No fine-print aquarium
This page explains what Phishtopia collects, why it is needed, and where your information goes. The goal is to be honest and understandable, not to bury you in legal language.
Last updated: July 31, 2026
Creating an account requires a username, email address, and password. Phishtopia also stores the information you deliberately create inside its tools, such as YouList entries and comments. Future StoreCalc features may store orders, templates, and facility choices only when those features are actually built and you use them.
Passwords are converted into one-way hashes before they are stored. Phishtopia cannot display or email your original password back to you. Email-verification and account-change tokens are used to confirm sensitive actions.
Phishtopia uses a session cookie named sid to keep you signed in and connect requests to your account. In production it is marked secure and HTTP-only, uses SameSite=Lax, and normally expires after two hours. The cookie is functional, not an advertising profile.
Public pages may load Google Tag Manager, and Cloudflare processes normal request information to deliver, secure, and measure the site. Authenticated account and dashboard pages currently disable Google Tag Manager. Analytics are used to understand site traffic and reliability, not to build a data-broker profile.
Some features communicate with outside services. For example, YouList uses The Movie Database for title information, transactional email is sent through the configured email provider, and EchoTrace relies on external public game data. Those providers receive the information needed to answer the request or deliver the message.
Phishtopia does not sell your personal information. It does not intentionally give account data or private tool content to advertisers. This site is a personal project, not a data-harvesting business.
Account information and saved tool data are generally kept while the account exists so the features continue working. You can permanently delete your account and associated live data from the Danger zone on the account page. Operational backups and bounded logs may retain historical copies temporarily until their normal retention periods expire.
Reasonable safeguards are used, but no website or network can promise perfect security. Do not store anything in Phishtopia that would cause serious harm if it were exposed. Security and privacy practices will be updated as the site grows.
Questions or concerns?
Use the contact page to ask what is stored, report a privacy concern, or request help with your account data.