Privacy & what we collect
No system can promise perfect anonymity. This page tells you exactly what SyriaGraph collects, what it does not, and what other parties between you and us may be able to see.
When you browse the site
- No analytics, advertising trackers, social-media pixels, session recording or third-party fonts and scripts.
- No cookies are set for visitors. The page language is part of the link itself.
- For abuse protection, our application keeps a short-lived, in-memory rate-limit counter keyed by a pseudonym of your network address. The pseudonym key changes every few hours and is never written to disk.
When you submit evidence through the secure form
- We do not ask for your name, email, phone number or any account.
- The submission service does not record your IP address, browser fingerprint, referrer or precise time; dates are kept to the day.
- Your text and files are encrypted on our public server the moment they arrive, with a key that server does not have.
- Files are kept in quarantine and checked; they are never published automatically.
- You receive a submission ID and a secret key. We store only a one-way verifier of the key, so we cannot recover it for you. Keep it safe — anyone holding it can read our replies to you.
- Files you send may contain hidden metadata (for example GPS location in photos, or author names in documents). Remove it before sending if you can; we also strip it before anything is published.
What others may see
- Our network protection provider (CDN/WAF) terminates encrypted connections and may process and temporarily log your IP address and request details under its own policies.
- Our hosting provider operates the servers and network and may keep network-level logs.
- Your internet provider, employer or anyone monitoring your network can see that you connected to this site, though not what you sent.
For sensitive submissions, consider using a device and network that are not linked to you, and the Tor Browser. If we operate an onion address it is listed on the submission page.
Email is not anonymous. Email providers and other infrastructure operators can see who wrote to whom and when. For sensitive submissions, use the anonymous submission form instead.
Retention
- Encrypted submissions leave the public server as soon as our research system has collected them (usually within minutes).
- Encrypted replies to you stay available through your secret key for 180 days after the last activity, then are deleted.
- Security logs of the public website are kept for 14 days with network addresses truncated.