Privacy Policy

United Kingdom

The UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, give you the same rights as the GDPR section above.

You can also complain to us first: choose “A complaint” in the request form. We acknowledge every complaint within 10 days, look into it and tell you the outcome.

We answer within one month (two more months for complex requests, and we tell you why). You can complain to the Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/

Switzerland

The Federal Act on Data Protection (FADP) protects you when our processing has an effect in Switzerland.

You can get information about your data and a copy of it, have it corrected or deleted, object to or stop its use, receive it in a common format, and not be subject to automated individual decisions (we make none). Your data goes to Israel and the United States, where Cloudflare and Google are certified under the Swiss–US Data Privacy Framework; Switzerland recognises both as adequate.

We answer within 30 days. You can report a concern to the Federal Data Protection and Information Commissioner: https://www.edoeb.admin.ch/en

Israel

We are based in Israel, so the Protection of Privacy Law, 5741-1981, as amended by Amendment 13 (in force since August 2025), applies to everything we do. Giving us data is voluntary; no law requires you to.

You can inspect the data we hold about you and ask us to correct or delete data that is wrong, incomplete, unclear or out of date. We also delete any form message on request, for any reason.

We answer within 30 days. If we refuse, we give reasons, and you may go to the Magistrates’ Court. You can complain to the Privacy Protection Authority at the Ministry of Justice: https://www.gov.il/en/pages/public_inquiries_ilita

Türkiye

Law No. 6698 on the Protection of Personal Data (KVKK) protects you if you are in Türkiye. We are the data controller and collect data only from you, through the forms, on the legal bases set out above.

You can learn whether your data is processed and why, which recipients in Türkiye or abroad receive it, have it corrected, erased or destroyed and those changes passed on to recipients, object to a result produced only by automated analysis, and claim compensation for unlawful processing.

We answer free of charge within 30 days. If we refuse or do not answer, you can complain to the Personal Data Protection Authority within 30 days of our answer, or 60 days of your request: https://www.kvkk.gov.tr

United Arab Emirates and Saudi Arabia

In the United Arab Emirates, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data protects you. In Saudi Arabia, the Personal Data Protection Law (Royal Decree M/19) protects you if you live there.

You can get information about your data and a copy of it in a readable format, have it corrected or erased, restrict or stop its processing, object to automated processing (we do none), and withdraw consent.

We answer within 30 days. In the UAE you can complain to the UAE Data Office; in Saudi Arabia to the Saudi Data and AI Authority (SDAIA), within 90 days: https://dgp.sdaia.gov.sa

California

The California Consumer Privacy Act (as amended by the CPRA) covers larger businesses, and we may fall outside it, but we give its notice and honour its rights anyway. In the past 12 months we collected: identifiers (name, email address or phone number, and IP address for delivery and security), internet activity (anonymous playback reports and security logs), and whatever you choose to write in a message. They come from you and your device, are used for the purposes and kept for the periods above, and are disclosed only to our service providers Cloudflare and Google. We do not sell or share personal information, including that of people under 16, and we use no sensitive personal information to infer anything about you. We do not disclose personal information to third parties for their direct marketing.

You can know and access what we hold, have it deleted or corrected, opt out of sale or sharing (there is none, and we honour Global Privacy Control), limit the use of sensitive information, and use your rights without being treated differently. Someone you authorise can make a request for you; we confirm it with you by email.

We confirm receipt at once and answer within 45 days, usually at once. You can contact the California Privacy Protection Agency (https://cppa.ca.gov) or the California Attorney General.

Other US states

Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island have privacy laws, and more take effect from 2027. Most cover only larger organisations, but we honour their rights for everyone. We do not sell personal data, use it for targeted advertising or profile you, and we honour Global Privacy Control.

You can confirm whether we process your data, see it, have it corrected or deleted, get a copy to take elsewhere, and opt out of sale, targeted advertising and profiling. If we refuse a request, you can appeal with the request form (choose “A complaint”); we decide appeals within 45 days and, if we still refuse, tell you how to contact your state’s Attorney General.

We answer within 45 days, usually at once. The site is not directed at children under 13 and its forms are for people 18 or older (see Children).

Canada and Québec

Canada’s federal privacy law (PIPEDA) and Québec’s Act respecting the protection of personal information in the private sector (as amended by Law 25) may apply to you. Your data may be communicated outside Québec and Canada, to Israel and to Cloudflare and Google in the United States. The person in charge of protecting personal information is the head of our team, reached with the request form.

You can access your data, have it corrected, withdraw consent, receive it in a structured format, and ask us to stop spreading it or de-index it.

We answer within 30 days. You can complain to the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca/en/report-a-concern/) or the Commission d’accès à l’information du Québec (https://www.cai.gouv.qc.ca).

