How this server handles personal data

• Your sign-in. A separate sign-in service holds your username, email address and password. This server never sees your password. When you sign in it receives your account id, username, access level and plan. Why: to know it is you and what you may use.
• Your session. One cookie and a matching record on the server, for at most 8 hours. Why: to keep you signed in between pages.
• Your devices. For each signed-in browser: a short label such as "Firefox on Linux", its network address, and when it signed in and was last seen. Why: so you can see your devices, sign one out, and be warned about a sign-in you did not make. Administrators see a list of recent sign-ins with the same details.
• Your searches and cases. What you looked up and what was found, stored under your account and shown only to you in the app. Each case's board is stored there too: its name, what you put on it, where you placed things, your notes and stars. So it is the same after a reload, in another browser and on another device, and it is deleted with the case. Why: it is the work you asked the tool to do.
• The activity log. One line per action: when, which kind of action, your account id and access level, the page address without what was typed into it, the result, and a scrambled form of your network address. It does not record what you searched for. Why: security, and to show who did what if something goes wrong.
• Daily limits. A count of how much of today's allowance you used. Why: fair use of shared resources.
• Access keys you create for other programs. Their name, dates and a scrambled form of the secret; the secret itself is never stored. Why: to check the key when it is used.
• Notices you dismissed. Which "What's new" notices you closed, filed under a scrambled form of your account id. Why: so they stay closed.
• Payments, if this server charges for plans. You pay on the payment provider's own page; card details never reach this server. It keeps the provider's customer reference and your plan's status. Why: to give you the plan you paid for.

• The results: accounts found on other sites, what those profiles show publicly, profile pictures, and records from public breach and leak lists, each with the date it was true.
• Inside a case, those results stay until the account holder deletes the case. Outside a case, they are deleted automatically (see How long).
• Scheduled re-checks an account holder sets up keep the detail they watch until they are removed.
• A line in the activity log for each search: who ran it, what kind of search, the ground they gave for it, and a scrambled form of the searched detail. Someone reading the log cannot see who was searched for; an administrator who already knows a detail can check whether it was searched.
• A photo uploaded to find where it was taken is not stored. It is used for that run and then dropped.

• ConsentThe person the search is about agreed to it (GDPR Art. 6(1)(a)).
• ContractNeeded to perform or prepare a contract with that person (Art. 6(1)(b)).
• Legal obligationA law requires the controller to do this (Art. 6(1)(c)).
• Vital interestsNeeded to protect somebody's life (Art. 6(1)(d)).
• Public taskA task in the public interest or official authority (Art. 6(1)(e)).
• Legitimate interestsA legitimate interest that the person's own rights do not override (Art. 6(1)(f)).
• Journalism or researchJournalistic, academic or archival work under the national Art. 85/89 exemption.
• Law-enforcement authorityA competent authority acting under its own statute (Directive 2016/680).
• Own data or testingThe analyst's own identifiers, or test data with nobody behind it.

• The sites and lists a search asks. Each learns the detail being looked up and the network address the question came from. The operator can send these questions through a private network connection so that the address is not this server's.
• An outside AI service, only if the operator set one up. When the assistant runs on an outside service instead of on this machine, it receives the case text and tool results it works with, and the page says so before anything is sent. Where the service supports it, every request asks it not to keep the text for training; that is an instruction this server cannot check. With the assistant on this machine, nothing about a case leaves it.
• An outside image service, only if the operator set one up, for finding where a photo was taken. It receives the picture with its hidden details (such as camera and location data) removed, and the result says the photo left the server.
• Map, satellite and elevation services. They receive a place or an area, not a person.
• The sign-in service run for this server, which holds your account.
• The payment provider, if this server charges for plans, which receives what you enter on its page and a reference to your account here.
• A notification service, only if the operator set one up, which receives a short message for each sign-in: the name, access level, device label, network address and time.

The sign-in service sets its own cookies on its own pages. The app also remembers a few things in your browser only, never on the server: your colour theme, panel layout and recent searches. Account, then Clear recent searches, forgets the searches; clearing your browser's site data forgets the rest. Your cases are kept on the server under your account (see What is kept about account holders); the browser holds a copy of them only to open quickly, and that copy and your recent searches are wiped when you sign out or your session ends.

• Passwords stay with the sign-in service. Administrator actions need a recent sign-in.
• On a server open to the internet, the session cookie is only sent over an encrypted connection.
• Each account's searches and cases are kept apart; one account cannot count, copy or delete another's.
• The activity log is chained, so a changed or removed line shows.
• The main searches send what you look for inside the request, not in the page address, and the server's access logs leave out the part of an address that can hold a search.
• Access keys are stored only in scrambled form, and secrets the operator enters are kept in files only the server can read.
• You can see every signed-in device, sign others out, and get an alert for a new one.
• The pages load nothing from other websites.