Privacy Policy

1. Scope

This policy covers exoliner.net (the "Site"), operated by serversiding.xyz. It explains what we process about people who visit the Site and what rights you have. For the separate question of personal data about third parties that appears in the published records, see section 6.

2. Our approach

The Site is built to collect as little as possible. It has no accounts, no sign-ups, no advertising, and no cross-site tracking. We do not sell personal data, and we do not use third-party analytics to profile you.

3. What we process about visitors

Information you send us. If you email us, we receive your email address and whatever you choose to put in the message. We use it only to reply and to keep a record of the request.

Hosting and security logs. Our host (Vercel) and network provider automatically log standard request data, such as your IP address, browser user-agent, the pages requested, and timestamps. This is used to serve the Site, keep it available, and protect it from abuse.

Browser check. Before showing certain pages, the Site runs a Cloudflare Turnstile check to tell humans from bots. Cloudflare processes your IP address and browser signals for that check. See Cloudflare's own privacy documentation for how it handles that data.

Lookups. When you search the breach data, we log the search to watch for abuse and to power a live "recent searches" ticker. Each entry holds the search term, your IP address, an approximate location derived from it (city, region, and country), and a rough result count, and is kept only for a limited time. The public ticker shows that approximate location and a masked label (a username, or a generic word for an email or id), never your IP or a full email address. The location comes from your IP via our network provider and is approximate, not your exact position.

Abuse prevention. To stop the Site being scraped or overloaded, we count recent requests against a short-lived, hashed record of your IP address. This holds a counter, not your searches, and it expires within minutes.

4. Cookies

The Site uses a small number of functional cookies, including one that records that your browser passed the human check so you are not asked again for a few minutes. It sets no advertising or cross-site tracking cookies. The full list is in our Cookie Policy.

5. Why we process it (legal bases)

Where the GDPR or UK GDPR applies, we rely on these bases:

• Legitimate interests — operating, securing, and maintaining the Site, and documenting a matter of public interest, balanced against your rights;
• Legal obligation — keeping records we are required to keep and responding to lawful requests;
• Consent — where we ask for it, which you can withdraw at any time.

6. Data about third parties in the records

The searchable records describe a data breach and include personal data about people other than the visitor. We publish these records as an exercise of freedom of expression and in the public interest, to document a security incident and a service's conduct, relying on the journalistic, academic, and special-purpose provisions that apply to that kind of processing. We do not publish them to target anyone, and our Terms forbid using them to do so.

If you are in the data. You can ask us to review an entry about you, correct it, or take it down. Email legal@exoliner.net with enough detail to find the entry (for example, the username) and tell us what you want and why. We weigh each request against the public interest in the record, and we will tell you the outcome. We do not require you to prove your identity in a way that would itself expose more data than necessary.

7. Who we share it with

We do not sell personal data. We share it only with the service providers that run the Site on our behalf (such as our host and the bot-check provider), each bound to handle it only as we instruct, and where we must to comply with the law or a valid legal request, or to protect the Site, its users, or the public.

8. International transfers

The Site is hosted on infrastructure that may process data in the United States and other countries. Where data moves out of your region, we rely on the appropriate safeguards our providers put in place, such as standard contractual clauses.

9. How long we keep it

Hosting and security logs are kept only as long as our providers retain them for operational and security purposes, then deleted or anonymised. Emails are kept as long as needed to deal with your request and to keep a reasonable record of it.

10. Security

We take reasonable measures to protect the Site, including serving everything over encrypted connections and limiting access. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security.

11. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive a copy in a portable form, and to withdraw consent. Where the CCPA applies, you may ask what we have collected, ask us to delete it, and know that we do not sell it; we will not discriminate against you for asking.

To exercise any of these, email legal@exoliner.net. We will respond within the time the law allows. Some rights are limited where the data is processed for journalistic or public-interest purposes, in which case we will explain why. If you are in the EU or UK, you also have the right to complain to your data protection authority.

12. Children

The Site is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has sent us personal data, contact legal@exoliner.net and we will delete it.

13. Changes to this policy

We may update this policy. The "last updated" date above shows the latest version, and material changes will be made clear on the Site.

14. Contact

For any privacy question or request, email legal@exoliner.net.