Privacy policy

• No user accounts, no passwords, no sign-in of any kind.
• No advertising network, no advertising identifiers, no data sold or shared with a broker.
• No third-party share widgets. Share links are plain intent URLs that run no script.
• No chat, no session recording, no heatmap, and no fingerprinting to follow a visitor across pages or sites.
• No payment details. Donations, if this project takes them, go to a hosted processor on its own pages, and card details never touch this site.

Hosting and its request logs exist to serve pages and to catch an outage or an attack. Form data exists so a submission can be read and answered, and so a correction can be traced to the record that prompted it. The salted hash, the honeypot and the form check exist so that a form is not a free channel for a flood.

In the language a European reader will expect, the first and third rest on the legitimate interest of running a public interest publication and keeping it available. The second rests on the step you took in choosing to send something. Analytics rests on consent, which is why an opt out signal stops it.

Analytics runs through an analytics service in an account this project holds. It reports pages viewed, referrer, approximate region, device and browser, and the network each visit comes from. It is used to see which findings people read, which public bodies and other organisations read them, and whether a page is broken. It is used for nothing else.

When analytics is allowed to load, the page asks this site's own server which network the visit came from. The browser keeps the answer for up to thirty minutes, or until the tab is closed, and does not ask again in that time.

To answer, the server looks up the public name that the visit's address carries, if it has one. That lookup uses the full address. It also asks a public service that maps addresses to networks which network holds the block the visit came from, and sends that service only the block. The answer gives the name and number of that network and a type, such as government, school, internet provider or mobile carrier. It also gives the public name. Any part of that name that contains the address is removed. The first part, which usually names the machine, is removed too, unless it is a common network word such as pool or static.

The server keeps neither the address nor the answer. The address is never sent back to the browser and is never one of the values this site sends to the analytics service. The answer goes to the analytics service with the visit and is kept there for the time set out under retention below.

Where a browser sends a Global Privacy Control signal, or the older do not track header, the analytics scripts are not loaded, the network lookup for analytics does not run, and no analytics cookie is set. A form you choose to send still records the details listed above. Browser settings and content blockers also stop the scripts, and the site works exactly the same without them.

Every form carries a field that a person never sees and never fills. A submission that fills it is rejected before anything is written, so an automated flood leaves no row and no file behind.

Every form also carries the form check described above. A form that fails it is turned away before anything is written.

A rate limit counts recent submissions against the salted hash described above, per form. It counts against a hash rather than against a person, and the count is not kept as a record of anyone.

Uploads are limited to a short list of types, checked, stripped of metadata and re-encoded before anything is done with them. Rows and files sit in private storage that the public site cannot read.

A tip sender is never named on the site. A response from a jurisdiction or a vendor is published verbatim beside the finding it contests, so send only what the jurisdiction or the vendor is content to have published. Nothing sent to this project is legally confidential, and publication is not promised.

• A rejected submission and its attachments are purged after ninety days. Nothing survives that sweep.
• An accepted submission is kept as provenance for the record it supports, for as long as that record is published.
• A salted hash expires with the rate limit window it was stored for.
• Request logs are kept to the retention the host sets, which is short.
• Analytics data, including the network a visit came from, is kept to the retention setting on the analytics account this project holds, and is aggregated after that.
• The network answer the browser keeps is not used after thirty minutes and is dropped when the tab closes. This site's server keeps no copy.

Deleting something removes it from the working store immediately. A copy can persist briefly in a backup before that backup rotates, which is true of every hosted system and is stated here rather than glossed.

Nothing collected here is sold, rented, traded or given to a data broker, under any circumstance. There is no advertising partner, no audience list and no exchange of any kind.

Where a lawful demand arrives for information about a submission, this project reads it carefully, objects to a demand that is improper or overbroad, and tells the person it concerns where the law allows that.

Several state laws in the United States and the frameworks that apply in Europe and the United Kingdom give a person rights over information held about them. This project honours a request for access, correction, deletion, a portable copy, or an objection to processing from anyone who asks, regardless of where they live.

The route is the contact form. A request that would destroy the provenance of a published finding is answered with an explanation rather than silence.

This is a New Jersey project about New Jersey public records. Its hosting, its database and its file store are in the United States, so a request from Europe is served from United States infrastructure and any data it carries is processed there. The rights set out above apply to you on the same terms as to anyone else.

This project does not knowingly collect personal information from anyone under 13, and where a framework sets the threshold at 16 this project treats 16 as the floor. If information from a child reaches this project anyway, it is deleted. Write through the contact form to ask for that.

Traffic runs over encrypted transport. Submission rows and uploaded files sit in private storage that the public site and the read only interface cannot reach. Uploads are restricted by type, checked, stripped of metadata and re-encoded. Access to the private store is limited to the publish pipeline.

No system is secure in the absolute, and this page does not promise that one is. The smallest amount of information is collected, and what is collected is kept in the narrowest place it can usefully sit.

Where a produced document shows an official signing in a role, the document is reproduced as produced. Where a production carries the identity of a person who requested records, that identity is redacted with a printed label, the redaction is counted, and the viewer says a redaction was applied. Correspondence addressed to a requester is excluded from the site entirely.

If you believe a document on this site carries personal information that does not belong in a public record, write through the contact form and name the document and the page.

This policy may change. A changed version carries a new version number and effective date at the top of this page. Nothing on this page is edited in place without that record.