What the site does not collect
There are no accounts, cookies, analytics, remote fonts, query telemetry or background polling. Search and filters run in your browser against static files.
What the host can see
Search terms in the address fragment are not sent in HTTP requests. Requests for source and year data files can still reveal access patterns in hosting logs. The search indexes are derived from public records; they are not encryption or a confidentiality guarantee.
What is left out
Public files exclude personal emails, phone numbers, street addresses, personal identifiers, credentials, full breach notices, full decisions, free-text narratives and raw combinations of CNIL row values.
Private state
Raw retrievals, caches, comparison state, and complete source snapshots remain in a configured private data root outside the repository and deployed site.