Privacy Policy

Last updated: September 2026

This page describes what information ExtremismLedger actually collects when you use the public site, why, and how long it is kept. It covers the public-facing site only, not internal editorial or administrative systems.

1. Browsing the site

Viewing published profiles, incident pages, wiki pages, or search results does not require an account and does not collect personal information from you beyond what is inherent to any web request (such as your IP address reaching our infrastructure and Cloudflare, our content-delivery and security provider, in the normal course of serving the page). We do not run third-party analytics or advertising trackers on the public site.

2. Theme preference (local storage)

The light/dark theme toggle stores your preference in your browser's localStorage under the key el-theme. This value stays on your device, is not transmitted to our servers, and is not used for tracking.

3. Cookies

The public site sets a CSRF-protection cookie when you load a page containing a form (for example, the report submission form), which is required for the form to submit securely and is not used for tracking or analytics. If you sign in to a staff/editorial account, a short-lived session cookie is used to keep you signed in; this applies to editorial staff, not ordinary site visitors.

4. Report submissions

If you use the public report form to submit a tip about a person, organization, or incident, we collect what you enter into the form: the subject information, your description of the conduct, source URLs, and any optional fields you choose to fill in (approximate date, general location, related entities, additional notes). Providing your name and email address is optional and is used only for internal follow-up about your submission — it is never published, never shown on any public page, and never included in any public or commercial data export. A submission is never automatically published; an editor reviews it and, if it meets our sourcing and inclusion standards, uses it as a starting point for independently verified, separately cited content.

You may optionally provide a street address as part of a report (for example, an organization's address). Any street address submitted is for internal verification use only, is never rendered on any public page, and is never automatically added to a published record — an editor must independently review and separately source any address information before it can appear publicly, and only for organizations, never for individuals (see our Legal & Editorial Disclaimer).

5. IP address logging on report submissions

When you submit the report form, we log a record of the attempt for abuse-prevention, security, and rate-limiting purposes. Your IP address is never stored in raw or plain form. It is passed through a keyed-HMAC hash before storage, so the stored value cannot be reversed back into your original IP address, even by an administrator of this site — the hash is only used to detect repeated submissions from the same source (for example, to enforce a rate limit) by comparing hashes, not by reading addresses back out.

These hashed-IP submission logs are retained for 90 days and then automatically deleted on a fixed schedule. This is separate from the report content itself, which is retained as part of our editorial moderation record without an automatic deletion period, since accepted or rejected reports may need to be referenced during editorial review.

6. Cloudflare Turnstile

The report form uses Cloudflare Turnstile, a bot-detection challenge, to reduce automated/spam submissions. When you submit the form, Turnstile's widget runs in your browser and we verify its result server-side with Cloudflare. This interaction is governed by Cloudflare's own privacy practices for the Turnstile service; we do not control what Cloudflare itself collects as part of running that challenge.

7. Data we do not collect on the public site

ExtremismLedger does not publish a person's residential street address or full personal phone number. Where public contact information is listed, it is identified as an office or other official contact detail; no missing office address is ever replaced with a home address.

• We do not require an account or login to browse published content or submit a report.
• We do not run advertising trackers, cross-site tracking pixels, or third-party analytics on the public site.
• We do not sell personal information.

8. Corrections and contact

If you believe information about you or someone else is inaccurate, or you have a privacy concern about published content, see the correction and takedown-request process described in our Legal & Editorial Disclaimer, or use the report form to reach us. We aim to acknowledge credible correction requests promptly and to investigate them diligently.

9. Changes to this policy

We may update this privacy policy from time to time as the site's features change. The "last updated" date above reflects the most recent revision.