Brazil

The General Data Protection Law (LGPD, Law No. 13.709/2018) protects you if you are in Brazil. The legal bases are set out above: consent for the “Get involved” form, legal obligation for privacy requests, and legitimate interest for running and protecting the site. Your data is transferred to Israel and to Cloudflare and Google in the United States under standard contractual clauses. The request form is our channel for data subjects.

You can confirm that we process your data, access it, have it corrected, anonymised, blocked or deleted, receive it in a portable format, learn who we share it with, learn what refusing consent means, and withdraw consent.

We confirm at once and give a full answer within 15 days. You can complain to the National Data Protection Authority (ANPD): https://www.gov.br/anpd

Mexico

This page is our privacy notice under the Federal Law on the Protection of Personal Data Held by Private Parties (2025). It lists the data we process, why, and how to limit its use. Only the “Get involved” form needs your consent; privacy requests and protecting the site do not. If this notice changes, we update the date at the top of this page.

You can access, correct and cancel your data, object to its use (ARCO rights), and withdraw consent. Our team handles these requests through the request form.

We answer within 20 days and carry out what we decide within 15 days. You can complain to the Secretariat of Anti-Corruption and Good Government: https://www.gob.mx/buengobierno

Argentina

Law No. 25.326 on the Protection of Personal Data protects your data. Answering our forms is voluntary, and the database is controlled by us.

You can be informed, access your data free of charge (once every six months, or more often with a legitimate interest), and have it corrected, updated or deleted.

We give access within 10 days and correct, update or delete within 5 business days. The Agency for Access to Public Information (AAIP), which enforces Law No. 25.326, handles complaints: https://www.argentina.gob.ar/aaip/datospersonales

Chile and Colombia

In Chile, Law No. 21.719 protects you once it takes effect (planned for 1 December 2026). In Colombia, Law 1581 of 2012 protects you where it applies to our processing.

You can access, correct and delete your data, object to its processing, receive it in a common format, have it temporarily blocked (Chile), revoke consent, and ask for proof of it (Colombia).

We answer within 10 days and block data within 2 business days. In Chile you can complain to the Personal Data Protection Agency once it is set up; in Colombia to the Superintendence of Industry and Commerce: https://www.sic.gov.co

South Africa

Where the Protection of Personal Information Act 4 of 2013 (POPIA) applies to our processing, it protects you. We collect data only from you, and giving it is voluntary.

You can access your data, have it corrected or deleted, object to its processing, refuse direct marketing (we send none), and not be subject to automated decisions (we make none).

We answer within 30 days. You can complain to the Information Regulator: https://inforegulator.org.za

Ukraine

The Law of Ukraine “On Personal Data Protection” gives you rights over the data we hold about you.

You can know where your data comes from, why it is used, where it is kept and who receives it, see it, object to its processing, have it corrected or destroyed, withdraw consent, and know how any automated processing works (we make no automated decisions).

We answer within 30 days. You can complain to the Ukrainian Parliament Commissioner for Human Rights: https://ombudsman.gov.ua

Georgia

The Law of Georgia on Personal Data Protection gives you rights over your data. Giving data is voluntary; without it we cannot reply to you.

You can be informed and get a copy of your data, have it corrected, deleted or blocked, receive it in a common format, withdraw consent, and not be subject to automated decisions (we make none).

We answer within 10 working days. Complaints go to the State Audit Office of Georgia: https://sao.ge

Russia

If Federal Law No. 152-FZ “On Personal Data” gives you rights over data we hold, you can use them with the request form.

You can get information about the processing, have your data clarified, blocked or destroyed, withdraw consent, and challenge what we do.

We answer within 10 working days. You can also turn to Roskomnadzor or a court.

Japan

The Act on the Protection of Personal Information (APPI) protects you if you are in Japan. Your data is handled in Israel and the United States. Cloudflare and Google protect it under contracts with measures equivalent to the APPI; Japan’s Personal Information Protection Commission publishes information on the United States’ privacy system, and you can ask us for details of these measures.

You can ask us to disclose your data, including as an electronic copy, to correct, add to or delete it, and to stop using it or giving it to others.

We answer without delay. You can contact the Personal Information Protection Commission: https://www.ppc.go.jp/en/

South Korea

The Personal Information Protection Act (PIPA) protects you if you are in Korea. When you press send, the details in the form (name, email or phone, topic and message; or email, request type and note) go over an encrypted connection to Cloudflare, Inc. (United States, https://www.cloudflare.com/privacypolicy/) for storage and email, and to Google LLC (United States, https://policies.google.com/privacy) for the team’s Chat space. They are kept for the periods above. If you do not want this, do not use the forms; the rest of the site works without them.

