# Privacy Policy

## Our Commitment

OSCD is built on the principle that the privacy of attack victims is paramount. This policy explains how we handle data.

## Principles

1. **No sensitive data in the repository. Ever.**
2. **All case studies are anonymized** before publication.
3. **Consent required.** No case is documented without explicit consent.
4. **Minimal data collection.** We collect only what is necessary.
5. **Third-party processor.** Incident reports are sent through **FormSubmit.co** (FormSubmit LLC), a third-party form-backend service that receives and forwards each submission to the OSCD coordination inbox. FormSubmit.co acts as a data processor on our behalf. We do not sell, rent, or disclose report data to any other third party.
6. **Right to removal.** Anyone can request data removal at any time.

## What We Collect

### Incident Report Form
- Contact name or alias (required)
- Contact email (required)
- Repository name/URL (optional)
- Package manager (optional)
- Incident description (required)
- Impact assessment (required)
- Evidence links (optional)

### Website/Analytics
- We use no analytics, no cookies, no tracking.

## What We Never Collect

- Passwords or access tokens
- Private encryption keys
- Personal identification numbers
- Payment information
- Browser fingerprints

## Data Retention

| Data Type | Retention Period |
|---|---|
| Active case data | Until resolution + 90 days |
| Anonymized case studies | Indefinitely (public documentation) |
| Form submissions | Deleted after resolution (unless consent given) |
| Email communications | 1 year after case closure |

## Data Location

- Private reports: encrypted email inbox
- Case studies: GitHub repository (public, anonymized)
- No database servers, no cloud storage

## Third Parties

**FormSubmit.co (data processor).** The private incident report form is delivered through FormSubmit.co (FormSubmit LLC), a third-party form-backend service. When you submit the form, your report is transmitted to and processed by FormSubmit.co, which forwards it to the OSCD coordination inbox (`amurlaniakea@gmail.com`). FormSubmit.co's own processing is governed by its privacy policy (<https://formsubmit.co/>). We chose this service to avoid operating our own server, but you should be aware that your submission passes through this external processor before reaching us.

**Platform reports.** When we facilitate reporting to GitHub Security or OpenSSF, we only share the anonymized technical details needed for their processes — never the reporter's identity or contact data without explicit consent.

## Your Rights

- **Right to access:** Request a copy of data we hold about you
- **Right to rectification:** Request correction of inaccurate data
- **Right to erasure:** Request deletion of your data
- **Right to withdraw consent:** Revoke consent for case documentation at any time

## Contact

For privacy-related requests, email the project coordinator.

---

*Last updated: 25 August 2026*