Privacy

What we record

We keep a server-side access log of requests to publicmosaic.com. For each request we store:

• Your IP address
• Date and time of the request
• The path and query string requested, the HTTP method, and the response status
• Your browser's user-agent string, the referring page, and preferred language
• Approximate location (country, region, city and time zone), derived from your IP by our CDN
• Your network operator (autonomous system number and organisation name)
• Connection metadata: HTTP protocol, TLS version and cipher, the CDN edge that served you, and the request's trace ID

Each listed address has its own page, so the path we log can show which listing you read. We do not analyse the log that way, we never join it to accounts, and it is deleted after 90 days like every other row.

Reading this site sets no cookies, needs no account, and uses no tracking pixels, fingerprinting scripts or third-party analytics. Downloading the machine-readable feed files, or taking a key for the API, needs a free account. Signing in sets first-party authentication cookies (__session, __client_uat) and uses your browser's local storage on the page where sign-in runs, solely to keep you signed in and never for tracking or advertising. Beyond that, we make no attempt to identify the person behind an address.

Accounts

An account is free. It exists to gate the feed downloads and to hold keys for the enrichment API. The account itself (the email address you sign up with, and authentication metadata such as sign-in times) is operated for us by Clerk (below).

If you create an API key, we keep a small accounts store of our own. It holds only: your account identifier (an opaque ID, never your email); for each API key, a one-way hash of the key (never the key itself, which is shown to you once and cannot be recovered), the label you gave it, the day it was created and the day it was revoked; and, per account, a count of API requests made on each day. It holds no path, no address, no query, and no time finer than a day, so it can say how much an account used the API and structurally cannot say what it looked up, from where, or when.

It is never joined to the access log. The log deliberately has no account or user column, so which of its rows are yours is as unknowable to us after you sign in as before. The limit of that promise: the access log records that an API request arrived from an address at a time, and the accounts store records how many requests an account made that day, so in principle the two could be correlated. We do not do so; they are separate databases we never join, and the same is true of the indicator archive below. Daily counts are deleted after 90 days, revoked keys seven days after revocation, and everything in the store on request (see Your rights).

Why we keep it

We publish a public threat-intelligence feed. The log exists to operate and defend it: to detect abuse, scraping and denial-of-service attempts, to diagnose faults, and to preserve the integrity of what we publish. Our lawful basis is legitimate interest (UK/EU GDPR Article 6(1)(f)) in securing a public service. We do not use the log for advertising, profiling or automated decision-making.

How long

Log rows are deleted automatically, on a schedule, 90 days after they are written.

Separately, Cloudflare keeps the site's own diagnostic messages, such as errors and the results of scheduled jobs, for seven days. We write them without your IP address, browser details or anything else about you, but Cloudflare stores each with the web address that was requested, including any query string, such as a search typed into the lookup box.

The indicator archive

Separately from the access log, we keep a permanent record of the C2 indicators we publish. It holds:

• the addresses, ports, certificates and fingerprints of scanned infrastructure, and the dates on which we observed them;
• the hashes of malware samples and other files captured from it, and the configurations extracted from those samples (the endpoints and settings whoever built them wrote into them);
• the certificate issuance templates those hosts share: a fingerprint, an issuer name and an issue date, never a person;
• public facts about the networks routing them: the registered operator name and country of each network (from the RIPE NCC's registry, or relayed by the scanner from the same public registries), third-party listings of the network (such as Spamhaus DROP), and the scanning partner's day-level estimates of when a malware family's hosting shifted toward a network, recorded by network number and day, never by address.

It is kept indefinitely and is not deleted on the 90-day schedule above, because it is the only record that a given address was ever listed.

It contains nothing about you. It holds attributes of machines we scanned on the public internet, never anything derived from a visit to this site: no identifier, no session, no account, and no record of who read which page. It is a separate database from both the access log and the accounts store, and none of the three is ever joined to another. That promise is enforced by their being different stores rather than by a rule we follow.

Who else sees it

We do not sell, rent or share personal data, and we do not transfer it to advertisers or data brokers. Two third parties are involved in serving this site:

• Cloudflare hosts and delivers the site and stores the access log, the diagnostic messages, the indicator archive and the accounts store on our behalf, as our processor. Traffic is served from their global network, so processing may occur outside your country.
• Clerk operates account sign-up and sign-in as our processor. If you create an account, to download the feed files or to use the API, Clerk processes your email address and authentication data. Its service is reached at clerk.publicmosaic.com and accounts.publicmosaic.com, and processing may occur in the United States.

Nothing else reaches out while you read. Typefaces, stylesheets and scripts are all served from this domain, with no font CDN, embedded widgets or analytics beacons, so no other company learns your IP address from reading this site. The one exception is signing in, through the sign-in flow on /indicators or the hosted sign-in page that the “sign in” link on every other page opens. If you use either, your browser talks to Clerk's endpoints on this domain and to Cloudflare's bot-check frame. Every other page loads no sign-in code: a script from this domain reads the __client_uat cookie in your browser, if you have one, only to show “account” instead of “sign in”, and sends nothing. You can check all of this in your browser's network panel.

We may disclose logs where we are legally required to, or where it is necessary to investigate abuse of this service.

Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or erased, to object to our processing it, or to lodge a complaint with your data protection authority. Email support@publicmosaic.com and we will respond within 30 days. The log is keyed on IP address and nothing else, so tell us the address and approximate dates and we can find the right rows. If you have an account, write from the email address you signed up with: the accounts store is keyed on your account identifier, which we resolve through Clerk, and we erase the account, its keys and its daily counts together.

About the indicator feed itself

The indicators at /indicators describe infrastructure: the addresses, domains, ports and certificates of hosts assessed as command-and-control servers, or as related hosts such as compromised devices, malware distribution hosts and exposed tools. They are published TLP:CLEAR for defensive use and are a separate matter from this visitor log; the two are never joined. The live page and the RSS feed are open to everyone. Only the bulk downloadable files (JSON, STIX, CSV) and the enrichment API ask you to sign in first. If you believe a host is listed in error, or you operate a network and want it excluded, see abuse & takedown and opt-out.

Changes

If we change what we collect or how long we keep it, we will update this page and move the effective date above. Material changes will be noted here rather than made quietly.

• 23 October 2026. Added the site's diagnostic messages, kept by Cloudflare for seven days, under “How long”.
• 21 October 2026. Reworded throughout for clarity, with no change to what is collected or how long it is kept, and the data controller named as Public Mosaic. This entry also records two additions made without moving the date: the configurations extracted from captured samples, in the indicator archive (5 October 2026), and the “sign in” link on every page, with the script that reads the __client_uat cookie in your browser to label it (13 October 2026).