Privacy & data use

What is stored

• Your reference number, generated at submission (for example 7KQX-2M4P).
• The WhatsApp number you entered with the country code you selected, the currency and the amount, and the account, crypto address or website you named. Every field of the form is required before a clue can be sent.
• The description of what happened, exactly as you wrote it.
• The date and time of submission.
• Your IP address, and a one-way salted hash of it used for rate limiting.
• Your browser's user-agent string (needed to tell abuse from real submissions).
• A visit counter keeps one salted hash of your IP address per visitor, only to count how many people open these pages. It uses no cookie, stores no IP address in plain text and is never linked to a report.

Nothing else is collected on this server: no login, no profile of you, no cookie set by us, nothing sold.

Advertising pixel (Meta)

These pages load the Meta pixel (Facebook) so that we can measure whether our advertising works. When a page opens, your browser connects to Meta Platforms Ireland Ltd. and reports two things: a page view, and — only when you complete a submission — that a report was sent. A second submission of the same WhatsApp number is not reported again.

No part of your report reaches Meta: the pixel carries those two events and nothing else — no WhatsApp number, no amount, no account and no description. It does set Meta's own cookies, and Meta may link the visit to your Facebook or Instagram account. Meta is an independent controller for that data — see facebook.com/privacy/policy.

You can block it without losing anything: tracking protection, a blocker add-on or a browser that refuses third-party cookies stops the pixel, and the report form works exactly the same.

The country code and the currency the form starts with are only a guess: the web server looks up the country of your IP address in an offline database, and if that says nothing it falls back to your browser language. The guess pre-selects two dropdowns, you can change both, and it is never stored — no IP address is kept for it and no outside service is asked.

Why it is stored

• To check the tip. Investigators need the details you provided to compare them with other reports about the same account.
• To answer your lookup. The reference number and WhatsApp number are what you use on the check status page.
• To stop abuse. Rate limits use the IP hash, so a flood of fake submissions cannot bury real ones.

One WhatsApp number, one report

If the same WhatsApp number is submitted again, the new text is not stored. The system recognises the number, keeps the first report and returns the original reference number. This is deliberate: it stops duplicates from diluting an investigation.

How long it is kept

• Reports: 24 months from submission (storage limitation, Article 5(1)(e) GDPR), then deleted by staff. Deletion is a manual task: no scheduled job removes reports automatically.
• Lookup log (reference, IP hash, found/not found): 7 days, then deleted automatically.
• Submission log (rate-limit and abuse events): 30 days.
• Visit counter (salted hash of the IP address only): kept without a time limit so that the same visitor is never counted twice; it holds no reference to your report.

Retention is a policy of this service, not a hard limit of the database. Ask for a copy or deletion earlier and it will be honoured (see below). Staff can also erase every stored report at once from the admin area, which empties the clue table in a single step.

Who can see it

• Authorised investigators handling fraud reports.
• Nobody else. Reports are not sold, shared or published.
• The database file sits outside the web root and cannot be downloaded over HTTP; the server refuses requests for database, log and backup files.

How it is protected

• The submission endpoint accepts POST only, validates every field and writes through parameterised statements.
• Duplicate submissions are rejected before anything is written.
• Anonymised lookups: status pages are rate-limited, and a report is shown only when reference number and WhatsApp number both match.
• The database is limited to the web-server account and stored on the private network.

Legal basis

• Reports of a suspected fraud. Article 6(1)(e) GDPR — processing necessary for a task carried out in the public interest or in the exercise of official authority — where this service is run by, or on behalf of, a public authority. Otherwise Article 6(1)(f) GDPR — the controller's legitimate interest in preventing and investigating fraud. Point (f) does not apply to processing carried out by public authorities in the performance of their tasks.
• Descriptions of a suspected offence. A report may describe a criminal offence. Under Article 10 GDPR such data may be processed only under the control of official authority, or when Union or Member State law authorises it with appropriate safeguards.
• Voluntary reports. Sending a report is voluntary; for its content the processing also rests on your consent (Article 6(1)(a) GDPR). You may withdraw consent at any time (Article 7(3)) without affecting processing carried out before the withdrawal.
• Abuse prevention. The IP hash, the user-agent string and the submission log are processed under Article 6(1)(f) GDPR (network and information security, Recital 49) and protected as required by Article 32 GDPR.
• No automated decisions. There is no profiling and no automated decision-making within the meaning of Article 22 GDPR.
• Report data. No transfer outside the EU/EEA. Everything you type into the form stays on the server described on this page — there is no third-country transfer of report data under Chapter V GDPR.
• Advertising measurement. The pixel described above sends a page view and a completed submission to Meta Platforms Ireland Ltd. and its US group companies. The basis is Article 6(1)(f) GDPR — measuring our own advertising — with Meta's transfer safeguards under Chapter V GDPR (Article 46). It carries none of your report.

Your rights

• Access (Article 15), rectification (16), erasure (17), restriction of processing (18), data portability (20) and objection (21) GDPR.
• Withdraw consent at any time (Article 7(3)).
• Lodge a complaint with a supervisory authority (Article 77 GDPR) — in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.
• Requests are answered within one month; for complex requests that period may be extended by two further months (Article 12(3) GDPR).

Your choices

Quote your reference number to ask for a copy of what is stored, a correction, or deletion. Deleting a report also removes it from status lookups.