Privacy policy

Draft: this text describes our current technical practices and requires formal legal review before production use (see docs/privacy.md in the repository).

What we collect

Reports you submit (including your email encrypted at rest if provided, never in the clear), a time-boxed hash of your IP for abuse prevention, and optional evidence you upload (re-processed to strip metadata).

What we don't do

We don't publish full email addresses or private individuals' names tied to phone numbers. We never show your IP to anyone.

Analytics & advertising

We use Google Analytics to understand aggregate site usage and Google AdSense to show ads. Both may set cookies and process your IP address and other identifiers under their own privacy policies. You can opt out of Google Analytics with the Google Analytics opt-out browser add-on and manage ad personalization at Google Ads Settings.

Retention

Abuse-prevention hashes are purged after 30 days. Rejected or expired reports have their personal fields purged after 90 days.

Your rights

You can request rectification, erasure, objection, or restriction via our privacy request form.