Privacy
This is what investigateit.org does with information about you. It is short because the site does very little. The workspace itself is not built yet, so nothing here is about your investigations: that will get its own policy before anyone can put a case into it.
Who is responsible
Šimon Pokorný, an individual in the Czech Republic, is the data controller for everything described on this page. There is no company behind this yet and no team: I run the site, the server and the mailbox myself.
The address for anything on this page is privacy@investigateit.org.
What this covers
investigateit.org, the pages served from it, and the waitlist behind the signup form. That is the whole of what exists today, and so it is the whole of what this page describes.
What the site puts in your browser
No cookies. Nothing is set for advertising, measurement or sessions, which is also why there is no consent banner: there would be nothing for you to consent to.
The page does keep a few values in your browser’s own storage. They stay on your machine, they are never sent anywhere, and clearing site data in your browser removes all of them.
- investigateit.name
- The name you type onto the card in the opening sequence, so the page still knows it if you come back. Optional. The page works without it.
- investigateit.mode
- Whether you chose the cinematic or the classic version of the page, so it opens the way you left it.
- investigateit.switch
- Session storage. Your scroll position across the reload when you switch between those two versions. It is gone when you close the tab.
- investigateit.wl
- A random token you are given if you join the waitlist. It is the only thing that can remove you from the list afterwards, which is how removing yourself works without an account.
- investigateit.debug
-
Only if you open the performance panel yourself, with
Ctrl+Shift+D or a
?debugaddress. It remembers that the panel was open. Nothing is measured unless you ask for it.
What the waitlist does
When you submit the form, your address and any optional answers are
encrypted in your browser, before
anything is sent: an ephemeral ECDH P-256 key exchange
against a public key printed in the page source, then
HKDF-SHA-256 and AES-256-GCM. The server
appends the result and cannot read it. The key that opens it exists
on one laptop and has never been on the server.
Two identical addresses seal to completely different ciphertext, so the server cannot even tell whether the same person signed up twice.
What the server stores:
- the sealed blob and the time it arrived, nothing about what is inside it
- the random token it hands back to you, so you can undo this
What it sees and does not keep:
- your IP address, which is hashed with a salt regenerated every time the process restarts, held in memory only, and never written to disk. It exists so a public endpoint can be rate limited, and for nothing else.
- two anti-spam signals carried outside the sealed blob: a field that only an automated submitter fills in, and how long the form was open before you sent it. Both are checked and discarded.
The web server in front of it keeps no access logs. That is a configuration choice, not something the encryption enforces.
The limit, stated plainly, because you would find it anyway: whoever controls that server also serves this page, and could serve a version that captured addresses before sealing them. Encrypting in the browser protects you from a breach of the server and from anyone who walks off with a copy of the database. It does not protect you from me.
What you will get in the post
Two emails: one from me before launch, and one when it opens. Both are written and sent by hand from an ordinary mailbox. There is no mailing platform, no tracking pixel, no open or click measurement, and the list is never rented, sold or shared with anyone.
If you ticked the box about testing an early build or taking a call, I may write once more about that. That is the whole of it.
One consequence worth saying out loud: once I have written to you, your address is also sitting in my mailbox, which is a normal email account and not encrypted the way the list is.
How long any of it is kept
The list exists to tell people that the thing they waited for is open. It is not kept past the beta: once it has done that, the database is deleted.
You can leave before then, at any time, without asking me. Open the signup form again in the browser you used and there is a button to remove yourself. It deletes the row outright.
If you cleared your browser storage, or you are on a different machine, write to privacy@investigateit.org with the address you signed up with. I have to decrypt the export on my own machine to find it, and then the row goes.
Who else your browser talks to
Nothing. Every file these pages need is served from the machine this site runs on: the typefaces they are set in, and the two graphics libraries the opening sequence on the front page runs on. There is no font host and no content network in any page here, so no company other than the one below learns that a browser at your address opened this site.
- Hetzner Online GmbH, Nuremberg
- The machine this site is served from, and the only place the sealed entries are stored. It can see your IP address and your browser’s user agent, as any host you connect to can. Germany, so inside the EU.
There is no analytics, no tag manager, no advertising or attribution script, no social embed, no session recorder, no chat widget and no CAPTCHA. Not on this page and not on any other.
This was the one real gap on this page and it is worth saying what changed: the typefaces used to come from Google and the libraries from jsDelivr, which meant two companies learned your address every time anything here loaded. They are served from here now. The typefaces are the same files, unmodified, under the open licences they were published with, which sit beside them on this server.
Legal grounds
- Consent, Article 6(1)(a) GDPR, for the waitlist: you typed an address into a form whose only purpose is to be written to. You can withdraw it at any moment, and section 06 says how.
- Legitimate interest, Article 6(1)(f) GDPR, for the hashed IP used in rate limiting: keeping an open endpoint from being flooded, by the least identifying method I could find.
Nothing is profiled, no decision is made about you automatically, and no special category of data is asked for anywhere.
Your rights
Under the GDPR you can ask for a copy of what is held about you, ask for it corrected or deleted, object to it being processed, ask for it in a portable form, and complain to a supervisory authority.
The practical note is that I cannot look you up. The list is a pile of ciphertext with no index and no search, so any request means telling me which address you used and me decrypting the export to check. That is the cost of building it this way, and it is the right trade.
The Czech supervisory authority is the Úřad pro ochranu osobních údajů (uoou.gov.cz). You may also complain to the authority where you live.
Changes to this page
If this page changes, the date under the title changes with it. Anything that would alter what happens to an address already on the list would be an email, not a quiet edit.
Getting in touch
privacy@investigateit.org for anything on this page.
security@investigateit.org if you found a flaw in the encryption or the server. I would much rather hear it from you than from a breach.
simon@investigateit.org for everything else. It is my own inbox and I answer it myself.