Privacy

Pre-launch privacy notice, subject to owner and legal review before public release. We claim no legal certification or completed compliance.

Reports process the allowed public profile fields, immutable ID, category, note, and public post evidence you consent to send. An HMAC of the network prefix supports abuse prevention; raw IP addresses are not stored in report records.

The extension uses a pseudonymous install key. We do not read X cookies, authentication tokens, or DMs. Private signing keys stay in the extension. Display preferences are local or browser-synced.

Volunteer applications contain name, email, handle, and experience. Appeals contain the immutable ID, explanation, and a public proof post URL. The service never asks for an X password or DM.

Public outputs contain IDs, categories, statuses, observed results, and aggregates. Reporter identities, volunteer applications, and appeal capability keys are never published. Production verification uses Cloudflare Turnstile; email uses the operator-selected SMTP provider.

The proposed policy removes raw reports 12 months after case closure and retains the audit trail. This policy, operational logging, controller identity, and rights-request channel need owner approval before launch. No production contact address has been approved in this repository.