Privacy Policy

This Privacy Policy applies to The Unverified File website, community and research features, and authorized social publishing tools operated by Null Records (“we,” “us,” or “our”). It does not govern third-party sites or platforms that we link to.

In brief: we collect only the information needed to operate these features, do not sell personal information, do not automatically publish raw incident submissions, and use social-account data only to provide actions an authorized user requests.

1. Information we collect

Website and device information

Our hosting, security, and analytics providers may process IP address, browser and device type, approximate location, referral page, pages viewed, timestamps, request logs, and similar network or usage information. The site may use browser storage for operational features such as cache timing.

Incident reports and other submissions

If you submit an incident, source, comment, correction, photograph, or video, we receive the information you provide. This may include a description, date and time, location, source URLs, media, provenance details, and an optional email address. Raw submissions enter a restricted review queue and are not automatically published. If we publish a sanitized report, we do not intentionally include private contact details or precise coordinates unless there is a documented editorial reason and appropriate permission.

Community votes

When you vote on a case or request an investigation, we store the selected vote and associated event identifier in Cloudflare D1. The service may also process limited request metadata needed for abuse prevention, reliability, and security. Votes are community signals, not identity profiles or factual determinations.

Comments and verification

Published comments include the display name and text you submit. Before accepting a comment, we require either a Cloudflare Turnstile spam check or a successful account check with Bluesky, X, or Reddit. A social access token is sent securely to our API, used once to ask that provider who the signed-in account is, and is not stored. We may publish the verified provider and account handle beside the comment. Limited one-way request fingerprints are used for rate limiting.

Authorized social publishing

If an authorized publisher connects a TikTok or other supported social account, the platform may provide us with an account identifier, display or creator information, granted permissions, access and refresh tokens, available privacy or interaction settings, and publishing-status information. We also process the media, caption, links, scheduling choices, and destination settings the authorized user selects.

We use this information only to authenticate the connected account, show the user the available publishing choices, send content at the user’s direction, check publishing status, troubleshoot failures, and maintain security and audit records. We do not ask for the user’s third-party password. We do not use connected-account data for advertising or sell it.

Public research data

Our research pipeline collects public records and publicly accessible source material, including government reports, news articles, public web pages, and public social-media links. We record provenance and canonical source links where possible. Public availability does not remove privacy or intellectual-property rights, and we review removal or correction requests.

2. How we use information

• operate, secure, troubleshoot, and improve the Services;
• review submissions, investigate claims, detect duplicates, and maintain evidence provenance;
• aggregate community votes and prioritize requested investigations;
• perform authorized social-account connections and user-directed publishing;
• measure site performance and understand aggregate readership;
• respond to privacy, correction, security, and rights requests; and
• comply with law and enforce our Terms of Service.

Local or hosted AI may help classify, translate, summarize, or find candidate connections in research material. AI output is treated as a lead and is subject to editorial review. We do not treat an AI inference about a person as verified fact.

3. When information is shared

We do not sell personal information. We disclose information only as needed:

• Service providers: Cloudflare provides delivery, security, APIs, and database services; GitHub may host static site files; analytics and content-delivery providers process technical requests.
• At your direction: when an authorized user requests publication, selected content and settings are sent to TikTok or another chosen platform.
• Public publication: an editor-approved, sanitized submission or public research record may be published with source attribution.
• Legal and safety reasons: we may disclose information when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or secure the Services.
• Project transfer: information may transfer with the project in a merger, reorganization, financing, or sale, subject to this Policy or notice of a replacement policy.

Third-party platforms process information under their own policies, including TikTok’s Privacy Policy, Google’s Privacy Policy, and Cloudflare’s Privacy Policy.

4. Retention

Pending raw incident reports are generally scheduled for deletion after 90 days unless they remain under active review. Rejected reports are generally scheduled for deletion within 30 days after review. Information supporting an approved investigation may be retained for up to one year or longer when needed for the public record, provenance, legal compliance, security, or a documented editorial purpose.

Community votes may be retained in aggregated or event-level form for the life of the related feature. Social authorization tokens are retained only while needed to provide the connected publishing feature and are deleted or rendered unusable after disconnection, revocation, expiration, or when no longer needed, subject to short-lived backups and security logs. Published content may remain on the destination platform until removed there.

5. Your choices and rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, or a portable copy of personal information. You may also:

• decline optional contact information when submitting an incident;
• control analytics through browser or provider settings;
• revoke a connected social account through that platform’s security or connected-app settings; and
• request deletion of associated authorization data by emailing us.

Send requests to privacy@unverifiedfile.com. We may need to verify that you control the relevant email address, submission, or connected account. We will not discriminate against you for exercising an applicable privacy right.

6. Security

We use reasonable administrative and technical safeguards, including HTTPS, access controls, restricted review queues, scoped platform permissions, and secret storage outside public site files. No system is perfectly secure. Report suspected vulnerabilities to security@unverifiedfile.com.

7. International processing

Our providers and public sources may operate in multiple countries. Information may therefore be processed outside your jurisdiction, where privacy laws may differ. We use the information only for the purposes described here and apply reasonable safeguards appropriate to the service.

8. Children

The Services are not directed to children under 13, and we do not knowingly collect their personal information. Contact us if you believe a child has submitted personal information so we can review and delete it.

9. Changes to this Policy

We may update this Policy as the Services or legal requirements change. We will post the revised policy at this URL and update the effective date. Material changes may receive additional notice where appropriate.

10. Contact

Privacy questions and requests: privacy@unverifiedfile.com.