In short
- No accounts, no tracking, no advertising.
- We do not store IP addresses.
- What you submit is encrypted on your device before it is sent. Our server cannot read it.
- Comments are public once an editor approves them.
- The only cookie is the anti-spam check's, on forms.
What we collect
| When you | What is kept | What is not |
|---|---|---|
| Read the site | Anonymous page-view counts from our host's cookieless analytics. | Your IP address, a profile of you, or anything that follows you to other sites. |
| Send an account, case or evidence | Your text and files, encrypted so we cannot read them on the server; when they arrived; a hash of your receipt code. A contact address only if you give one, and it is encrypted with the rest. | Your IP address, the receipt code itself, or your name unless you write it. |
| Comment | The display name you choose (or “Anonymous”) and your text. Comments are not encrypted, because they are meant to be published after moderation. | Your email, IP address or any account. |
| Send a right of reply | The same as a submission: encrypted on your device. | Your IP address. |
How encryption works
When you press send, your browser creates a new random key, encrypts your text and every file with it (XChaCha20-Poly1305), then locks that key separately to each editor's public key. Only the locked copies leave your device.
Our server stores the result and holds no key that can open it. The editors' private keys are kept offline, with printed backups, and are loaded into a browser only while an editor is reading submissions.
Limits: what this cannot protect
- Our hosting provider sees your IP address. The site runs on a hosting network that sees the address of every connection. We do not store it, but the host processes it.
- A compromised site could serve altered code. Someone who took over this site could change the form so that it sends your words unencrypted. The published hash of the form script lets anyone check the code they received; see below.
- Your own device. Encryption does not protect against someone who can see your screen, your browser history or a shared computer. If that is a risk, read how to submit safely: use a private window, Tor Browser, or a device that isn't yours.
- What you write can identify you. Dates, places and small details can point to the writer even when the name is left out. Editors remove identifying details before anything is published, but think about what you include.
How long we keep things
| Submissions | Until the editors have finished with the matter; encrypted backups expire after a period to be set before launch. A submission cannot be withdrawn once sent. |
|---|---|
| Comments | Approved comments stay with the page they are on. Pending and rejected comments are deleted after a period to be set before launch. |
| Editors' actions | What an editor did with a submission (for example, “counted as corroboration”) is logged for accountability, without its contents. |
| Visit counts | Aggregate numbers only, kept by the host under its own retention policy. |
Legal requests
If we receive a legal demand about a submission, the most we can hand over from the server is ciphertext we cannot read, when it arrived, and the hash of its receipt code. We have no IP addresses to give.
The editors' offline keys could in principle be demanded from the editors themselves. This is one more reason to leave out anything you do not need to tell us.
Checking the submission form
The submission form's script is loaded with Subresource Integrity: your browser refuses to run it if it differs from the version the page expects. We publish the script's hash here so it can be compared with what your browser received, and with copies of this page archived elsewhere.
- Form script hash
- Published with the first release
Contact and data controller
Questions about privacy can be sent through the encrypted form.
- Data controller
- To be named before launch