THE STEAM DOSSIER — EVIDENCE, CORRECTIONS AND LAWFUL DECISIONS Version 3 — effective 17 October 2026 https://phishdestroy.io/steam_dossier/dispute/ OUR COMMITMENT Challenge the statement. Show the evidence. If we are wrong, we will put it right. We will correct a demonstrated error, withdraw a finding that cannot be supported, and acknowledge the change. Where our error has caused harm, an appropriate apology belongs with the correction. A court case is not a prerequisite. 1. SCOPE, EQUAL TREATMENT AND ELIGIBILITY 1.1 This procedure covers the Steam Dossier and copies we control, including translations, downloadable publications and managed mirrors. It is linked from the PhishDestroy Terms of Service, section 9. 1.2 Anyone may identify an error, including a reader, a person named in a finding, Valve, Taylor Wessing or another representative. The same evidence standard applies to everyone. A company's or lawyer's demand is not, merely because of its sender, a judicial or regulatory decision. Its evidence and any legal obligations it identifies are nevertheless assessed on their merits. 1.3 This voluntary intake does not accept demands by, or on behalf of, Russian or Belarusian government, court, law-enforcement, intelligence or regulatory bodies. Requests whose handling is prohibited by applicable sanctions, including applicable OFAC restrictions, are also outside this intake. Sanctions programmes can be targeted: appearance of a country on OFAC's programme page does not by itself prohibit every interaction with its people. 1.4 A request identified as excluded at intake is rejected before a case is created. Its text and uploads are not retained in the dispute database, document vault, notifications or public log; temporary uploads are discarded. The form screens declared capacity and jurisdiction. It cannot guarantee detection of a concealed or false declaration. Ordinary infrastructure access and security logs are separate and are not represented as erased by this rule. 1.5 These exclusions concern official demands and prohibited dealings, not a person's nationality, language, residence or ability to report an error as a private person. This policy neither enlarges a foreign body's jurisdiction nor overrides an obligation or right that applicable law makes mandatory. 2. DECISIONS: AUTHENTICITY, AUTHORITY, SCOPE, THEN EXECUTION 2.1 Submit the complete decision, issuing body, jurisdiction, case reference, legal basis, affected passage or URLs, territorial scope, operative wording, requested remedy and any deadline. Include the issuer's digital signature or official verification route. A representative's signature alone does not establish that the issuing body made the decision. 2.2 We verify an official digital signature against the issuing body's published key, certificate or trusted certificate chain. Successful official-key verification confirms the document's issuer and integrity. We then record the issuing body's relevant powers, applicable publication scope, operative requirements and deadline, using the official decision and verification source. 2.3 Detached OpenPGP signatures can be checked by the intake system. Signed PDFs, qualified electronic signatures and seals, official registers and other legally valid instruments are accepted for independent verification. Our preferred file format does not invalidate a decision or statutory request. 2.4 We aim to provide a verification result or a specific request for missing information within 72 hours of receipt. A shorter applicable legal deadline takes priority. We execute applicable, authenticated decisions without undue delay, within their actual scope and deadline. We may also correct voluntarily when the underlying evidence establishes an error. Neither an unverified upload nor expiry of this review target automatically removes a publication. 2.5 After verification, an authorised operator approves the exact affected copies and remedy. The execution tool can restrict the approved local copies first, then apply the approved correction or remove them from publication, purge managed caches and record each delivery result. The receipt distinguishes completed actions from pending or failed mirror operations. Uploading a signed file alone cannot authorise deletion or rewrite the publication. 2.6 Our normal course is to comply with an authenticated, applicable decision. If we seek review or appeal, we explain that step through private tracking and attempt notice to the optional contact supplied for the case, where disclosure is lawful. An appeal does not itself suspend an enforceable obligation. Restoration requires a lawful basis and a recorded decision. We do not require payment, silence, disclosure of our contributors' identities or withdrawal of a complaint to correct an error. 3. EVIDENCE OF ERROR 3.1 Identify the exact statement, explain the error and provide records or sources supporting the correction. Evidence may be supplied in the form itself or in an attachment. No lawyer, court decision or OpenPGP key is required. 3.2 We aim to answer within 14 days. A substantiated error is corrected or the unsupported finding withdrawn, with an explanation of what changed. Where justified, we publish an appropriate apology. If the finding is maintained, we explain the evidence and reasons. If a material question remains open, we state what is unresolved and when the next update is expected. 