Privacy & cookies

What we collect

Reports and corrections may contain provider names, issue types, dates, written accounts, source links, file hashes, connections or incentives, confidentiality restrictions and an optional reply email. We record accepted submission conditions, their version and the acceptance time. Complaints do not require acceptance of the terms. Please avoid sending passwords, payment card details or unrelated sensitive information.

Why we use it

We use this information to assess reports, maintain accurate public records, consider responses and corrections, communicate with contributors and protect the service from abuse. Our basis for this processing is our legitimate interest in providing an accurate information directory and a secure complaints process. Where a legal obligation requires us to retain or disclose information, we process it for that obligation. We do not sell submission data or use it for advertising.

Editors make publication decisions. Original submissions, contact details and internal notes remain private. An editor may publish a separate, redacted account and relevant sources after review. We may also assess information obtained from public sources; public records describe their evidence and limitations. There are no decisions about people based solely on automated processing.

Hosting and third parties

The website and its SQLite database are hosted on a Hetzner server. Cloudflare provides the public network proxy and security layer. These infrastructure providers process connection information such as IP addresses, request paths and technical errors. Cloudflare operates a global network, so connection data may be processed outside the UK. See Cloudflare’s privacy policy and Hetzner’s privacy policy for their processing information.

Our application stores source links as text and does not fetch or scan them. Opening an external source visits another website. Game logos and other local images are served by cheat.top. If an editor publishes an externally hosted image, your browser connects to that host to load it, without this page’s referrer.

Cookies and security records

Public browsing and form submission do not require an account or a tracking cookie. The application does not use analytics, advertising or marketing cookies. Cloudflare may process security information and set essential security cookies when its protection features require them.

Editor sign-in creates an essential cookie named ct_session, lasting eight hours. It is Secure, HttpOnly and SameSite=Strict on the live site. Signing out invalidates the server session. We store a hash of the session token, editor name, expiry and request-protection token.

Short-lived abuse counters use a keyed hash of the client IP address. Counters expire after 15 minutes for sign-in and one hour for submissions. Single-use form tokens expire after an hour. Expired session, counter and token rows are cleaned on subsequent sign-ins or submissions. Infrastructure access logs can contain IP addresses and request paths; do not put sensitive details in URLs.

Retention and disclosure

We retain reports and editorial material while needed to investigate a concern, support a published assessment, handle corrections or respond to a legal claim. Retention depends on whether a matter remains open, whether evidence still supports a public record and whether an applicable legal obligation requires it. There is currently no automatic deletion schedule for these editorial records. We review removal requests through the contact form. Database backups can retain earlier copies until those backups are replaced or removed.

Editors have access to the private review queue. Changes are logged with the editor identifier, time, action and reason. The application does not log report bodies or passwords. We cannot promise absolute anonymity; lawful disclosure may be required. Confidentiality instructions are preserved for editorial review.

Your rights and requests

Depending on the circumstances, you may request access, correction, deletion, restriction or transfer of your personal information, and object to processing based on legitimate interests. Some rights are subject to exceptions. Use the private contact form and include enough information to identify the material and a way to reply. You can also complain to the Information Commissioner’s Office.