Privacy
What we collect, and the legal basis for it
This site is a static reference index. It has no accounts, no login, no advertising, and no cookies of its own. The short version: unless you write to us or use a form, we hold nothing about you beyond ordinary server logs.
Who is responsible
The data controller is Antonio Radu, an individual operating ClickFixReport as an independent security-research project. Contact: privacy@clickfixreport.com. A postal address is provided on request to that address. There is no data protection officer; the project is far below the threshold at which one is required, and correspondence reaches the controller directly.
What we collect
| Data | Purpose | Retention |
|---|---|---|
| Email address you give on a submission, or in an email about a listing | To reply to you and to check a claim about a listing | Automatically erased 90 days after the case is resolved |
| The content of what you submit | It is the record of the report or dispute and its outcome | Retained as part of the audit trail, without your address |
| Email you send us directly | Correspondence | Kept while relevant; deleted on request |
| Server request logs, including IP address | Operating the site, diagnosing faults, blocking abuse | Short operational retention by our hosting provider |
The 90-day erasure is not a policy we promise to remember. A scheduled job nulls the address column 90 days after a submission is marked resolved, whether or not anybody thinks about it that week.
Cookies: there are none, so there is no banner
ClickFixReport sets no cookies and stores nothing in your browser. There is no analytics tag from an advertising company, no social media pixel, no session identifier, and no fingerprinting.
As of the review date below there is no analytics product installed at all, so the only record of your visit is the request log described above. We intend to add Vercel Web Analytics, which is cookieless, builds no profile and does not follow you between sites. When it goes in, this page changes first, and the row for it appears in the table above.
That is why you were not asked to accept anything. A consent banner on a site that sets no cookies is theatre, and it teaches people to dismiss the banners that do matter. If this ever changes, the banner will appear before the cookie does.
Legal basis
- Legitimate interests, Article 6(1)(f) — for publishing security research, for operating and securing the site, and for the request logs that make that possible. The interest is network and information security and public documentation of an active attack technique. A written balancing assessment is on file and available on request.
- Consent, Article 6(1)(a) — for the email address you choose to give us on a form or in a message. You can withdraw it at any time by asking, and withdrawal costs you nothing: your report stays in the record, your address does not.
When the dataset itself contains personal data
Sometimes it does, and pretending otherwise would be dishonest. An indicator can be an email address. A registration record can carry a person’s name. A compromised website can be somebody’s personal blog.
Where that happens the data is published under legitimate interests, it always comes from an already-public report by a named third party, and it is presented as a dated observation rather than an accusation — see the disclaimer. If you are named in an entry and want it removed, write to privacy@clickfixreport.com or use /dispute. We weigh your interests against the public interest in the record, we do that case by case rather than by policy, and being the victim of a compromise weighs heavily in your favour.
Your rights
If the GDPR or UK GDPR applies to you, you have the right to access your data, to have it corrected, to have it erased, to restrict or object to processing, and to receive it in a portable form. You also have the right to complain to your national supervisory authority, and you do not have to raise it with us first — though we would rather you did, because it is faster.
Exercise any of these by writing to privacy@clickfixreport.com. We answer within 30 days, usually much sooner, and we do not ask for identity documents unless the request would expose somebody else’s data.
Who else touches the data
| Processor | Role | Region |
|---|---|---|
| Vercel | Hosting and request logs | United States and EU regions |
| Supabase | The database behind the site | EU region |
| Resend | Transactional email — configured, but nothing has been sent | United States |
| Cloudflare | Authoritative DNS only — traffic is not proxied through it | Global |
Where a processor is outside the EEA, transfers rely on the European Commission’s standard contractual clauses and the provider’s own transfer framework. We do not sell data, we do not share it with advertisers, and there are no advertisers to share it with.
Children
This site is aimed at security practitioners and at people trying to work out what just happened to their computer. It is not directed at children and we do not knowingly collect data from them.
Changes
Material changes to this notice are dated here and, where they affect what we do with data already held, noted on /corrections. The review date below is the authoritative one.