Limits and privacy: what we can’t guarantee, and what we keep.
Written the same way we write the report: what was checked, what wasn’t, and where the data goes.
What Counterspy can’t guarantee
Never “clean”
Without opening the device, the Gen 3 implant can’t be ruled out. If you don’t open it, nobody can tell you it is clean.
Photos aren’t proof of your unit
Remotely we see what you send. The report says what was checked, not what is true about the device in your hand.
The AI only marks zones
It has not been publicly proven that any AI detects this implant. It flags areas for you to look at; it never decides.
Genuine Check isn’t ours and isn’t enough
Ledger’s check verifies the Secure Element. This implant leaves it intact, so a pass means nothing about it.
The registry is a list of claims
“Reported by N users” is users with photos. “Confirmed” only when a manufacturer, an authority or a laboratory cited in the press confirms it, with the link.
Not affiliated, not advice
Counterspy is independent and not affiliated with Ledger, Trezor or any manufacturer. Nothing here is financial or legal advice.
What we store, and for how long
The check and the report
A check is paid once, 0.2 SOL, before it starts. What we keep on our side is the check id and the payment signature, so the same check doesn’t get charged twice. Your answers, your report and your access are saved in this browser’s local storage so you can come back to them; clearing the site data deletes them. The report keeps the marked zones and a hash, never the photos.
Inspection photos
Photos you upload for analysis are sent to the AI and discarded. Counterspy does not keep them. Only the zones the AI marked (coordinates) and the hash of the report are kept.
Photos you send as evidence to the alert registry
These are kept, because they are the evidence behind “reported by N users”. You will be asked for explicit consent before they are stored. They are kept until the report is resolved and for 90 days at most; then they are deleted.
The AI
Photos you upload for analysis are sent to a third-party AI service that marks zones for you to look at. It never decides, and Counterspy does not keep the photos. If you prefer not to upload photos, the purchase check, the checklist and the migration guide work without them.
Wallets
A wallet connection is only ever used to pay for an inspection. We never ask for a seed phrase, a PIN, a private key or a signature for anything else. Anyone asking for those in our name is not us.
Analytics and cookies
No analytics, no advertising cookies. Local storage is used only for your own progress and reports.
Contact
Write to @counterspy_app on X. If a source in a finding is wrong or outdated, tell us and we fix the finding.