3.3 Factual assertions, attributed allegations, opinion and historical records are distinguished. A later development may require an update; it does not by itself make an accurately described earlier event false. We do not demand that a complainant identify or pursue an author before reviewing a passage. 3.4 A requested remedy is considered on its merits. It does not authorise an unrelated admission, unlawful publication or disclosure of third-party data. 4. RIGHT OF REPLY 4.1 A person or organisation named or identifiable in a finding may submit a reply. We aim to publish a relevant reply, or explain a specific concern, within seven days. A reply does not require agreement with our conclusions. 4.2 Replies are checked for relevance, unlawful material, unnecessary personal data and third-party rights. Material edits are identified and, where practicable, agreed before publication. We do not promise to reproduce arbitrary material unedited. Replies up to 800 words ordinarily fit beside the relevant finding; longer supporting material may be linked separately. 5. PRIVACY, COPYRIGHT AND THE HISTORICAL RECORD 5.1 An accurate public-interest finding is not removed merely because it is unwelcome, old or criticised. Public sources, verification, context and the freedom to receive and impart information are central to our assessment. 5.2 Public availability alone does not exempt personal data from applicable data-protection law. We assess each request and any applicable freedom-of- expression, journalistic, research or legal-claims grounds. GDPR Article 17(3) and Article 85 do not create an automatic exemption for every page. Where GDPR applies, requests are answered without undue delay and normally within one month; any lawful extension and its reasons are communicated within that month. No court order is required to exercise a statutory right. 5.3 Copyright does not protect facts as such. It may protect the expression of those facts, photographs, documents or other reproduced material. Notices are assessed under the applicable law and our published copyright procedure; neither automatic rejection nor an automatic counter-notice is promised. Removing a particular exhibit need not erase a lawfully reportable fact. 5.4 Information: https://phishdestroy.io/gdpr and https://phishdestroy.io/dmca. Privacy requests may also go to privacy@phishdestroy.io; copyright notices to dmca@phishdestroy.io. The form does not restrict other lawful channels. 6. CONTRIBUTORS AND REPRESENTATIVES 6.1 Responsibility for a published finding is addressed through its evidence and this procedure. Private contributors' identities are not published as the price of a correction, a reply or compliance with a binding obligation. 6.2 If identities or mandates are genuinely relevant to resolving a dispute, the parties may agree to reciprocal verification of the involved representatives through independent counsel or another agreed confidential channel. This includes the relevant Valve representatives. Any voluntary disclosure requires a lawful basis, necessity and the affected person's consent where required. It is not an offer to expose unrelated employees. 6.3 A mandatory lawful disclosure obligation is assessed independently. It is not conditional on reciprocal disclosure by the opposing party. 7. RECORD, AUTOMATION AND COPIES 7.1 Accepted submissions receive a timestamped receipt and private tracking key. Hashes identify uploaded bytes. The original signed document is preserved privately so its signature remains verifiable; a separate sanitised working copy may be made. Neither copy becomes public on upload. 7.2 A new request is private, including its existence, identifier, target, dates, status, file hashes and correspondence. There is no automatic public receipt. A separately reviewed correction or permitted public outcome may be released after checking privacy, third-party rights and publication restrictions. A publication preference is permission to consider release, not an instruction to publish immediately. Private and restricted cases cannot be released by the ordinary public-event or file-publication commands. The public corrections log contains only deliberately released entries and policy notices. Its hash chain detects changes against a retained earlier head; it does not prove truth. The system does not submit new heads, requests, uploaded files or affected pages to the Internet Archive or another public archive. 7.3 Software records missed review targets and execution results in the private case timeline. A missed target does not prove a finding false. Verified official decisions are applied through the automated execution system after the issuer, applicability and exact remedy have been confirmed. Public input cannot place itself in the approved execution queue. 7.4 A removal covers identified public copies under our control. A correction replaces the affected content and adds an appropriate erratum. It must also address relevant translations, exports, previews and managed caches. Scope and completion are checked, rather than inferred from a single edited page. 7.5 IPFS publication is content-addressed. A corrected version has a new CID. For managed copies we update the current publication reference and remove our pins to superseded content where required and technically available. A resolver, gateway or pin operation not yet confirmed remains pending. Correcting a mirror does not authorise a public account of the request or a link to the removed edition. No publication notice is added by default. A separately cleared notice must omit case identifiers, private material and links to the withdrawn bytes. Existing third-party archives, independent pins and downloaded copies are outside our direct control. We take the available lawful steps concerning them and do not claim global erasure. 