Privacy Policy

Last updated: 10 July 2026

Redlist processes personal data in line with Sri Lanka’s Personal Data Protection Act, No. 9 of 2022 (PDPA), including purpose limitation, data minimization, and security.

We collect: Gmail account details for authentication; optional phone numbers you provide; report content and evidence you upload; hashed IP addresses and hashed search queries for abuse prevention (never plaintext search queries); and moderation notes.

Public identifier search shows redacted identifiers except on exact matches. The public Tactics directory shows methods and patterns only — personal identifiers are stripped from those summaries. Moderators may view unredacted data to review disputes. You may request access, correction, or removal via the takedown form.

Data is stored with our infrastructure providers (database, object storage, email delivery) under contractual safeguards. This policy will be expanded before broader public launch.