Privacy Policy

Information We Collect

We collect and process minimal personal data, limited to what is strictly necessary:

• Threat report submissions: Domain names, URLs, wallet addresses, and any evidence you voluntarily provide when reporting a phishing site via our Telegram bot or other channels. We do not require personal information to submit a report.
• Technical data: IP addresses, user agent strings, and access timestamps collected automatically by our servers for security, abuse prevention, and service stability. IP addresses are processed strictly for security purposes (DDoS mitigation and abuse prevention) and are not used to identify individual users or build personal profiles.
• Analytics data: Usage statistics through Google Analytics and Microsoft Clarity (loaded via Google Tag Manager), plus Ahrefs Web Analytics. Clarity records anonymized session interactions — clicks, scrolls, and aggregated heatmaps — to help us understand how our services are used and improve them. These tools do not build advertising profiles.
• Communication data: Email addresses or Telegram usernames when you contact us directly for support, appeals, or inquiries.

We never request passwords, seed phrases, private keys, or identity documents. The complaint-draft tool processes only the incident details you choose to provide—including a loss amount, wallet addresses, transaction hashes, suspect contacts, related sites, and your narrative—through the AI services disclosed below. Name and contact fields added after generation remain local in your browser.

How We Use Information

The information we collect is used exclusively for our anti-phishing mission:

• To analyze and verify reported phishing domains, scam infrastructure, and malicious content.
• To report verified malicious domains to registrars, hosting providers, and security partners (AV vendors, blocklist operators, CERTs).
• To publish anonymized threat intelligence to our public feeds, API, and community channels.
• To maintain and improve our services, tools, and detection systems.
• To respond to your inquiries, appeals, or support requests.

Information Sharing and Disclosure

We only share information in the following circumstances:

• With security partners: We share threat data (domains, URLs, technical indicators) with registrars, hosting providers, AV vendors, and CERTs to facilitate takedowns. This data does not include reporter identities.
• Public threat intelligence: Confirmed phishing domains and associated technical indicators are published in our blocklists, API feeds, and public channels. Reporter identities are never included.
• Legal obligations: We may disclose information if required by law, court order, or to comply with a valid legal request from authorities.

Third-Party Services

We use the following services for infrastructure and performance:

• Cloudflare: CDN, DDoS protection, and DNS services. Cloudflare processes connection metadata (IP addresses, request headers) for security purposes. Cloudflare Privacy Policy.
• Namecheap: Domain registration. Namecheap Privacy Policy.
• Google Analytics (via GTM): Anonymized website analytics. We have enabled IP Anonymization, ensuring your IP address is truncated within the EEA before transmission to Google. Google Privacy Policy.
• Microsoft Clarity (via GTM): Anonymized product analytics — session replay, click and scroll heatmaps — used to improve usability. Clarity masks text and form inputs by default and we do not use it to identify individuals. Microsoft Privacy Statement.
• Telegram Bot API: For threat report submissions. We process only the data you provide; we do not access your phone number. Telegram Privacy Policy.
• Ahrefs: SEO analytics and website performance monitoring. Ahrefs Privacy Policy.
• OpenRouter and Anthropic: If you explicitly consent to AI draft generation, incident details are routed through OpenRouter to an Anthropic Claude model using OpenRouter's Zero Data Retention routing requirement. OpenRouter documents its input/output and metadata handling in its Data Collection guide; Anthropic describes its standard API retention and exceptions in its Privacy Center.

Data Retention

We retain data only as long as necessary:

• Threat intelligence data: Retained indefinitely as part of the public record. Domain names and technical indicators are not personal data of the reporter.
• Server logs (IP, user agent): Retained for up to 90 days. These logs are used exclusively for security monitoring, mitigating DDoS attacks, and identifying malicious scraping of our data feeds.
• Communication records: Retained for up to 12 months after last interaction.
• Analytics data: Anonymized and aggregated; individual-level data is managed by Google Analytics under its own retention settings.
• Complaint-draft content: PhishDestroy does not persist the request body or generated draft in its application database. Temporary rate-limit counters and ordinary security metadata may be processed. The AI providers apply their own retention and legal-policy exceptions as described above.

Data Security

We implement robust technical measures, including mandatory TLS/HTTPS encryption. We use Cloudflare as our CDN and security layer, providing enterprise-grade DDoS protection and WAF. All connections are encrypted end-to-end via TLS. See our Security Policy for details.

International Data Transfers & Sanctions

PhishDestroy infrastructure is distributed across multiple jurisdictions, primarily within the EEA and the USA.

• Sanctions Compliance: In accordance with our mission and international law, PhishDestroy does not provide services, process inquiries, or maintain communication with individuals or entities located in the Russian Federation, Belarus, or other jurisdictions under comprehensive international sanctions.
• Data Discard: Any data, reports, or communications originating from these regions may be discarded immediately without processing or response.

Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or restrict processing of your personal data. EU/EEA residents have additional rights under GDPR — see our dedicated GDPR Notice for details. To exercise any data rights, email [email protected].

Cookies

We use minimal cookies for analytics (Google Analytics and Microsoft Clarity) and security. No advertising, marketing, or behavioral profiling cookies. For full details, see our Cookie Policy.

Children's Privacy

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. The "Last Updated" date in the page metadata will be revised accordingly. Continued use of our services after changes constitutes acceptance.

Contact

For all privacy-related inquiries, requests, or complaints:

• Email: [email protected]
• Subject line: Privacy Request (for formal requests) or Privacy Inquiry (for general questions)