Privacy Policy

Information We Collect#

We collect and process minimal personal data, limited to what is strictly necessary:

Threat report submissions:

Domain names, URLs, wallet addresses, and any evidence you voluntarily provide when reporting a phishing site via our Telegram bot or other channels. We do not require personal information to submit a report.

Technical data:

IP addresses, user agent strings, and access timestamps collected automatically by our servers for security, abuse prevention, and service stability. IP addresses are processed strictly for security purposes (DDoS mitigation and abuse prevention) and are not used to identify individual users or build personal profiles.

Analytics data:

Usage statistics through Google Analytics 4, loaded via Cloudflare Zaraz: your browser sends page events only to phishdestroy.io, and Cloudflare forwards them to Google. We do not record sessions, clicks or scroll heatmaps. Analytics is not used to build advertising profiles.

Communication data:

Email addresses or Telegram usernames when you contact us directly for support, appeals, or inquiries.

We never request passwords, seed phrases, private keys, or identity documents. The complaint-draft tool processes only the incident details you choose to provide—including a loss amount, wallet addresses, transaction hashes, suspect contacts, related sites, and your narrative—through the AI services disclosed below. Name and contact fields added after generation remain local in your browser.

How We Use Information#

The information we collect is used exclusively for our anti-phishing mission:

• To analyze and verify reported phishing domains, scam infrastructure, and malicious content.
• To report verified malicious domains to registrars, hosting providers, and security partners (AV vendors, blocklist operators, CERTs).
• To publish anonymized threat intelligence to our public feeds, API, and community channels.
• To maintain and improve our services, tools, and detection systems.
• To respond to your inquiries, appeals, or support requests.

Information Sharing and Disclosure#

We only share information in the following circumstances:

With security partners:

We share threat data (domains, URLs, technical indicators) with registrars, hosting providers, AV vendors, and CERTs to facilitate takedowns. This data does not include reporter identities.

Public threat intelligence:

Confirmed phishing domains and associated technical indicators are published in our blocklists, API feeds, and public channels. Reporter identities are never included.

Legal obligations:

We may disclose information if required by law, court order, or to comply with a valid legal request from authorities.

Third-Party Services#

We use the following services for infrastructure and performance:

Cloudflare:

CDN, DDoS protection, and DNS services. Cloudflare processes connection metadata (IP addresses, request headers) for security purposes. Cloudflare Privacy Policy.

Namecheap:

Domain registration. Namecheap Privacy Policy.

Google Analytics 4 (via Cloudflare Zaraz):

Anonymized website analytics. Events reach Google through Cloudflare, not directly from your browser, and Google Analytics 4 does not log or store IP addresses. Google Privacy Policy.

hCaptcha and Cloudflare Turnstile:

Bot protection on our forms: hCaptcha on the appeal form, Cloudflare Turnstile on the report form. They process your IP address and browser signals to tell people from bots. hCaptcha Privacy Policy, Cloudflare Privacy Policy.

Images from other sites:

Some pages show site icons through Google’s favicon service and news cover images directly from their publishers. Your browser loads them from those servers, so they see your IP address.

Telegram Bot API:

For threat report submissions. We process only the data you provide; we do not access your phone number. Telegram Privacy Policy.

OpenRouter and Anthropic:

If you explicitly consent to AI draft generation, incident details are routed through OpenRouter to an Anthropic Claude model using OpenRouter's Zero Data Retention routing requirement. OpenRouter documents its input/output and metadata handling in its Data Collection guide; Anthropic describes its standard API retention and exceptions in its Privacy Center.

Data Retention#

We retain data only as long as necessary:

Threat intelligence data:

Retained indefinitely as part of the public record. Domain names and technical indicators are not personal data of the reporter.

Server logs (IP, user agent):

Retained for up to 90 days. These logs are used exclusively for security monitoring, mitigating DDoS attacks, and identifying malicious scraping of our data feeds.

Communication records:

Retained for up to 12 months after last interaction.

Analytics data:

Anonymized and aggregated; individual-level data is managed by Google Analytics under its own retention settings.

Complaint-draft content:

PhishDestroy does not persist the request body or generated draft in its application database. Temporary rate-limit counters and ordinary security metadata may be processed. The AI providers apply their own retention and legal-policy exceptions as described above.

Data Security#

We implement robust technical measures, including mandatory TLS/HTTPS encryption. We use Cloudflare as our CDN and security layer, providing enterprise-grade DDoS protection and WAF. All connections are encrypted end-to-end via TLS. See our Security Policy for details.

International Data Transfers & Sanctions#

PhishDestroy infrastructure is distributed across multiple jurisdictions, primarily within the EEA and the USA.

Sanctions Compliance:

In accordance with our mission and international law, PhishDestroy does not provide services, process inquiries, or maintain communication with individuals or entities located in the Russian Federation, Belarus, or other jurisdictions under comprehensive international sanctions.

Data Discard:

Any data, reports, or communications originating from these regions may be discarded immediately without processing or response.

Your Rights#

Depending on your jurisdiction, you may have the right to access, correct, delete, or restrict processing of your personal data. EU/EEA residents have additional rights under GDPR — see our dedicated GDPR Notice for details. To exercise any data rights, email privacy@phishdestroy.io.

Cookies#

We use minimal cookies for analytics (Google Analytics 4 via Cloudflare Zaraz) and security. No advertising, marketing, or behavioral profiling cookies. For full details, see our Cookie Policy.

Children's Privacy#

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

Changes to This Policy#

We may update this Privacy Policy to reflect changes in our practices or applicable law. The "Last Updated" date in the page metadata will be revised accordingly. Continued use of our services after changes constitutes acceptance.

Contact#

For all privacy-related inquiries, requests, or complaints:

• Email: privacy@phishdestroy.io
• Subject line: Privacy Request (for formal requests) or Privacy Inquiry (for general questions)