You can see your data, have it corrected or deleted, suspend its processing and withdraw consent. We make no fully automated decisions and use no cookies. The privacy officer role is held by our team and reached with the request form.

We answer within 10 days. You can report a problem to the Privacy Infringement Report Center (https://privacy.kisa.or.kr, phone 118) or ask the Personal Information Dispute Mediation Committee to mediate (https://www.kopico.go.kr).

China

Where the Personal Information Protection Law (PIPL) applies to you, it gives you the rights below. We have no office in China, and your data is stored outside China, in the United States, as described above.

You can ask us to explain how we handle your data, see and copy it, have it corrected or deleted, restrict or refuse its processing, and withdraw consent. Close relatives can use some of these rights over a deceased person’s data.

We answer within 10 days. You can also complain to the Cyberspace Administration of China.

Taiwan

Taiwan’s Personal Data Protection Act protects your data.

You can ask about and review your data, get a copy, have it supplemented or corrected, have its collection, processing or use stopped, and have it erased.

We answer requests to see your data within 15 days, and requests to correct or delete it within 30 days.

India

The Digital Personal Data Protection Act, 2023 and its Rules protect you if you are in India. Most of their duties apply from May 2027; we follow them now. The data we collect and why are listed above, and you can withdraw your consent as easily as you gave it, by asking us to delete your message.

You can get a summary of your data and how it is used, have it corrected, completed, updated or erased, have a grievance addressed, and nominate someone to use your rights if you die or cannot act.

We address grievances within 10 days. After that, you can complain to the Data Protection Board of India.

Singapore

The Personal Data Protection Act 2012 (PDPA) protects you if you are in Singapore.

You can withdraw consent, see your data and how it was used or disclosed in the past year, and have it corrected. The data protection officer role is held by our team and reached with the request form.

We answer within 30 days. You can complain to the Personal Data Protection Commission: https://www.pdpc.gov.sg

Thailand

The Personal Data Protection Act B.E. 2562 (2019) protects you if you are in Thailand, even though the site is free.

You can withdraw consent, get a copy of your data and receive it in a common format, object to its processing, and have it erased, restricted or corrected.

We answer within 30 days. You can complain to the Office of the Personal Data Protection Committee: https://www.pdpc.or.th

Philippines

Where the Data Privacy Act of 2012 applies to our processing, it protects you.

You can be informed, see your data, dispute and correct it, have it suspended, withdrawn, blocked, removed or destroyed, receive it in a common format, object, and claim damages.

We answer within 10 days. You can complain to the National Privacy Commission: https://privacy.gov.ph

Indonesia

Law No. 27 of 2022 on Personal Data Protection protects you if you are Indonesian or in Indonesia.

You can get information about your data and a copy of it, have it completed or corrected, stop its processing, have it deleted, withdraw consent, restrict its processing, object to automated decisions (we make none), receive it in a common format, and claim compensation.

We act on requests to see, correct or stop processing your data within 3 × 24 hours; copies and deletions happen at once. Until the national data protection agency is set up, you can complain to the Ministry of Communication and Digital Affairs: https://www.komdigi.go.id

Vietnam

The Law on Personal Data Protection (No. 91/2025/QH15), in force since 1 January 2026, protects you if you are a Vietnamese citizen or a person of Vietnamese origin living in Vietnam. We never take silence as consent.

You can be informed, give, refuse or withdraw consent, see and correct your data, have it deleted, restrict or object to its processing, and complain or claim compensation.

We reply to an objection or a withdrawal of consent within 2 working days and carry it out within 15 days, correct data within 10 days, and delete at once. You can complain to the Department of Cybersecurity and High-Tech Crime Prevention (A05) of the Ministry of Public Security.

Australia and New Zealand

In New Zealand, the Privacy Act 2020 protects you. The agency collecting and holding your data is Three Musketeers Production (a company in formation); giving it is voluntary, and without it we cannot reply. In Australia, the Privacy Act 1988 may not apply to a small overseas organisation like us, but we follow the Australian Privacy Principles anyway.

You can see your data and have it corrected. It is held in Israel and the United States.

We answer within 20 working days in New Zealand and 30 days in Australia. You can complain to the Office of the Privacy Commissioner (https://www.privacy.org.nz) or the Office of the Australian Information Commissioner (https://www.oaic.gov.au/privacy/privacy-complaints).

Other countries

Many other countries and territories have privacy laws, among them Hong Kong, Malaysia, Kenya, Nigeria, Egypt, Qatar and Kazakhstan. Wherever you live, you can use the rights your law gives you with the same form, and we answer within the time your law sets.