Privacy Policy

Introduction

PhishIndex ("we", "us", "our") operates this website and a browser extension. This Privacy Policy explains what information we collect, why we collect it, how we use it, with whom we share it, how long we retain it, and how you may exercise your privacy rights.

Controller & Contact

• Controller: PhishIndex
• Contact email: [email protected]

Definitions

• Technical information: This means your IP address, browser type and version, operating system, device identifiers, network data, and other technical metadata.
• Processing: Any operation performed on personal data, whether or not by automated means.
• Controller: The entity that determines the purposes and means of the processing of personal data.

Information We Collect & Purposes and Legal Basis

• Website: We collect certain Technical information, such as your IP address, browser type and version, operating system, device identifiers, network data, and other technical metadata, when you visit our website. We rely on legitimate interest to process this information for the purposes of providing our website and tools, and for ensuring the security, reliability, and performance of our website and tools.
• Form submissions: We collect data submitted through forms on our website, such as your email address, any content you provide via the forms, and certain Technical information. We rely on user consent to process this information for the purpose of responding to your inquiries or reports.
• Data Processing Tools: These tools (including Base64, hashing, defanging, extraction, and generation utilities) process all data entirely within your browser. No information you enter is transmitted to us or to any third party.
• Password Checker tool: We do not intentionally collect or store plain-text passwords, as password processing occurs entirely within your browser. However, for the password breach check feature, your browser transmits the first five characters of the SHA-1 hash of the password you entered, together with certain Technical information, to the Have I Been Pwned service. Neither we nor the Have I Been Pwned service obtains your full plain-text password, and only the Have I Been Pwned service receives the first five characters of the SHA-1 hash. We rely on user consent to process this information for the purpose of providing this feature.
• Browser extension: The Malicious URL Blocklist feature downloads a list of domains from GitHub; GitHub may receive certain Technical information when the extension retrieves that list. We rely on user consent to process this information for the purpose of providing this feature.

Data Sharing with Third-Parties

• We do not sell or rent your personal data. We do, however, share certain data with the following third parties in order to provide our features and services. Their respective privacy policies are available at the links below.
• Website data is shared with Cloudflare, which provides website hosting, security, and bot protection. They use this data in accordance with their privacy policy which can be found at https://www.cloudflare.com/privacypolicy/
• Form submission data is shared with Formspree, which processes form submissions on our behalf. They use this data in accordance with their privacy policy which can be found at https://formspree.io/legal/privacy-policy/
• Password Checker tool data, specifically relating to the password breach check feature, is shared with Have I Been Pwned. They use this data in accordance with their privacy policy which can be found at https://haveibeenpwned.com/Privacy
• Browser extension data, specifically relating to the malicious URL blocklist feature, is shared with GitHub. They use this data in accordance with their privacy policy which can be found at https://docs.github.com/site-policy/privacy-policies/github-privacy-statement

Data Retention

• Data is retained for as long as necessary to provide our services and to comply with applicable legal obligations.

International Transfers

• Data may be processed in, or transferred to, countries outside your jurisdiction. Where such transfers occur, we apply appropriate safeguards.

Your Rights

• Depending on applicable law, you may have the right to access, correct, delete, or restrict the processing of your personal data, to receive a copy of it, to object to its processing, to opt out of its sale or sharing, and to lodge a complaint with a supervisory authority.
• To exercise these rights, please contact us at [email protected].
• We will respond to all such requests in accordance with applicable law.
• These rights apply to your personal data and do not affect the license you grant us over feedback and suggestions you submit, as described in our Terms of Use.

Children

• Our services are not directed to individuals under the age of 18.
• We do not knowingly collect personal information from individuals under the age of 18. If we become aware that we have collected such data, we will delete it.

Security

• We implement reasonable administrative, technical, and physical safeguards appropriate to the associated risk.
• No method of transmission over the internet is entirely secure; accordingly, we cannot guarantee absolute security.

Cookies and Third-Party Content

• We do not set first-party cookies.
• Third-party cookies may be set by Cloudflare for security purposes. These cookies are strictly necessary to protect our contact forms from abuse and are therefore set regardless of consent choices, consistent with the strictly-necessary-cookie exemption under applicable cookie law. We also rely on our legitimate interest in protecting the website and its data as the legal basis for this processing.

Changes to This Policy

• We may update this Privacy Policy from time to time. Continued use of our services following any such update constitutes your acceptance of the revised policy.

How to Contact Us

Please contact us at [email protected] or through the contact form on our website.