What we collect

• Account details you give us when you register: email address, name, and optionally organization, department, country and phone number.
• Your password, stored only as a one-way bcrypt hash. We cannot read it.
• Security records: when you sign in, failed sign-in attempts, password resets, and actions taken on accounts and evidence, with the time, IP address and browser identifier involved.
• Evidence you submit, its description and metadata, and a chain of custody recording who submitted, reviewed or changed it and when.
• A session cookie that keeps you signed in for up to 8 hours. We use no advertising or analytics cookies and load no third-party tracking scripts.

Why we use it

• To run your account, including verifying your email and vetting who may contribute.
• To keep the archive trustworthy: every evidence record carries a custody history that courts and investigators can rely on.
• To protect the platform and its users from abuse and unauthorized access.
• To email you about your account: verification, approval, role or address changes, and password resets.

We do not sell personal data, use it for advertising, or share it with data brokers.

Who processes data for us

• DigitalOcean hosts the application and its database in New York, United States.
• Cloudflare carries traffic to the site and filters attacks; it sees requests in transit.
• Resend delivers our account emails.
• Pinata stores submitted evidence files on IPFS.

These providers process data on our behalf. Your data may therefore be processed in the United States.

Evidence is meant to be permanent

The archive exists so that evidence cannot be quietly erased. Evidence is reviewed before it is published, and published evidence, its custody history and the security records tied to it are kept even if you close your account, because their legal value depends on being complete. If evidence you submitted endangers someone, contact us and we will review whether it should be withdrawn from public view.

How long we keep it

• Account details: while your account exists.
• Database backups: about seven days.
• Evidence and custody records: indefinitely, as described above.

Your choices

• Correct your details on your profile.
• Download a copy of your data from profile export.
• Ask us to close your account or delete your personal details. Records that must stay with evidence are kept as described above.

For any of these, or a question about this policy, email [email protected].

Security

Connections are encrypted, accounts are vetted by an administrator before they can contribute, and access to evidence and accounts is limited by role. No system is perfectly secure; if you believe your account or the platform is at risk, email [email protected] right away.

Changes

We will update the date above when this policy changes, and email account holders about significant changes.