Terms and privacy

Plain-language summary. This is not legal advice, and it will be replaced by a reviewed policy before launch.

What Counterlure is

A way for people in the tech industry to find out, privately, whether someone they are in contact with has also been reported by others. A match is a pattern worth noticing, not a finding of fact about anyone.

Acceptable use

• Report only people you are personally in contact with and are genuinely unsure about.
• Do not report anyone because of their nationality, ethnicity, religion or any other protected characteristic.
• Do not use Counterlure to monitor, locate or harass anyone, including former partners.
• Do not upload photos of children, or photos you have no right to use.

We may remove reports and close inboxes that break these rules, without a refund.

What we collect

• Reports: the photo (re-encoded to remove metadata), a face fingerprint derived from it, the name you were given and where you met.
• Abuse prevention: a keyed one-way hash of your IP address, so repeat reports from one source count once. We do not store the address itself.
• Inboxes: a username, an encrypted authenticator secret, hashed recovery codes and your payment transaction. No email, name or phone number.

Retention

• Photos are deleted after 180 days, when a case is dismissed, or when you withdraw a linked report.
• Face fingerprints are kept so that patterns can be detected over time, and are deleted when you withdraw a linked report.
• Login sessions expire after 30 days.

Who sees what

Only the reviewer can see reports and photos, and every view is logged. Other users never see anything about anyone else's reports. The reported person is never contacted. Messages go only to inbox members who reported the person in a reviewed case.

Processors

Photos are stored and face-matched on Amazon Web Services. The application runs on Fly.io and its database on Neon. Traffic passes through Cloudflare.

Payments

Lifetime inbox membership is a one-time payment in cryptocurrency. Blockchain transactions are public by nature; we only record the transaction ID to verify it. Payments are non-refundable once an inbox has been created.

No guarantee

Face matching can produce false matches and miss real ones. Counterlure is provided as is, without warranty. Make your own decisions, and talk to your security team or the authorities if you believe you are at risk.

Contact

[email protected]. To exercise data rights about a report, contact us with its receipt.