Privacy policy.
What we collect, why, how long we keep it, and how to take control of it.
Last updated 26 Oct 2026 · Operator FLS (OPC) Pvt. Ltd, registered in India · Previously operated from the EU
The short version
- We keep only what the registry needs: IDs, usernames, case details, evidence and staff logs.
- We publish the record, never the person who reported it. No real names, addresses or ID documents.
- Transcripts are staff-only in full. A redacted version shows only on an exact ID lookup, never in a list.
- Only essential cookies. No analytics, ads or trackers. We don't sell data.
- Evidence from dismissed reports is purged after 90 days.
- You can ask to access, correct, erase or object, and appeal any listing.
This summary helps you skim. The full text below is what applies.
01Who is responsible for your data
TrustDB is run by FLS (OPC) Pvt. Ltd, a company registered in India. TrustDB previously operated in the European Union as FL EUROPE TECH PVT LTD and has since moved its operations to India; if we hold data about you from that time, you keep the same rights over it, including your GDPR rights. We're the data fiduciary under India's Digital Personal Data Protection Act 2023, and the controller under the GDPR and UK GDPR for people in the EU and UK.
This policy covers TrustDB.org, the TrustDB Discord server, the TrustDB and Trustified bots, and the staff dashboard. Contact details are in section 16.
02What we collect
If you report, appeal or open a ticket
- Your Discord ID and username, and an email if you give one
- What you tell us: description, amount, game, what was traded, replies
- Evidence you send: screenshots, chat exports, links, payment proof
About people who are reported
- Identifiers: Discord ID, past and current usernames, server IDs, wallet addresses, and where they're part of the evidence, email addresses or phone numbers
- The case: category, game, amount, tier, status, dates and the staff verdict
- Anything they send us in reply or in an appeal
Case records and staff activity
- Transcripts of report, appeal and support tickets
- Staff logs: who reviewed, approved, listed or removed what, and when
- Staff sign-in: staff log in to the dashboard with Discord OAuth. We get their Discord ID, username and avatar, nothing else, and never their password.
When you visit the website
- Standard server logs: IP address, time, page and browser
- The ID you type into the lookup, used only to run that lookup and rate-limit it
- Cookies: only essential ones. A gate cookie while the site is in preview, and a session cookie for staff signed into the dashboard. No analytics, ad or tracking cookies.
We never ask for passwords, tokens, 2FA codes, payment card details or ID documents. If you send them anyway, we delete them.
03Why we use it, and our lawful basis
| Purpose | India (DPDP Act 2023) | EU and UK GDPR |
|---|---|---|
| Handling your report, appeal or ticket | Your consent, given when you submit | Contract and legitimate interests |
| Recording and publishing scam reports to prevent fraud | Legitimate uses allowed under the Act, and consent where required | Legitimate interests in preventing fraud (Art. 6(1)(f)) |
| Staff logs, security and stopping abuse of the service | Legitimate uses | Legitimate interests |
| Meeting legal requests and keeping required records | Legal obligation | Legal obligation (Art. 6(1)(c)) |
For fraud prevention, we've weighed our interest (and the community's) in warning people about scams against the rights of people who are reported. That's why we only publish after two staff review the evidence, publish as little as possible, and let anyone appeal.
A note on Article 10 GDPR. Some reports describe behaviour that could also be a crime. A TrustDB listing is a staff verdict on a trade dispute, not a criminal record or a finding that anyone committed an offence. We don't collect or publish criminal conviction data, and we take extra care with wording and access for these cases.
04Transcripts
- Full transcripts are staff-only.
- A redacted version can be shown with a published record. Reporters show as "Filing Party", staff as "TrustDB Staff", and emails, phone numbers and payment handles keep only their last 4 characters.
- Exact-ID lookup only. A transcript only shows when someone searches the exact Discord ID, wallet or case ID. Partial searches never show one.
- Never listable. There's no page, feed or API that lists transcripts.
- Rate-limited, to stop scraping.
