Cluttersignal checks the email, message, link, or site in front of you and shows its work. Here’s how it decides, what runs on your device, what’s sent only when you ask, and the security practices behind it.
At a glance
How Cluttersignal decides
Whenever you check something — an email, a pasted message, a link, or a site — Cluttersignal asks the same six questions, then folds the answers into one recommended action and, with cloud analysis on, a 0–100 Trust Score. Here’s what each one checks.
Identity
Reads your mail app’s own verified-sender badge and warning banners, then looks for look-alike, homoglyph, and typosquat domains dressed up as someone you trust.
Relationship
If your mail app marks someone as a first-time sender, Cluttersignal takes that into account — a first-time “your CEO” deserves more caution than a name you actually email.
Threats
Reads scam and phishing language, checks where each link really goes (and, with cloud analysis on, whether it is on a blocklist), and flags attachment names that look like programs, macros, or archives.
Context
Detects password, payment, and one-time-code forms a request is steering you toward and, with cloud analysis on, how old a link’s or site’s domain is.
Privacy
Flags pages asking for credentials or payment and known trackers — suspicious data-collection behavior worth a second look, not a full data audit.
Decision
Folds the answers into one clear next step — verify, proceed, or walk away — and, with cloud analysis on, a 0–100 Trust Score.
Current controls
Specific safeguards we operate today — not certification language we haven’t earned. If a control isn’t on this page, we don’t claim it.
The badge and the first pass of every check run in your browser: wording, look-alike domains, link destinations, QR codes in images, senders you’ve had mail from, and attachment names.
Live link reputation, domain age, and the AI read only happen with cloud analysis on. It’s on by default for new installs, you can switch it off any time, and every result tells you whether anything left your device.
What you send is used only to produce your result and isn’t saved to our database. Our AI provider can’t train on it and deletes it within 30 days (longer only if it’s flagged for misuse). The result stays in your browser.
Traffic is encrypted in transit with TLS 1.3 and data at rest with AES-256. We do not train AI models on your data, and our AI provider is contractually bound to the same.
On every site you open
The badge is worked out on your device. Only the content you explicitly check is sent for a deeper look — and only with cloud analysis on — and isn’t saved to our database.
On-device page signals
The badge reads form fields, links, and page structure locally in your browser to decide what to flag.
Look-alike detection
Catches homoglyph and typosquat domains pretending to be a brand you trust — on your device.
Verdict + badge
Returns No obvious threats detected, Use caution, Suspicious, or Dangerous. Clean and caution results show a brief badge that fades; suspicious and dangerous show a warning that stays until you dismiss it.
With cloud analysis on — domain checks
When you check a link or a page, looks up how old its domain is and checks its live reputation.
With cloud analysis on — the written report
The written report and a 0–100 Trust Score for what you explicitly check. What you send is used only to produce your result and isn’t saved to our database. Our AI provider can’t train on it.
Cluttersignal is a second opinion — not a guarantee
Cluttersignal is a best-effort check. No automated screening catches every threat — it will sometimes miss one and sometimes flag something genuine.
Treat it as one of several defenses — alongside your provider's spam controls, your own judgment, and any organization-level security tooling — not as a replacement for them. We do not warrant that Cluttersignal (or any AI-powered feature) will detect every fraudulent or unwanted message. See Terms § 7 for the full disclaimer.
Data handling
Three plain answers: what we keep, why we keep it, and what you can switch off on your own.
Your Clutterstrike account and Signal Pro subscription details. Not the pages you visit. What you send for a check is used only to produce your result and isn’t saved to our database. The Privacy Policy has the full list.
Running the checks you ask for, and running your account and billing.
See every request the extension has made in its settings, switch cloud analysis on or off at any time, cancel Signal Pro from your account page, and remove the extension whenever you like.
If you find a vulnerability or something that feels unsafe, contact the team at [email protected] and include enough detail for us to reproduce and respond.