THE STEAM DOSSIER — SHARE MATERIAL WITH THE EDITORS Version 1 — effective 17 October 2026 https://phishdestroy.io/steam_dossier/contribute/ THE IDEA We investigate facts that can be checked and, where justified, published. We do not offer a vault for secrets. If information cannot lawfully be shared or used, please do not send it. Send the smallest truthful, redacted account that lets an editor understand what happened and check the evidence. 1. WHAT THIS FORM IS FOR 1.1 An adult may offer their own relevant case, a public source, or supporting evidence for the Steam Dossier, including its support-refusals collection. Submission is not publication, endorsement or verification of an allegation. 1.2 Disputes about our findings, official decisions, urgent removal requests and statutory rights use https://phishdestroy.io/steam_dossier/dispute/ or the applicable legal channel. Do not use the editorial queue for a binding deadline. 1.3 No account, real name, email address, telephone number or identity document is requested. Prefer the private receipt to email. Do not put contact details in the account, links, screenshots or temporary editor note. Technical access information is still processed by the hosting/CDN and human-verification provider; this form is not a promise of untraceable communication. 2. WHAT YOU MAY SEND 2.1 Explain what you directly observed, how you obtained the evidence, what the evidence actually establishes and what remains uncertain. Distinguish your experience from a claim about another person's motives or identity. 2.2 Use truthful text, up to five public HTTPS links and up to three flattened, redacted PNG/JPEG screenshots, each at most 4 MB and 12 megapixels. The longest side must not exceed 8,000 pixels. Other formats, archives, PDFs, executables, office documents, HTML, SVG, audio and video are not accepted by this editorial form. Official signed decisions have a separate intake. 2.3 Remove unnecessary third-party personal data and all identifying information about minors. Crop or permanently cover names, handles, faces, addresses, account identifiers, ticket identifiers, payment details and correspondence not needed to understand the case. Flatten the image; a removable annotation or a translucent mark is not reliable redaction. 2.4 Never send fabricated or misleading material, credentials, authentication cookies, tokens, private keys, unlawfully obtained material, illegal content, or information whose storage or disclosure is legally restricted. If a case cannot be explained without such material, do not submit it through this form. 2.5 Declarations and automated checks do not identify every privacy or legal problem. We review suitability and delete prohibited or unusable material when identified, subject only to a specific mandatory applicable preservation or reporting obligation. This is not an invitation to upload it for assessment. 3. TWO SEPARATE PARTS 3.1 The account, evidence explanation, public links and processed screenshots are offered for editorial verification and possible public use. You expressly permit us to quote, summarise, redact and reproduce the parts you are entitled to provide, solely for this investigation and related corrections. You keep your rights. Your permission cannot waive another person's rights or make unlawful material lawful. Publication remains an editorial and legal decision. 3.2 The optional editor note is context for understanding the submission, not material for quotation or public use. It has a separate confirmation and a choice of deletion after 7 days (default) or 14 days from receipt. It is stored separately, excluded from all publication exports, and never sent to a public archive, mirror, external AI service, email or chat by this intake system. Editors must not copy it into drafts, screenshots, tickets or other working stores. A note cannot authorise a public allegation; public claims still need independently publishable evidence. 3.3 Example only, not a factual submission: Material: "In [month/year], I asked Steam Support to restore items after an account compromise. The response cited its item-restoration policy. My redacted screenshots show the request and response. I cannot establish how the account was compromised." Editor note: "The screenshots are in reverse order. Read image 2 before image 1. This note only explains the sequence; do not quote it." 3.4 We prefer not to receive a secret we cannot use. This is not an NDA service, privileged legal channel, secure whistleblower system or promise to conceal material from a binding lawful obligation. Temporary editorial discretion does not replace the instruction to remove restricted information before sending. 4. CHECKING, STORAGE AND ACCESS 4.1 Temporary uploads and the encrypted private queue are outside the public website and outside the site's normal code/database backup jobs. Access uses the existing server permissions. No public upload URL is created. 