Privacy policy

Who is responsible

The site popfake.com is run by the PopFake team. For any privacy question, or to exercise your rights, contact us via the form on the home page.

What we collect and why

• Reading the site. Our host (Vercel) processes technical data such as your IP address and browser type to deliver pages and protect the site from attacks. We count visits with Vercel Web Analytics and measure page speed with Speed Insights. They do not use cookies, do not follow you across other sites, and give us only aggregated numbers.
• Sending a rumor for checking. We store the text and link you send and the site language. Do not include personal data about yourself or others in the text.
• Showing your requests only to you. Your browser gets a random token in the pf_guest cookie. We store only a one-way hash of it, not the token itself, and it is not linked to your name or any account.
• Spam protection. To limit how many messages can be sent from one network, we store your IP address only as a salted one-way hash. Limit records are deleted after 2 days.
• Email notification (optional). If you leave an email address, we use it once to tell you that your request has been answered, then delete it.

Legal basis

• Running the site, answering your requests and protecting against abuse: our legitimate interest in providing a free fact-checking service (GDPR Art. 6(1)(f)).
• Email notification: your consent (Art. 6(1)(a)). You can withdraw it at any time by contacting us. The address is deleted after one letter in any case.

Cookies

• pf_guest: lets the site show you the requests you sent. Kept for 1 year.
• pf_lang: remembers the language you chose. Kept for 1 year.
• These cookies are needed for features you use. We use no advertising or tracking cookies, so we do not ask for cookie consent. You can delete the cookies in your browser at any time; you will then no longer see your earlier requests.

Who processes data for us

We use service providers that process data only on our instructions:

• Vercel Inc. (USA): hosting, analytics, page speed.
• Neon (USA): database where requests are stored.
• Resend (USA): sending the notification email.
• Anthropic (USA): the AI model that reads the text of your request in order to research the rumor.

Transfers outside your country

These providers are in the USA. Transfers are covered by the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

Publication

If a rumor you sent is worth a public check, we may publish an article about the rumor itself. We never publish who sent it, and the text of your request stays private: only you see it, or anyone who has your private answer link.

How long we keep data

• Requests: as long as needed to answer them and to follow the rumor, or until you ask us to delete them.
• Spam-limit records: 2 days.
• Email address: until the notification is sent.
• Server logs at our host: the host's standard short retention period.

Your rights

You can ask us to show, correct or delete your data, to restrict its use, or object to it, and you can withdraw consent. Contact us via the form on the home page and include the text of your request or your private answer link, so we can find it: we do not know who you are.

You can also complain to your data protection authority.

Children

The site is not intended for children under 16, and we do not knowingly collect their data.

Changes

When this policy changes, we update the date at the top.