Privacy policy

Last updated September 30, 2026

This policy explains how Checkfirst handles personal data, in line with Brazil's General Data Protection Law (LGPD, Law 13,709/2018). We collect as little as we can: there is no e-mail address, CPF or phone number, no analytics and no advertising.

Who is responsible

The controller of your data is victor ostapushchenko , an individual. Questions and requests about your data go to vitorostapushchenko@gmail.com .

What we collect, why, and on what basis

  • Username and password (the password is stored only as a hash). To run your account. Basis: performing the service you asked for.
  • Recovery code (stored only as a hash). So you can reset your password without an e-mail address. Basis: performing the service.
  • Country, if you choose to add one. To show it on your public profile. Basis: your consent; remove it at any time.
  • Your reviews, votes, reports and appeals. To run the site. Reviews are public, together with your username.
  • A keyed hash of your network address on each review. To spot several reviews from one network. The address itself is not stored on the review and cannot be recovered from the hash. Basis: our legitimate interest in preventing abuse.
  • Access logs: your IP address, the date and time, the page opened and your account if you are logged in. We are required to keep these by the Marco Civil da Internet (Law 12,965/2014, art. 15). Basis: legal obligation.
  • Cookies: a session cookie and a security (CSRF) cookie, both strictly necessary to log in and submit forms. No tracking or advertising cookies.

How long we keep it

  • Account data: until you delete your account.
  • Reviews: until you delete them. After you delete your account, your published reviews stay online as "Former user" with no link to you. Removed reviews are kept privately for the audit log and legal requests.
  • Access logs: 6 months, then deleted. They can be kept longer only while a court order requires it.

Who receives it

Your data is not sold or shared for advertising. It is processed on servers of the hosting provider we use, which may be located outside Brazil. Access logs are disclosed only to the authorities when a court orders it. When someone adds a website, our server fetches that website's public page to read its title and icon.

Your rights

Under the LGPD you can ask us to confirm that we process your data, give you access to it, correct it, anonymise or delete it, give you a copy, and tell you with whom it is shared. You can also object to processing based on legitimate interest.

  • Copy of your data: "Download my data" on your account page.
  • Correction: change your profile and password on the account page.
  • Deletion: "Delete my account" on the account page. Your personal details are erased at once.
  • Anything else: write to the contact above. You may also complain to Brazil's data protection authority (ANPD).

Security

Passwords and recovery codes are hashed, connections use HTTPS, and access to administration requires two-factor authentication.

Changes

If this policy changes, the date at the top changes too.