Privacy policy

Last updated: 7 November 2026

Short version: the only cookies here are Google Ads cookies, and only if you accept them. Your handle, name and report link are never part of that measurement (details below). If you run the free scan or ask the AI box a question, what you type goes to my own scan server (details below). When you message me, I use what you send to answer you and, if you hire me, to do the work. That's it.

Who is responsible

The controller under the GDPR is:

Ognjeni Feniks, Jaka Basej, s.p.
Kvedrova cesta 5A, 1000 Ljubljana, Slovenia
Email: me@jackbase.dev

This website

• Your browser and other parties. Icons, images and fonts are served from this site itself (the demo creator site uses your device's own fonts), and apart from the free scan and the AI box described next and the Google Ads measurement described below, your browser makes no requests to anyone else.
• Free scan. The free scan runs on this site's scan page. The handle and platform you enter are sent to my own scan server (scan.srv1395798.hstgr.cloud), which runs the Google search, keeps the result so your report link works, and passes the result thumbnails through to your browser (so your browser never loads them from Google directly). The server keeps the full result for 3 days and its list of links for 30 days. After that it keeps a short summary (handle, platform, counts, the sites with the most copies, public profile info) until you ask me to delete it. A deep scan's lists of links for takedowns stay with that summary. Public photos and thumbnails gathered for a report are deleted once they're 3 days old, by a clean-up that runs once a day, so they can stay up to 4 days. A repeat scan inside those 3 days reuses them without fetching again, and its copy counts from that scan. If anyone repeats a scan with the same inputs within 6 hours, they see that recent result instead of a new search. Report pages are unlisted and marked noindex. The scan itself sets no cookies. The report link contains a random id: anyone who has it can open the report, so share it only with people you trust. The optional deep-scan link opens my scan app at jackbase.me/scan, which also has an optional chat box: only if you use it, your questions are sent to an AI provider (DeepSeek) to be answered.
• Ask-AI box. The homepage has an optional "Ask AI before you DM me" box. Common questions are answered right in your browser from this page's text, without sending anything. Any other question you type is sent, with the earlier messages of that chat and, if you ran the free scan in this browser, your report's random id, to my scan server (scan.srv1395798.hstgr.cloud). It has an AI model provider generate the answer, so your question is processed by that provider too. Your questions are not stored beyond the server's rate-limit logs. The chat itself is kept only in your browser tab and is gone when you close it. No cookies. Please don't type passwords or anything you wouldn't put in a message. Legal basis: answering what you ask (Art. 6(1)(b) GDPR).
• The same site is served from two places: GitHub Pages (blackphoenixslo.github.io) and my own server (abolita.srv1395798.hstgr.cloud), the same server that runs the free scan. Like any web host, whichever one you opened may process technical data such as your IP address in server logs to deliver the site and keep it secure. For GitHub Pages, see GitHub's privacy statement.
• Clicking a Telegram, WhatsApp or email link opens that app. From then on, that provider's own privacy terms apply to the message itself.

When you message me

I process what you choose to send: your name or creator name, your handles, your contact details on the channel you use, links to leaked copies and to your original content, and anything else you write.

• Why: to answer you, to run your free scan and free removal, and, if you hire me, to perform the service: finding copies, filing copyright notices and removal requests in your name, building your official website and sending your reports.
• Legal basis: steps you ask for before a contract and the performance of the contract (Art. 6(1)(b) GDPR), and legal obligations such as bookkeeping (Art. 6(1)(c) GDPR).
• Copyright notices: a notice has to identify the rights holder or their authorized agent. Recipients (sites, hosts, registrars, Google) receive what the notice requires. Some forward notices to the uploader or publish a copy; Google, for example, may send copies of removal requests to the Lumen database. Ask me before we start and I'll walk you through what each recipient sees.
• Who else sees it: the messaging or email provider you chose, and the recipients of notices described above. I don't sell or share your data with anyone else.
• How long: for as long as we work together and as long as needed to handle follow-ups and re-uploads; invoices for as long as tax law requires. Ask me any time and I'll delete the rest.

Google Ads measurement and cookies

I advertise with Google Ads and want to see which ads lead to a finished free scan or a message. While this measurement is switched on, your first visit shows a banner with Accept and Reject, and the footer has a "Cookie settings" link. If you see neither, it is off and nothing in this section happens.

• What runs: the Google tag (gtag.js, loaded from www.googletagmanager.com) with Google Consent Mode v2. Provider: Google Ireland Limited; data may also go to Google LLC in the US. Everything starts denied, wherever you are. See how Google uses data from sites that use its services.
• If you accept: ad storage, ad user data, ad personalization and analytics storage are granted. The tag then sets the cookie _gcl_au and, if you arrived from a Google ad, _gcl_aw on this site (about 90 days), keeps an entry _gcl_ls in your browser's storage, and Google may set its own advertising cookies on its own domains. They let Google connect an ad click to a finished scan or a message. Legal basis: your consent (Art. 6(1)(a) GDPR).
• Before you choose, and if you reject: no cookies are set. The tag still loads and sends Google cookieless pings: that a page was opened, that a scan finished or a contact link was clicked, the page address and technical browser details. Like any request, these reach Google with your IP address. Legal basis: my legitimate interest in knowing whether my ads work (Art. 6(1)(f) GDPR); you can object at the address above or block the tag in your browser.
• Never part of this measurement: your handle, name, what you searched for and your report link. Page addresses are cut to their path before they are sent, keeping only Google's own ad click id if you came from an ad; conversions carry no details about you, and enhanced conversions are off. Separately, the free scan's Google search runs from my server as described above, with no link to your browser.
• Your choice is kept in your browser's storage as leakscan.consent. It is not a cookie and is not sent anywhere.
• Changing your mind: "Cookie settings" in the footer reopens the banner at any time. Reject there withdraws your consent from that moment and deletes the _gcl cookies and entries from this site. Google's cookies on its own domains are removed in your browser's settings.

Your rights

You can ask for access to your data, correction, deletion, restriction, a copy in a portable format, and you can object to processing. Just email me@jackbase.dev. You also have the right to complain to a supervisory authority; in Slovenia that is the Information Commissioner (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana.

If this ever changes

If I ever add other cookies or other measurement, this policy will be updated first and the site will ask for your consent before anything is set.