Questions we actually get.

No. You can paste a message at scampilot.de/check and get a verdict instantly. Up to 3 checks per day are free without an account. A free account raises that to 20 checks per day.

Your own forwarding address for suspicious mails, burner aliases for family members, and all your reports in one dashboard. Your daily quota goes up to 2880.

Every report carries a confidence score between 0 and 100. Below 60, Scampilot automatically escalates to a more precise model. On our 30-fixture eval set we hit 100 % accuracy - and never a false "safe" on an actual scam.

It happens. We tune toward caution - better one extra "warn" than one missed "danger". The report shows the specific signals so you can double-check the reasoning. We're a co-pilot, not the captain.

That would be the worst case. It doesn't happen on our eval set - but we don't claim it never will. If something feels off about a "safe" message, trust your gut. And email us - every wrong call helps us improve.

Heuristic keywords are tuned primarily for standard German and English today. The AI analysis handles most dialects and mixed-language mails. Swiss German and strong Austrian phrasing are on the roadmap.

In German data centers (Falkenstein and Nuremberg). Database, object storage, and cache are all in the EU. AI analysis runs through an AI provider under EU Standard Contractual Clauses. More details on the security page.

No - not in the "click-through" sense. The message goes through an automated pipeline, an AI model analyzes it, and the result lands in your report. No one on the Scampilot team reads your mail - unless you explicitly forward one for error analysis.

No. Not "anonymized" or "aggregated" either. Our business model is the future business tier for company integrations - not your content.

In the dashboard at /settings/security/delete. Type-to-confirm, then the deletion cascade runs asynchronously. What remains: a tombstone audit entry to prove to authorities that deletion happened.

Yes - the plaintext message goes to the AI provider for analysis, under its API terms (no training on content). If that's too much for you, you can use heuristic-only mode: less precise, but purely in the EU.

Yes - it's actually the most common use. You create your own account, set up a burner alias like mama@in.scampilot.de, and add a forwarding rule in her mail account. Full walkthrough on the families page.

No - by design. Each account belongs to one person. Multiple people don't share a login; they forward to burner aliases. That protects each person individually, even if one account is compromised.

Scampilot can't prevent clicks - we're not a browser firewall. What we can do: help your mom check before clicking. If something already happened, the browser extension (coming soon) will be the fastest way to check an already-open page against our reputation database.

Yes, at scampilot.de/docs/api. Generated from PHP annotations - always current, no drift between docs and code. Downloadable as openapi.json.

Free for personal use (2880 requests per day, shared bucket across all tokens). For company integrations a business tier is coming - see pricing.

Scampilot falls back to a heuristic and keeps answering. The model_used field becomes heuristic-fallback so your client can decide whether to retry once the AI provider is back.

Add a scampilot entry to your Claude Desktop config with http transport and a bearer token. Full example on the developers page.

No. Scampilot is not open source and cannot be self-hosted. You use it as a hosted service - via web, mail forwarding, Telegram, the browser extension (coming soon), or the API.

Because we're the co-pilot through scam-infested waters - and a friendly mascot invites embarrassing questions more readily than a padlock icon. Senior testers liked the duck. That was enough for us.

A small team in Berlin. One engineer, one security advisor, one UX designer with a seniors background. We build this because our own families needed it and nothing fitting existed.

Today: not directly. We carry the server costs out of pocket, funded by consulting. Mid-term: a business tier for company integrations.

No, and we don't plan to. Telegram and soon the browser extension cover the mobile use cases more cheaply. The web app works offline once loaded.

A public stats page with volume and verdict distribution over the last 30 days. Our own reputation feed of German phishing domains. Heuristics for Austrian and Swiss dialects.