7.6 Administrative notification is queued as soon as an eligible case is recorded and delivery is attempted immediately. Failed transport handoffs are retried. An email contact is optional and used only with the submitter's permission. Case updates, including a decision to seek review or appeal, remain available through the private tracking receipt. Queued, transport-accepted, delivered and read are different states; we do not promise delivery or reading. 7.7 Approved local remedies are executed promptly. Managed mirror work is scheduled for the next 00:00 in Europe/Berlin, or may be run earlier by an administrator. This is a scheduling target, not a reason to miss a binding deadline. Technical failures, missing publisher access and unconfirmed resolver changes remain pending, trigger administrative attention and are retried or handled manually. We take available steps to comply as quickly as possible and report what is still outstanding. Midnight already passed earlier on the day of receipt is not presented as a future execution time. 7.8 Removing public access is distinct from deleting a private legal case record. Private material is retained only where a lawful and necessary basis remains. A publication restriction also applies to the change log, notifications, mirror notices and related disclosures. Execution does not automatically preserve a new backup of removed content: retaining a private execution copy requires a specific lawful reason and a recorded expiry/review date. 7.9 Internal review may use local AI only where it is configured and authorised. Such processing must stay on our infrastructure: submissions must not be sent to an external AI provider. Any AI output is advisory and cannot bypass issuer, jurisdiction, publication-restriction or exact-scope checks. Automatic file checks, private tracking and execution of approved remedies remain separate from the confirmation of an official decision's authenticity and applicability. 7.10 New material for the investigation uses a separate editorial intake at https://phishdestroy.io/steam_dossier/contribute/ . Its temporary notes, publication permission and 7/14-day limits are governed by its own policy, not by the legal-case retention reference in section 9.3. 8. SECURITY AND CONFIDENTIALITY 8.1 Files are format-checked and scanned in an isolated worker. Rejected or quarantined files cannot authorise an execution action. A failed signature is not by itself an allegation of forgery. Suspected forgery is investigated and any disclosure to an authority must have a lawful, necessary basis. 8.2 Mark legally restricted decisions clearly and identify the restriction. Incoming requests remain private while any disclosure is assessed. Do not send unrelated secrets, credentials, fabricated evidence or unnecessary third-party personal data. This procedure does not promise confidentiality against a mandatory applicable legal obligation; disclosure and retention must have a specific lawful basis and be limited to what is necessary. 9. POLICY VERSION AND PRIVACY NOTICE 9.1 This version replaces version 2 for submissions received from its effective date. Earlier policy versions and their signatures remain available. Policy changes are appended to the log, with a hash and signature where provided. 9.2 Accepted submissions are handled to resolve accuracy and legal issues: legal obligation where applicable, otherwise legitimate interests subject to the applicable balancing and safeguards. Contact privacy@phishdestroy.io. Access is restricted to those handling the case and relevant processors. No name or email is required by the form. An optional email and permission to use it are stored privately for case communication. Technical infrastructure and hCaptcha may separately process connection data under their privacy notices. 9.3 Case retention is reviewed against the need to document the publication and resolve or defend claims; the normal upper reference is the publication's lifetime plus three years, not an unconditional requirement to keep every field for that period. Shorter periods, restriction, erasure and legal holds are applied where appropriate. Rate-limit records expire after two days; submission connection hashes are removed after 30 days. Public log material is minimised. Hashes can still be linkable to a known document or person. 10. CONTACT AND SOURCES legal@phishdestroy.io — corrections, decisions and procedural questions. A request outside this form is not automatically registered by this form; the receiving team must register an eligible case. Urgent legal deadlines should be identified clearly. This procedure is not an agreement that every foreign forum has jurisdiction and is not a substitute for mandatory service. GDPR, Articles 12, 17 and 85: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng eIDAS, Regulation (EU) No 910/2014, as amended: https://eur-lex.europa.eu/eli/reg/2014/910/oj/eng Copyright facts/works distinction: https://www.copyright.gov/help/faq/faq-protect.html Current OFAC programmes (comprehensive and targeted): https://ofac.treasury.gov/sanctions-programs-and-country-information IPFS persistence: https://docs.ipfs.tech/concepts/persistence/