fragments are cut. See “Learned Phishing Phrases” below. |
| Support chat on this website | Answer your question; hand off to a human if asked | What you type, our replies, your IP address and browser string — and, if you ask for a human, the name, email and note you enter. Sent to Anthropic to compose each reply. Deleted after 90 days unless you escalated to a human, in which case it is kept. |
| Community threat alerts | Protect your org when AI confirms a phishing attack | Sender, subject, and the AI's written explanation — no body text |
| Org email domains | Recognize emails from colleagues (familiar sender detection) | Domain names only — cached locally on your device |
| Sender familiarity tally | Notice when a sender is writing to you for the first time | Sending domains and a count each — on your device only, never sent to us |
| Directory address fingerprints (Google Workspace schools) | Spot mail that claims to be from your school but comes from an address that does not exist | Our server: a one-way fingerprint of every address in your Google directory, students included. No addresses, no names, no account details, and nothing marks which are students. An unknown sender's address is held for at most a day while we check it with Google. Deleted when you disconnect. |
| Sender behavior profile (Complete Coverage) | Notice when a familiar sender suddenly acts unlike themselves — the sign of a hijacked account | Aggregate numbers per sending domain: how many messages your organization has received from it, how many people it usually writes to at once, whether it normally sends attachments, whether it has ever asked about payment, and how often its mail arrives without you on the To line. No message content, no subjects, no attachment names, no sender addresses, no record of individual messages. Staff mailboxes only — never collected for student or parent accounts. |
| Free course (/learn) — only if you give an email | Send your link that saves your place and your certificate; print your name on the certificate | Our server — see “Free Course (/learn)” below |
When you open an email in Gmail, our extension analyzes it for phishing indicators using a local analysis engine (analyzer.js) that runs entirely inside your browser. The email content is never transmitted to our servers or any third party. The trust score, findings, and recommendations are all computed on your device.
Footnote — the Outlook add-in (beta). We also publish a separate Outlook add-in, currently in beta. It does not work the way the extension does: Microsoft's add-in platform gives us no way to run our analyzer on your device, so when you open the TSNC panel on an email the add-in sends the sender, subject, link URLs, and up to 3,000 characters of the body to our servers, where the same scoring engine runs. That is its normal, default behavior every time you open the panel — there is no separate opt-in for it. We score the message and return a verdict; the body is not written to our database on this path. The cases where body text is stored are listed below and apply to the add-in exactly as they apply to the extension. The on-device statement above describes the browser extension.
When you install our extension, Chrome tells you it can “read and change all your data on all websites”. The extension does request access to every site, not only Gmail and Outlook. Here is why, and what it does not mean.
The full permission-by-permission breakdown is on our Security page.
When you press Report Suspicious, we send and store thesender address, the subject, the link URLs, the message headers (up to 16 KB), and a 500-character excerpt of the body. The excerpt exists so your administrator can review what you flagged without having to ask you to forward the email. It is visible to administrators at your organization. The excerpt is erased 30 days after the report; the sender, subject and verdict remain. If an administrator confirms the report as phishing, short phrases from that excerpt — with identifying details removed first — are kept separately as detection signals (see Learned Phishing Phrases below). Report Safe sends the sender and subject only.
You may optionally click the “AI Analysis” button on any email's trust badge for a deeper, AI-powered review. This is entirely voluntary and requires your explicit action each time — it never happens automatically. When used:
A clear disclaimer (“Email content was sent to our AI for this analysis”) is shown every time you use this feature.
Your organization's email domains (e.g. yourschool.edu) are synced to the extension so it can recognize emails from colleagues. The synced list itself is domain names only — no staff names or addresses. Internal senders receive a small trust score boost. This runs locally in your browser using the cached domain list.
The extension also keeps its own tally, on your device, of how many times each sending domain has written to you. It is what lets the score say this is the first time anyone from here has ever emailed you — the strongest single signal there is against someone impersonating a colleague or a supplier. It holds domains, a count, and a date. Not addresses, not names, not subjects, not messages. It is never transmitted to us or to anyone else, and it goes when the extension goes.
When AI analysis identifies an email as clearly dangerous (score below 30/100), the sender address and subject line only are stored in our database and shared with other members of your organization. This protects your colleagues from the same phishing attack.
The Online Kindness Score monitors your communication patterns across email, chat, and AI platforms for polite language signals (such as greetings, gratitude, and considerate phrasing). This analysis runs 100% in your browser. Your actual messages, emails, and conversations are never recorded, transmitted, or stored. Only an aggregate kindness grade (Average, Good, or Excellent) is synced daily to the server for organizational leaderboards if you are part of an organization. Organization administrators can disable this feature for their organization.
When you manually scan a suspicious URL, that URL is sent to our server for real-time threat analysis — similar to how Google Safe Browsing works in every web browser. The URL is processed immediately and never stored, logged, or associated with your account. No page content, browsing history, or personal data is included.
