Privacy notice

Updated 14 October 2026.

This notice describes how the Looks Sus website and Chrome extension handle information. No public account is needed to vote. Sessions and network controls mean participation is not anonymous browsing.

What we collect and why

• Lookups: main public domains identify a shared website profile. The website removes page paths before submitting a lookup. API users should send hostnames only. We do not scan websites or fetch submitted evidence links.
• Contributions: votes, optional reasons, changes and session identifiers support ratings and abuse controls. Private reports contain your description, category, optional incident date and evidence links. Corrections contain your description and the relevant website.
• Security: credential digests identify an active session. Short-lived, daily keyed network-prefix identifiers help limit abuse. Hosting providers receive connection information needed to serve requests.

What is public

Website profiles, aggregate ratings, eligible vote counts, qualifying reasons and reviewed warnings are public, including through our AI interfaces. Private reports, corrections, receipt identifiers and voting credentials are not included in public responses. A report does not become a warning automatically.

Cookies and local storage

The website uses an HttpOnly cookie for its voting session, which lasts up to 24 hours. This tab’s session storage holds form drafts and unresolved requests so a failed save can be retried. Successful submissions clear their draft. Closing the tab normally ends tab storage. Clearing site data removes local copies but does not delete contributions already stored on the server.

Optional Disqus discussions

Clicking Load discussion connects your browser to Disqus. Disqus operates its own accounts and data controls, receives connection information and the profile URL, and may use cookies or show advertising. We do not include private reports or voting credentials in the embed configuration. Loading permission is not remembered across page reloads. See Disqus’s privacy policy.

Comments are public and stored separately by Disqus. Use its controls to manage comments. Removing a Looks Sus vote or withdrawing a report does not remove a Disqus comment.

Chrome extension

The extension has a separate voting session, kept in trusted extension session storage for up to 24 hours. Manual checks send the current public domain. Optional automatic alerts require tab URL access and send active public domains after navigation. Page contents, titles, paths and query strings are not sent; incognito is excluded. Turn alerts off to stop automatic checks.

Preferences remain locally stored. Snoozes and voting drafts last for the extension session. The server can cache public Disqus excerpts, author names, timestamps and like counts for up to five minutes; expired excerpts are not displayed. The extension does not load Disqus scripts or avatars.

Service providers

The deployed service uses Netlify for website hosting and request routing, Vercel for the application backend, and Turso for the database. Providers process information needed to operate the service and may retain infrastructure logs under their own policies. Application error logging avoids request bodies, request URLs, raw IP addresses and credentials. A complete provider-log retention inventory has not yet been confirmed.

Retention and your controls

You can change or remove a vote and withdraw a private report while its originating session remains active. Withdrawal clears the report’s live narrative and evidence links. Session expiry ends receipt and editing access; it does not delete accepted contributions. Corrections do not have a self-service withdrawal control.

Votes stop counting 90 days after their last change, but their stored records are not automatically deleted at that point. Maintenance clears expired credential digests, retry records, rate-limit buckets and comment cache entries. A verified fixed deletion period for contributions, infrastructure logs and backups is not yet available. Do not submit passwords, card numbers, identity documents or other sensitive personal information.

Privacy questions

A dedicated privacy contact and the service operator’s identity have not yet been published. See Contact and support for the controls currently available. Do not use website-report forms to send identity documents or private account information.