Privacy Policy
Last updated: October 11, 2026
This policy covers two products: the Phishlight.ai suite and the HumanCore Initiative (HCI) Validator. Both are built the same way — analysis happens on your device, and we do not sell or monetize your data. Each product is described in its own section below.
1. Phishlight.ai
Phishlight is designed with a privacy-first architecture. This section explains, in simple terms, how the Phishlight extension and website handle your data.
Local analysis by default
Core phishing analysis is performed entirely within your browser. Your email content and browsing activity are not sent to our servers for analysis.
No email content transmitted
No email content is transmitted to external servers during offline analysis. The extension examines messages locally on your device to keep your information under your control.
Optional integrations are off by default
Optional third-party threat intelligence services are disabled by default. To enable any integration, you must provide your own API key and explicitly turn it on. You control when and whether external services are used.
We do not sell or monetize your data
Phishlight does not sell, share, or monetize user data. We do not use your personal information for advertising or profiling.
Website data
When you visit the Phishlight.ai website, we may collect basic technical information such as your browser type and IP address to operate and improve the site. We do not link this information to your extension usage.
2. HumanCore Initiative (HCI) Validator
HCI Validator follows the same privacy-first approach, with one difference: it has no optional third-party integrations at all.
No personal or browsing data collected
HumanCore Initiative (HCI) Validator does not collect, transmit, sell or share any personal or browsing data.
What happens when you scan a page or site
When you choose to scan a page or site, the extension reads that page's content and requests the site's own privacy-policy page and response headers in order to rate it. All analysis happens locally in your browser. Scan reports, including the addresses of the pages you scanned, are stored only on your device using Chrome's local storage. You can delete them at any time by removing the extension.
No servers, analytics, advertising or third-party services
The extension has no servers, analytics, advertising or third-party services, and it does not run any remotely hosted code.
We do not sell or monetize your data
HCI Validator does not sell, share, or monetize user data, and does not use your personal information for advertising or profiling.
Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page.
Contact us
If you have questions about this Privacy Policy or our data practices, please contact us at info@samssoft.com.