Administrators have a button to tell us our scoring got one wrong — that a real phishing email slipped through with a good score. Because we cannot diagnose that without seeing what we mis-scored, that report includes the sender address, the subject, our scores, and a 500-character excerpt of the body. This is the third of the four places we hold body text. It is never automatic — an administrator has to choose to send it — and it goes only to ThouShaltNotClick's own engineering team, never to another school. The excerpt is erased 90 days after the report — longer than the 30 days we give a staff report, because this queue is reviewed by hand and infrequently. Administrators who would rather not include the excerpt should describe the email in words instead.
Attackers reuse wording. When an administrator marks a report as confirmed phishing, we run its subject and its 500-character excerpt through a phrase extractor and keep the most distinctive 3-to-5-word fragments, word for word, as candidate detection signals.
The chat bubble on thoushaltnotclick.com is answered by an AI assistant, not a person, and it is not a local feature — it is the one place on this site where what you type is sent to a third party as you type it.
The retention periods above are enforced by jobs that run daily. You can always ask us to purge something immediately at privacy@thoushaltnotclick.com.
Schools may optionally enable a Content Filter that blocks categories of websites on managed devices. It is off by default — most users are never affected. When a school turns it on, the extension blocks sites locally on the device (your browsing is not sent to us to be filtered) and records policy events only: attempts to reach a blocked site, and staff “proceed anyway” bypasses (domain + category + time), shown to administrators as aggregate counts by default. It does not record your general browsing — sites that aren't blocked are never logged. Full terms are in the Content Filter Addendum.
We use one third-party analytics tool — PostHog — and we run it locked down: cookieless (no tracking cookies, so no consent banner), anonymous by default (we never attach your name or email to analytics events), no session recording ever, and it honors your browser's Do Not Track setting. Signed-in student sessions are excluded entirely. That's the whole list. No Google Analytics. No Facebook Pixel. No ad networks. No data brokers. No advertising or marketing trackers of any kind. You can verify this yourself: the analytics configuration is plain, readable source in our web app, and the browser extension ships no analytics at all — its privacy commitments are embedded directly in the source code of every file.
Our free course, Anatomy of a Scam, opens without an account, a login, or an email address. If you never give us an email, we keep no course record about you: your place in a chapter is saved only in your own browser. (The anonymous, cookieless analytics described under “Analytics & Third-Party Tracking” applies here as on every page.)
What we collect, and only if you give us your email (to save your place across devices or to earn the certificate):
Certificates are verifiable. Each certificate has a number and a verification link. Anyone who has the number can see the name on the certificate, what it covers, and the date it was issued — never your email address.
What we never do with it. Taking the course never enrolls you in phishing simulations. We do not sell your information, and we do not share it with your school, employer, or anyone else. Your IP address is used only to rate-limit the page against abuse: it is held in a short-lived counter that is cleared within about two days, and it is never stored with your course record.
How long we keep it. Your link works for 90 days; if it runs out, ask for a new one with the same email and your progress is still there. If you do not earn the certificate, we delete your record about 30 days after your link expires — but if you have saved progress, we keep it for 180 days after your last activity on the course (saving progress or asking for a link), so you can come back and finish. If you earn the certificate, we keep it, and your course record with the email it was issued to, so the certificate stays verifiable, until you ask us to delete them.
Unsubscribing and deletion. If you ticked the updates box, the email with your link includes an unsubscribe link, and so will every updates email; unsubscribing does not affect your certificate. To unsubscribe another way, or to have your course record and certificate deleted, email privacy@thoushaltnotclick.com.
For schools using ThouShaltNotClick, we store organizational data necessary to run phishing simulations and training: staff rosters (name, email, role), campaign results, and training completion records. This data is accessible only to authorized school administrators and is never shared with other schools, organizations, or third parties.
Sender address check (Google Workspace schools). If your school connects Google Workspace, we keep a one-way fingerprint of every address in your Google directory — every person's account, students included, plus aliases and groups — refreshed once a day. A fingerprint cannot be turned back into an address; it only tells us whether an address we are shown is in your directory. Nothing we keep marks which addresses belong to students. We store no address, no name and no account details — only the fingerprint and whether it is a person's address or a group's. When mail claims to come from your domain from an address that is not in the index, we hold that address for at most a day while we check it with Google, then delete it; we keep only its fingerprint and Google's answer, for 7 days. If your directory grows too large to index (more than 200,000 accounts or more than 80,000 groups), we stop using it within five minutes, and within about ten minutes we delete every fingerprint and every stored answer we held for it; an address still waiting to be checked is deleted without being checked. While it stays too large we keep no addresses and no address fingerprints for it — only the number of accounts and groups we counted. All of it is deleted when you disconnect Google Workspace.
Organization-wide benchmarking (e.g. Diocese-wide) uses anonymized, aggregated statistics only — click rates and catch rates averaged across schools. No individual staff member's data is ever visible to other schools or the parent organization.
