Privacy policy

1. Who we are

[NE]legalus is a platform for reporting potentially illegal online content, conducting human review and publishing only confirmed domains in a public register and machine readable feeds.

For questions about data, contact the platform administrator using the account email specified during deployment, or the project repository maintainer.

2. What data we collect

• Account data: email, name and profile image from Google or Microsoft OAuth where enabled; the name, email and password hash provided through the registration form. Passwords are not stored in plain text. The registration request stores an optional purpose of use, status, administrator note and decision time.
• Reports: URL, domain, category, the description or evidence you provide, status and review note.
• API keys: only the key hash and prefix are stored. The full key is shown once when it is created.
• Audit log: administrative and review actions, including who acted, when and what they did.
• Registration decision emails: recipient email, greeting name and registration approval or rejection message. Email status, attempt count and times, next retry time, email provider, provider message identifier and technical error code are processed to manage delivery attempts.
• Technical logs: standard server infrastructure access logs from Vercel and the database. A hashed email or client IP identifier, request count and rate limit window end are stored to limit the frequency of sign in and registration attempts.

The browser extension does not send the full page content to the [NE]legalus server. It sends only the URL and fields you enter. Optional LLM analysis communicates directly with your chosen provider only after separate confirmation in the extension. Before sending, you can review and edit the visible or selected text, URL, provider address and model. The URL fragment and known sensitive parameters are removed, but you must check the remaining parameters yourself.

3. Purposes and legal basis

• Account and authentication management (contract or legitimate interest).
• Notification of registration approval or rejection (account management).
• Accepting and reviewing reports and publishing the register (legitimate interest and public interest in tackling illegal content).
• Security, abuse prevention and auditing (legitimate interest).

4. Public register

Confirmed records, including domain, URL, category, decision date and review note, may be publicly visible on the website and in JSON/XML feeds. The reporter’s email is not published.

5. Storage and security

Data is stored in PostgreSQL, for example Neon, and processed on Vercel infrastructure. We use role based access controls (USER / FC / ADMIN), API key hashing, administrator TOTP MFA and basic HTTP security headers.

A registration request does not grant account access or access to API keys. An account is created only after an administrator approves the request. The password hash is then transferred to the account and removed from the request. A rejected request also has its password hash removed.

When email delivery is configured, the registration decision email is passed to the selected email service or SMTP provider, which processes the data to send the notification. The provider receives the recipient email address, greeting name, subject, plain text and HTML content. Approval emails contain public links to sign in and create an API key. Administrator notes, the registration purpose, passwords and API key values are not included in these emails.

Delivery status and technical metadata are used to identify sending errors and manage retries. A status of ‘Submitted to email provider’ means the provider accepted the message. It does not confirm delivery or that the message was read.

Local extension data

API keys, settings, a register copy and an unsent report draft are stored on your device. API keys are held in local Chrome storage accessible only to trusted extension contexts. They are not synced with your Chrome account. Chrome may sync settings that are not secret. Resetting settings removes the keys, and removing the extension removes its local data. Submitted platform reports and data held by an LLM provider are managed by their respective recipients.

The extension does not collect browsing history or use advertising analytics. The current domain is compared with the downloaded register on your device. URL and content data are used only for the register checks, reporting and optional LLM analysis you choose. They are not sold or used for advertising, creditworthiness or lending decisions. Data use complies with the Chrome Web Store User Data Policy, including Limited Use requirements.

6. Your rights

Under the GDPR, you can request access to, correction of, restriction of processing of or deletion of your data where this does not conflict with legitimate security or audit interests. Contact the administrator. You can also revoke your API keys on the account page.

7. Cookies

We use session and authentication cookies required for the service. The platform does not use marketing or tracking cookies.