Legal

Privacy notice

This notice describes the data AntiNCII stores when you open or track a case. It is written for a Cloudflare Workers + D1 deployment.

What we collect

• Optional email, used only to send the case number
• Wizard answers and the platforms you select
• PDQ fingerprints for photos or MD5 fingerprints for videos, plus file size, media type, and a generic file label
• Case status, public notes, internal reviewer notes, and a hashed password
• A short-lived CSRF cookie and, when configured, a reCAPTCHA token
• A hashed IP address used only for short-term rate limiting
• Partnership inquiries: name, email, organization, optional website, partnership type, and the text you send about cooperation

What we do not collect

We do not upload, receive, or store the intimate photo or video. Answers that indicate a minor is involved, a third-party subject, or non-intimate media are not stored as a case; the form is refused. We cannot recover a case number or password. We never email the password.

Why we use the data

To operate the case queue, show you status, send the case number if you asked for it by email, share fingerprints (never the media) with participating platforms for match-on-upload blocking, reduce abuse of the intake form, and reply to partnership requests.

Where it is stored

Case records are stored in Cloudflare D1 bound to this Worker. Passwords are stored as PBKDF2 hashes with a unique salt, not in plain text. Optional email for the case-number message may pass through SendGrid and is then deleted from the case record after about three days.

Sharing

We do not sell case data. Reviewers with the admin secret can read cases. Fingerprints may be shared with participating platforms so they can detect matching uploads. The original photo or video is never shared. We may also disclose information if required by law or to protect someone’s safety.

Retention

Cases remain until a reviewer closes and later deletes them, or until you withdraw the case from the status page. Withdraw deletes the case and the fingerprints we hold, and we request deletion from partners that received those fingerprints. Optional email is deleted after about three days even if the case remains.

Contact

Privacy requests: ceo@antincii.org. See also the Contacts page. Do not email intimate photos or videos.