You can request complete deletion of your account and all associated data at any time by contacting us. School administrators can remove staff members from their roster, which removes their simulation and training data. Online Kindness data and the extension's on-device sender tally are stored locally on your device and can be cleared by removing the browser extension. Community threat alerts you contributed will be removed when your account is deleted.
SMS verification is an optional security feature. We send text messages only when you have explicitly opted in from your Security Settings page by ticking a standalone consent checkbox. SMS opt-in is never a requirement for using ThouShaltNotClick — you can use the platform without it.
What we send. One-time 6-digit verification codes when you log in or perform sensitive actions on your account. We do not send marketing, promotional, or bulk SMS messages of any kind. Message frequency varies based on how often you log in — typically a few messages per month per active user. Message and data rates may apply per your carrier's plan.
What we store. Your phone number is stored only while SMS verification is enabled on your account. We also record the date and IP address of your initial opt-in (TCPA compliance) and the version of the consent text you agreed to. Phone numbers are never sold, rented, or shared with third parties for marketing.
How to opt out. Reply STOP to any verification message — your number is immediately removed and SMS verification is disabled. You can also disable SMS verification from your Security Settings page. Reply HELP for help. We will never charge you to opt out, and we will never message a number that has opted out without a fresh, explicit opt-in.
SMS messages are delivered through Twilio, our verified communications partner. For full SMS program details, see the SMS Verification Policy.
A ThouShaltNotClick school account is created with staff coverage only, and in that default state we store no student names and no student records of any kind. The core platform — phishing simulations and staff training — is built for adult staff and teachers.
If your school connects Google Workspace, the sender address check described above also applies to students: we keep a one-way fingerprint of every address in your directory, students included. A fingerprint cannot be turned back into an address, and nothing we keep marks which ones are students. If mail arrives from an address on your domain that is not in the index yet — a student account created since the last daily read, for example — we hold that address for at most a day while we check it with Google, then delete it.
Student coverage is a separate add-on — either purchased, or granted to your school under a contract with us. No student record is created anywhere in our system unless both of the following are true. Neither one alone is enough, and if we cannot verify either one, we store nothing (the sender address check's fingerprints, described above, are not student records — nothing in them names anyone or marks a student):
Both are checked on every path that could store a student's name, by one shared gate. There are two such paths: a directory sync, which additionally requires an administrator to have designated a specific directory group as a Student group; and a parent invitation, where a parent creating their account types their child's first name, last name and grade so the school can link them. If the gate refuses the parent path, the parent's own account is still created normally and the child's name is discarded before it is written anywhere — including our logs, which record the refusal but never the name.
There are three different things that can exist for a student, and they hold very different amounts of data. Conflating them is the sort of thing a privacy policy should not do, so here they are separately.
0. The parent-invitation link. The smallest of the three: a parent's account, the child's first name, last name and grade as the parent typed them, and the school it belongs to. Nothing else, and no login for the child.
1. The roster record (what a directory sync creates). For each student in a designated Student group we store first name, last name, school email address, and grade level, plus whether the record is still active. That is the complete list for a roster record. It has no login, no password, and no activity attached to it. We do not collect student browsing history, message or email content, grades, test scores, academic records, disciplinary records, location, biometric data, or device identifiers.
2. The student account (only if your school issues students their own logins). A student account is a real account, and it accumulates what any account accumulates. It is not limited to the four roster fields. Alongside their name and school email it can hold:
If that last point is not what your school wants for students, the controls are yours: do not issue student logins, or do not deploy the extension to student devices, or turn Online Kindness off for your organization.
Phishing simulations: staff by default, students only if your administrator turns them on. Simulations are addressed to the staff target list. Student participation is a separate decision that belongs to your school's administrator and is off by default for every organization — we do not enable it, and it does not switch itself on because a student appears on a roster. When a school turns it on, students get their own campaigns on their own send volume — set independently of the staff cadence — drawn only from templates an administrator has marked age-appropriate. Adult-financial lures (payroll and direct-deposit changes, wire transfers, vendor and invoice fraud, tax, benefits, banking and W-2 scams) are never sent to students, even if someone tags one of them age-appropriate.
Students are held out of staff campaigns automatically. The check runs when a campaign is built and again when it launches, and if we cannot tell who on a roster is a student, the campaign does not launch. If you think a student received a simulation, write to privacy@thoushaltnotclick.com and we will tell you what happened.
Student coverage is governed by additional terms — the Student Coverage & Student Data section of our Organization Terms of Service — which apply on top of the base agreement and set out the school's consent obligations before any student is added.
Separately, some schools deploy our optional Content Filter to student devices. The same controller relationship applies, and the school is responsible for any parental notice or consent required before deploying it. We practice strict data minimization there too: the filter records only blocked-site attempts (never general browsing), defaults to aggregate counts, and is governed by the Content Filter Addendum.
Questions about our privacy practices? Email us at privacy@thoushaltnotclick.com
“Every person's data deserves the same care and respect we owe every person.”
That's not just our policy — it's our promise.