Privacy

The short version: browsing this site does not require an account, and we ask for personal data in exactly one place — the report forms. This page describes what we actually do, not what we might do later.

What we collect

From a report: your name, your email address, optionally your organisation, and what you wrote. Nothing else — no postal address, no phone number, no identity documents, and no file attachments.
From ordinary browsing: the server keeps standard request logs. We run no analytics, no advertising and no third-party tracking scripts, and we set no tracking cookies.
Cookies: only strictly necessary ones. Opening a report form sets a CSRF cookie, which exists solely to stop someone else submitting the form in your name; logging in to the admin sets a session cookie. Neither is used to profile or follow you.

Why, and on what basis

A report is processed because we have a legitimate interest in responding to complaints about what we host and in keeping a record of the decisions we took. Your email is used only if an operator needs to reply to you about your report — we send no automatic mail at all. We do not sell your data, and we do not use it for advertising or marketing.

Who else handles your data

Different things you send us travel different paths, and not everyone below sees the same thing. Rather than list providers in general, here is each path separately.

The report form

What you type into the form is submitted to our site and stored in our database. The servers and that database are hosted at Hetzner, which handles the web request and stores the data as part of hosting the project. The full text of your report stays there — an operator reads it in our admin, behind a login.

The alert we send ourselves

When a report arrives we email an internal address of ours so somebody knows to look. That alert is deliberately partial: it carries the reference, the kind of report, the package, version, file hash and page you named, whatever card those matched, and a link to open the report in our admin. Your name, your organisation, the text of your complaint and any evidence link are NOT in it. Your email address is attached as the reply-to, so an operator can answer you. This alert is sent through Resend and reaches the operator's mailbox via our forwarding provider ImprovMX and Google Gmail.

Mail you send us directly

If you write to our published address instead of using the form, that message is forwarded by ImprovMX into a mailbox at Google Gmail. Both handle the contents of your message and its delivery metadata — sender, recipient, timestamps and the technical headers mail carries.

A reply from an operator

When an operator writes back, the reply is composed in Google Gmail and sent through Resend to you. Both handle your address, what the operator wrote and the delivery metadata.

We name these providers so you know who is involved; we do not speak for them. How long each keeps what, under which jurisdiction and on what terms is their business to state, not ours to summarise. If that matters for what you are about to send, tell us as little as the report needs.

How long we keep it

Reports and the decisions taken on them are kept as a record of why a card was removed or restored. We have no automatic deletion schedule yet — when we add one, this page will say what it is rather than implying we already have it.

Your rights

You can ask what we hold about you, ask for it to be corrected, or ask for it to be deleted. Write to the contact below and quote your reference if you have one. Where a report led to a decision we have to be able to justify, we may keep the decision record while removing the personal details around it.

Who is responsible

Operator

Denis Ostroukhov

Status

Independent non-commercial project

Country

Serbia

Legal and privacy contact

legal@apkproof.com