Privacy

The public guides do not ask for your name or for a description of a fraud. The quiz runs in the browser. It may send a first-party event that records only that a quiz started or finished, plus a short category code such as “hospice” or “securities.” It does not send the words you would use to describe a scheme, because the quiz never asks for them.

The quiz page also has a form titled “Request a free, confidential call from a participating whistleblower attorney.” FraudBounties.com is not a law firm and does not provide legal advice. Submitting that form does not create an attorney-client relationship. It is attorney advertising. The site does not recommend or vouch for any particular lawyer or firm, and the form does not promise a result or an award.

If you submit the call form, the site stores your name, email address, phone number, state, the fraud type you selected, who you said was defrauded, whether you said you are an insider, and a rough dollar range. It does not ask for a description of the fraud, and it does not accept files. Do not put those details in the other fields. This site is not a privileged channel. The form does not file an official report. Official reporting remains available at America.gov/fraud and on the Justice Department’s fraud whistleblower page.

The form has two checkboxes, both unchecked until you mark them. One is consent to share the information on the form with participating attorneys and legal service providers, who may contact you. The other is express written consent to be contacted by phone or text, including autodialed and prerecorded calls and messages. That contact consent is not a condition of using the guides or of reporting to the government. For each consent, the site stores the consent text, the time the server received it, a hash of the connection address, and the page URL. It does not store the raw connection address.

Name, email, and phone are encrypted in the database with AES-GCM. The key is a Pages secret named LEAD_ENC_KEY and is not stored in the database. State and the category answers are stored so the publisher can count requests by fraud type and state without decrypting every row. A separate events row records the fraud type and state of a submitted request, without the name, email, or phone. The site also stores a numeric score from those categories. Because the form does not ask when the conduct happened, the timing factor in that score is recorded as unknown and adds no points.

With the consents above, the publisher may share the call-request fields with participating attorneys and legal service providers so they can contact you. The site does not sell personal information. It does not send form fields to an advertising network. The quiz page, where the form lives, does not load a web analytics script. If a Cloudflare Web Analytics token is configured at build time, the beacon may load on other pages. Turnstile, if a site key is configured, may load on the form for a bot check. If the key is not set, that script is omitted. Turnstile receives a bot-check token, not the contents of the form.

Call-request rows are deleted 180 days after they are stored. Deletion runs when a new request is saved, when an administrator exports the rows or opens the stats page, and when a scheduled job calls the cleanup address described in the project README. Law-firm business inquiries are a separate table. They are kept until the publisher deletes them. They are not mixed into the call-request export.

To ask for deletion sooner, email [email protected]. That address is only for privacy requests. It is not a tip line and not a way to report a correction to a news item. Include the email address you used on the form. The publisher will delete the matching call-request rows that it can still decrypt. Admin export of stored rows is protected by a server token. Rate-limit records store a hash of the connection address, not the address itself, and are deleted as they age out of the window.

The law-firm page has its own contact form. If you submit it, the site stores your name, work email, organization, optional phone number, the kind of conversation you selected, and your message. That form is for a business inquiry about the site. It is not a fraud report and it is not a request for a whistleblower attorney to call you.

Official reports are made on America.gov/fraud or other government sites. Those sites have their own privacy rules. This site does not receive a copy of those reports.