Privacy Policy

Privacy Commitment

PhishDestroy is a non-commercial, volunteer-driven project. We collect the minimum data necessary to operate our anti-phishing mission. We do not sell, rent, or trade personal information.

Information We Collect

We collect and process minimal personal data, limited to what is strictly necessary:

Threat report submissions: Domain names, URLs, wallet addresses, and any evidence you voluntarily provide when reporting a phishing site via our Telegram bot or other channels. We do not require personal information to submit a report.
Technical data: IP addresses, user agent strings, and access timestamps collected automatically by our servers for security, abuse prevention, and service stability. IP addresses are processed strictly for security purposes (DDoS mitigation and abuse prevention) and are not used to identify individual users or build personal profiles.
Analytics data: Anonymized usage statistics through Google Analytics (via Google Tag Manager) to understand how our services are used and improve them.
Communication data: Email addresses or Telegram usernames when you contact us directly for support, appeals, or inquiries.

We do not collect financial data, identity documents, passwords, or any special categories of personal data.

How We Use Information

The information we collect is used exclusively for our anti-phishing mission:

To analyze and verify reported phishing domains, scam infrastructure, and malicious content.
To report verified malicious domains to registrars, hosting providers, and security partners (AV vendors, blocklist operators, CERTs).
To publish anonymized threat intelligence to our public feeds, API, and community channels.
To maintain and improve our services, tools, and detection systems.
To respond to your inquiries, appeals, or support requests.

Information Sharing and Disclosure

We only share information in the following circumstances:

With security partners: We share threat data (domains, URLs, technical indicators) with registrars, hosting providers, AV vendors, and CERTs to facilitate takedowns. This data does not include reporter identities.
Public threat intelligence: Confirmed phishing domains and associated technical indicators are published in our blocklists, API feeds, and public channels. Reporter identities are never included.
Legal obligations: We may disclose information if required by law, court order, or to comply with a valid legal request from authorities.

Third-Party Services

We use the following services for infrastructure and performance:

Cloudflare: CDN, DDoS protection, and DNS services. Cloudflare processes connection metadata (IP addresses, request headers) for security purposes. Cloudflare Privacy Policy.
Namecheap: Domain registration. Namecheap Privacy Policy.
Google Analytics (via GTM): Anonymized website analytics. We have enabled IP Anonymization, ensuring your IP address is truncated within the EEA before transmission to Google. Google Privacy Policy.
Telegram Bot API: For threat report submissions. We process only the data you provide; we do not access your phone number. Telegram Privacy Policy.
Ahrefs: SEO analytics and website performance monitoring. Ahrefs Privacy Policy.

Data Retention

We retain data only as long as necessary:

Threat intelligence data: Retained indefinitely as part of the public record. Domain names and technical indicators are not personal data of the reporter.
Server logs (IP, user agent): Retained for up to 90 days. These logs are used exclusively for security monitoring, mitigating DDoS attacks, and identifying malicious scraping of our data feeds.
Communication records: Retained for up to 12 months after last interaction.
Analytics data: Anonymized and aggregated; individual-level data is managed by Google Analytics under its own retention settings.

Data Security

We implement robust technical measures, including mandatory TLS/HTTPS encryption. We use Cloudflare as our CDN and security layer, providing enterprise-grade DDoS protection and WAF. All connections are encrypted end-to-end via TLS. See our Security Policy for details.

International Data Transfers & Sanctions

PhishDestroy infrastructure is distributed across multiple jurisdictions, primarily within the EEA and the USA.

Sanctions Compliance: In accordance with our mission and international law, PhishDestroy does not provide services, process inquiries, or maintain communication with individuals or entities located in the Russian Federation, Belarus, or other jurisdictions under comprehensive international sanctions.
Data Discard: Any data, reports, or communications originating from these regions may be discarded immediately without processing or response.

Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or restrict processing of your personal data. EU/EEA residents have additional rights under GDPR — see our dedicated GDPR Notice for details. To exercise any data rights, email privacy@phishdestroy.io.

Cookies

We use minimal cookies for analytics (Google Analytics) and security. No advertising, marketing, or behavioral profiling cookies. For full details, see our Cookie Policy.

Children's Privacy

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. The "Last Updated" date in the page metadata will be revised accordingly. Continued use of our services after changes constitutes acceptance.

Contact

For all privacy-related inquiries, requests, or complaints:

Email: privacy@phishdestroy.io
Subject line: Privacy Request (for formal requests) or Privacy Inquiry (for general questions)