05What we publish
- The lookup, /check and our Discord channels show: case ID, tier, status, category, game, listed date and identifier type.
- We never publish who reported a case, staff identities, real names, home addresses, faces or ID documents.
- Lookups only work on exact IDs. You can't browse or search people by name.
06Data from other sources
Some records come from partner databases, such as abuse.wtf, or from partner servers. Every imported record is tagged with its source, and staff review it before anything is published on TrustDB. If a source record turns out to be wrong, we correct or remove ours.
07Children
Anyone who may use Discord can use TrustDB, including people under 18. Staff can join from 16 (Management from 18). Staff are unpaid volunteers, and we don't require parental consent to join as staff. If you're under 18, we only collect what we need for your report, appeal or ticket, we never publish it, and a parent or guardian can ask us to see, correct or delete it.
If a reported account seems to belong to someone under 18, staff take extra care: we publish only what's needed to warn others, and we'll review takedown requests from a parent or guardian with priority.
08How long we keep it
| Data | How long |
|---|---|
| Evidence from dismissed reports | Purged after 90 days |
| Published records and their evidence | While the record is live. Listings are reviewed when an appeal or new evidence comes in, and on a regular review cycle. |
| Resolved or removed records | Kept only as long as needed to handle disputes and repeat reports |
| Tickets and transcripts | As long as the related case is kept |
| Staff logs | As long as needed for accountability and audits |
| Web server logs | A short period for security and rate-limiting |
09Who we share it with
We don't sell your data. We share it only with:
- Hostinger, for VPS hosting
- Our own VPS, where the database, website and bots run. We run it ourselves and don't give anyone else access.
- Discord, because the server, tickets and bots run on it. What you post there is also covered by Discord's own privacy policy.
- Authorities, when Indian law or a valid legal order requires it
Published records are public by design. Anyone can see them with an exact ID lookup.
10International transfers
Our providers may store or process data outside India, the EU or the UK. Where the GDPR or UK GDPR applies, we rely on adequacy decisions or standard contractual clauses for those transfers. Transfers out of India follow the DPDP Act and any restrictions the government sets.
11Security
- Staff sign in with Discord OAuth and access is limited by role.
- Evidence is kept in private, staff-only channels and storage, with a SHA-256 fingerprint to catch tampering.
- Ticket links carry their access token after the # so it never reaches our server logs.
- Everything is served over HTTPS, and lookups are rate-limited.
No system is perfectly secure. If a breach affects you, we'll tell you and the relevant authority as the law requires.
12Your rights
Depending on where you live, you can ask us to:
- Access the data we hold about you
- Correct anything that's wrong or out of date
- Erase your data where we no longer need it
- Object to how we use it, including for fraud prevention, and ask us to restrict it
- Appeal a listing, or our answer to any request
- Nominate someone to act for you (India), or withdraw consent you gave
If you're listed, we may not be able to erase a record that the evidence still supports, because that would defeat the point of fraud prevention. We'll explain why, and you can always appeal.
13How to make a request
Open a Privacy Request through a support ticket on the web or in #general-support. You don't need Discord. You can also contact our Grievance Officer (section 16). We may ask you to prove you own the account or ID.
14Response times
| Request | Target |
|---|---|
| Acknowledgement | Within 24 hours |
| Grievances under India's IT Rules 2021 | Resolved within 15 days |
| Access, correction, erasure and objection | Within 30 days, extendable where the law allows for complex requests |
15Complaints to a regulator
Please talk to us first. If you're not happy with our answer, you can complain to:
- India: the Data Protection Board of India, once you've used our grievance process
- EU: the data protection authority in your country
- UK: the Information Commissioner's Office (ICO)
16Changes and contact
We'll update this policy when things change, update the "last updated" date, and post bigger changes in our Discord.
- Data fiduciary
- FLS (OPC) Pvt. Ltd, registered in India
- Previously
- FL EUROPE TECH PVT LTD (European Union)
- Grievance Officer
- Lilo Kahala
- trustdb@froniz.live
- Fastest route
- Support ticket