Privacy Policy

We only collect what is necessary to provide the service. By source:

• Account data: the email address and password you use to register (passwords are stored as irreversible hashes and cannot be recovered by us); or the display name, avatar URL and email returned by Google / GitHub if you sign in with them.
• Content you submit: dispute reports, deal listings, directory applications, feedback and any screenshots attached as evidence. Once reviewed, this content may be published.
• Authenticity check records: the time of the check, the target endpoint, the model selected, probe verdicts and scores. The API key under test is never written to our database — only redacted metadata is kept for accounting and de-duplication.
• Order data: order number, item, amount, payment status and the payment provider's transaction reference. We never see or store your card number or payment credentials; those are handled by the payment provider.
• Technical data: request time, path, browser User-Agent and source IP. IP addresses are used only for rate limiting and abuse prevention, and are stored as a truncated SHA-256 digest — never in plain text.
• Unlock records: which deal's contact info you viewed, when, and whether it used a paid credit or a free allowance. These records are used only to avoid charging you twice for the same deal, to reconcile credits and to investigate abuse; they are never shown publicly or used for profiling.
• Cookies: the encrypted session cookie required for signing in, plus a local-storage entry remembering your light/dark theme preference.

The information above is used solely for the following purposes:

• Providing the service: registration and sign-in, displaying your submissions and check records, delivering the credit packs or listing slots you purchased.
• Content moderation: human or model-assisted pre-review of submissions to detect contact details, unlawful material or unsubstantiated accusations.
• Security and anti-abuse: rate limiting and detection of automated scripts or bulk manipulation.
• Aggregate analytics: understanding traffic and page usage in aggregate. We do not build individual profiles and make no automated decisions about you.
• Necessary notices: transactional email such as address verification, password resets and order status. We do not send marketing email.

We do not sell or rent your personal information. We share the minimum necessary data with the following third parties, only where a feature requires it:

• Identity providers (Google / GitHub): only when you choose them, to verify your identity and obtain your display name, avatar and email.
• Payment providers (e.g. EPay, Stripe): to create orders and receive payment notifications; we share the order number and amount.
• Email provider (SMTP): to deliver verification, password-reset and other transactional messages; we share the recipient address.
• Object storage: to hold the screenshots you upload. If not configured, images are stored on our own server.
• Content pre-review model service: the title and body text of a submission may be sent to the configured model endpoint for compliance screening.
• Web analytics (e.g. Umami, Google Analytics, Baidu Tongji, Microsoft Clarity): enabled at the administrator's discretion for aggregate traffic statistics. Whether they are active is visible in the page source.
• Legal requests: where we receive a valid judicial or administrative request, we will provide the required information to the extent required by law.

Different categories are kept for different periods:

• Account data: kept while the account exists. When you close your account we delete or anonymise the fields that identify you.
• Published records and evidence: because they carry ongoing public reference value, they may be retained after a submitter closes their account, but they are unlinked from your identity.
• Orders and transactions: retained for no less than three years from creation, to meet accounting and tax obligations.
• IP digests and rate-limit counters: short-lived, typically expiring within hours to days.

Using the contact details at the end of this page, you may ask us at any time to:

• tell you what information we hold about you;
• correct information that is inaccurate;
• delete your submissions or close your account;
• withdraw consent you previously gave (withdrawal does not affect processing already carried out);
• object to the content of a published record or request its removal, with supporting evidence.

We apply reasonable technical and organisational safeguards: passwords are hashed, sensitive configuration is stored encrypted, API keys under test are never persisted, traffic is served over HTTPS and administrative actions are permission-controlled. No transmission over the internet is ever completely secure, so we cannot guarantee absolute safety. If a breach occurs that may affect your rights, we will post a notice on the site and inform affected users as soon as practicable.

This site is not directed at children under 14. If you are a minor, please use the site under the guidance of a guardian. If we learn that we have collected a minor's information without a guardian's consent, we will delete it promptly.

Some of the infrastructure and third-party services we rely on (sign-in, payment, email, object storage, analytics) may be located outside mainland China, and data will be processed on those services' servers. By continuing to use the site you acknowledge and accept this necessary transfer.

When our features or data practices change materially, we will update this policy and the date shown at the top. Significant changes will be highlighted on the site. Continued use of the site constitutes acceptance of the updated policy.

For any question, complaint or rights request regarding this policy or your personal information, contact us at:[email protected]. We will respond within a reasonable time after verifying your identity.