Privacy & data use

What is stored

• Your reference number, generated at submission (for example 7KQX-2M4P).
• The WhatsApp number you entered with the country code you selected, the currency and the amount, and the account, crypto address or website you named. Every field of the form is required before a clue can be sent.
• The description of what happened, exactly as you wrote it.
• The date and time of submission.
• Your IP address, and a one-way salted hash of it used for rate limiting.
• Your browser's user-agent string (needed to tell abuse from real submissions).

Nothing else is collected. There are no cookies, no analytics, no advertising tags and no third-party scripts on these pages.

The country code and the currency the form starts with are only a guess: the web server looks up the country of your IP address in an offline database, and if that says nothing it falls back to your browser language. The guess pre-selects two dropdowns, you can change both, and it is never stored — no IP address is kept for it and no outside service is asked.

Why it is stored

• To check the tip. Investigators need the details you provided to compare them with other reports about the same account.
• To answer your lookup. The reference number and WhatsApp number are what you use on the check status page.
• To stop abuse. Rate limits use the IP hash, so a flood of fake submissions cannot bury real ones.

One WhatsApp number, one report

If the same WhatsApp number is submitted again, the new text is not stored. The system recognises the number, keeps the first report and returns the original reference number. This is deliberate: it stops duplicates from diluting an investigation.

How long it is kept

• Reports: 24 months from submission (storage limitation, Article 5(1)(e) GDPR), then deleted by staff. Deletion is a manual task: no scheduled job removes reports automatically.
• Lookup log (reference, IP hash, found/not found): 7 days, then deleted automatically.
• Submission log (rate-limit and abuse events): 30 days.

Retention is a policy of this service, not a hard limit of the database. Ask for a copy or deletion earlier and it will be honoured (see below). Staff can also erase every stored report at once from the admin area, which empties the clue table in a single step.

Who can see it

• Authorised investigators handling fraud reports.
• Nobody else. Reports are not sold, shared or published.
• The database file sits outside the web root and cannot be downloaded over HTTP; the server refuses requests for database, log and backup files.

How it is protected

• The submission endpoint accepts POST only, validates every field and writes through parameterised statements.
• Duplicate submissions are rejected before anything is written.
• Anonymised lookups: status pages are rate-limited, and a report is shown only when reference number and WhatsApp number both match.
• The database is limited to the web-server account and stored on the private network.

Legal basis

• Reports of a suspected fraud. Article 6(1)(e) GDPR — processing necessary for a task carried out in the public interest or in the exercise of official authority — where this service is run by, or on behalf of, a public authority. Otherwise Article 6(1)(f) GDPR — the controller's legitimate interest in preventing and investigating fraud. Point (f) does not apply to processing carried out by public authorities in the performance of their tasks.
• Descriptions of a suspected offence. A report may describe a criminal offence. Under Article 10 GDPR such data may be processed only under the control of official authority, or when Union or Member State law authorises it with appropriate safeguards.
• Voluntary reports. Sending a report is voluntary; for its content the processing also rests on your consent (Article 6(1)(a) GDPR). You may withdraw consent at any time (Article 7(3)) without affecting processing carried out before the withdrawal.
• Abuse prevention. The IP hash, the user-agent string and the submission log are processed under Article 6(1)(f) GDPR (network and information security, Recital 49) and protected as required by Article 32 GDPR.
• No automated decisions. There is no profiling and no automated decision-making within the meaning of Article 22 GDPR.
• No transfer outside the EU/EEA. The data stays on the server described on this page; there is no third-country transfer under Chapter V GDPR.

Your rights

• Access (Article 15), rectification (16), erasure (17), restriction of processing (18), data portability (20) and objection (21) GDPR.
• Withdraw consent at any time (Article 7(3)).
• Lodge a complaint with a supervisory authority (Article 77 GDPR) — in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.
• Requests are answered within one month; for complex requests that period may be extended by two further months (Article 12(3) GDPR).

Your choices

Quote your reference number to ask for a copy of what is stored, a correction, or deletion. Deleting a report also removes it from status lookups.