4.2 Screenshots are scanned and decoded in a disposable process without network access, website access or access to other cases or encryption keys. File type, size, pixel count, still-image format and execution resources are limited. Accepted screenshots are re-encoded as fresh JPEG pixels, without original metadata or embedded payloads. Originals are deleted after processing. These are processed review copies, not byte-identical original exhibits. 4.3 Failure or uncertainty in file checks blocks acceptance. Rejected uploads are discarded, not kept indefinitely in a quarantine. A housekeeping timer also clears abandoned temporary work. Server-side source-link retrieval, automatic archive capture and automatic public posting are not implemented. 4.4 Editors use an authorised local server account and the editorial command-line tool. Review copies contain processed images and escaped plain text; editor notes remain separate and are excluded from every file export. Publication requires independent review and deliberate use of permitted material. Downloaded editorial copies must remain in the approved workflow and be deleted by the intake expiry if unused. Notes must never be copied. 4.5 Any use of local AI requires an authorised, configured local component and is limited to the permitted review material. Editor-only notes are excluded. External AI processing is not authorised through this intake. AI output does not establish that an allegation is true and cannot authorise publication or execution of a legal decision. Retention limits also apply to derived records. 5. RETENTION, DELETION AND THE RECEIPT 5.1 Unpublished intake material is available for up to 14 days from receipt. Selecting or reviewing it does not restart the clock. The editor note has its separately chosen 7- or 14-day limit. Editors may delete either sooner. After its deadline the normal interface cannot read it; the periodic cleanup removes the encrypted content and its individual keys. If cleanup fails, access still expires and administrators must resolve the deletion failure. 5.2 You receive an ID and a private access key. Keep them to check the status or withdraw the still-private submission. No email recovery is provided. The withdrawal action deletes the queued material and note immediately; a minimal private receipt/status remains until the original 14-day expiry. It does not automatically erase a separately verified, lawful published investigation. Use the dispute/privacy procedure for a publication or statutory request. 5.3 Rejected material is deleted immediately by the editor's reject action. At 14 days the intake record itself expires. Publicly used, verified material may remain in the publication and its necessary evidence record under an applicable lawful basis; the temporary editor note is never part of that record. 5.4 An actual mandatory legal preservation obligation may require minimal, restricted retention. It needs a recorded specific basis and a fixed review date; it is not an automatic exception or an editorial convenience. Normal editorial access still expires on time. Expired holds are not renewed by software. Where disclosure is permitted, the private receipt identifies that restricted legal retention exists. Unrelated material must still be minimised. 5.5 Rate-limit records use a keyed connection identifier and expire within two days. Ordinary hosting/CDN security logs and human-verification processing are separate. We do not claim forensic erasure of every physical storage block, deletion of copies independently saved by others, or control of third-party archives. No new archive copy is created by submitting or withdrawing a case. 6. LEGAL BASIS, RIGHTS AND CONTACT 6.1 The limited private review serves the legitimate interest in checking and reporting matters of public interest, subject to applicable balancing and safeguards. Mandatory legal duties apply where relevant. Your publication permission covers only material and rights you can actually provide; it is not blanket consent on behalf of third parties. Data minimisation, storage limits and freedom of expression must be assessed under the applicable law. For this intake, the separate editor-note restrictions and retention limits take precedence over any general submission licence in the site Terms. 6.2 For privacy rights, a correction, or a concern about material already used, contact privacy@phishdestroy.io or use the dispute form. Supply the receipt ID if relevant; never email the private access key. Applicable statutory rights, response periods and rights to complain to a competent authority are unaffected. 6.3 Earlier signed versions remain available when this policy changes. A signature authenticates the published policy; it does not certify every submitted case. REFERENCE POINTS GDPR, in particular Articles 5, 6, 12–22, 32 and 85: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng OWASP File Upload Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html