Wary Security Privacy Policy
Last updated 22 June 2026. Published by Natchland.
Wary Security is a desktop app that warns you about fake and malicious websites. We
built it to protect your privacy, not trade on it. This page explains what the app
does with your data, in plain terms.
What the app sends, and why
- Links you check. When the cloud threat feed is on, the web
address you check (by hand, from your clipboard, or via the browser extension)
is sent to our backend so it can be checked against live threat lists. We use it
only to check it. We don't store it, we don't tie it to you and we never sell it.
- Password checkup. Your password never leaves your device. We
send only the first five characters of its scrambled (SHA-1) hash to the
Have I Been Pwned service, which can't identify your password from that. We never
see or store your password.
- Shared ad and tracker list. If you leave the community blocklist
on, Wary sends the bare web addresses of ad and tracker servers it spots (things
like "ads.example.com") to our backend, so the shared list gets better for everyone.
The free browser extension does this too, sending only those bare domains directly.
Each is tagged with a random anonymous id used only to count how many people saw it.
We never send your browsing history, the pages you visit or anything that identifies
you, and you can turn this off in the app's Features page or the extension popup.
- Anonymous error reports. Off unless you turn them on. If you do,
when something in the app goes wrong Wary sends just the error and the part of the
app it came from, tagged with a random id so repeat faults from one machine can be
told apart from many. Before it leaves your device it strips out your Windows
username, any email address and any IP address, and it never includes the sites you
visit. You can turn it off any time in the Features page.
- Everything else is local. The lookalike, typo and brand checks
run on your device and send nothing.
What we don't do
No account needed. No ads. No behavioural tracking, and no analytics that follow what
you do. Error reports, if you switch them on, are anonymous and only describe what
broke. We don't build a profile of you and we don't sell or share your data with anyone
for marketing.
What stays on your device
Your settings and your recent activity list are stored only on your own computer.
They aren't uploaded to us.
Services we rely on
To check links and passwords we use: our own backend (hosted on Railway), the
URLhaus threat feed, the
Google Web Risk API, and
Have I Been Pwned for the password check.
Each receives only what it needs to answer the check.
Children
Wary Security isn't directed at children under 13 and we don't knowingly collect
their data.
Changes
If this policy changes we'll update this page and the date at the top.
Contact
Questions about your privacy? You can contact us through the Wary Security page on
the Microsoft Store.