Privacy, cookies and terms

Last updated 9 October 2026. Covers caught.org.uk.

Who we are

CAUGHT is an independent, non-commercial project run by Angus McMillan, who is responsible for the personal data described here (the "data controller"). Contact: contact@caught.org.uk.

What we collect, and why

• Just browsing: nothing about you. No advertising, no tracking, no third-party analytics, and nothing stored on your device. We keep simple daily counts of how many times each public page was loaded, whether the visitor was a browser or a search-engine crawler, and the name of the website that linked you here (the site's name only — never the full address, so never anything you searched for). We also keep daily counts of a few things the site is for — how many times the closure dataset was downloaded, an evidence pack was generated, a letter to an MP was drafted, or a share button was pressed. These are running totals per day, not records of visits: there is nothing in them that could identify you, they are not linked to each other or to anything else, and we do not store your IP address or your browser's details. Our host keeps short-lived technical logs to keep the site running and secure.
• An account (optional, needed only to vote, comment or get alerts): your email address, and your password if you set one (stored only as a one-way hash). Sign-in codes are stored hashed and expire after 10 minutes; a sign-in lasts 60 days.
• Votes and comments are linked to your account. Comments are public, shown with a shortened name made from your email (for example "an…w"). So that deleting an account can't be used to vote twice, we keep a one-way code derived from your email; it cannot be turned back into your address.
• Email alerts: your address and the areas you chose, until you unsubscribe (every alert has a link).
• Feedback: your message and your browser type. It is also emailed to us through Web3Forms. We do not store your IP address.
• Write to your MP: your postcode is sent to the UK Parliament's Members API to find your MP. We don't store it. You send the letter yourself, from your own email.
• Abuse protection: rate limits use a one-way code made from your IP address, kept only for the short time window they apply to.

We rely on our legitimate interest in running and protecting the site, on providing the features you ask for (your account), and on your consent for alerts. We never sell data or use it for marketing.

Who else handles it

Fly.io hosts the site (servers in London); Tigris stores encrypted backups, kept for 7 days; Brevo sends sign-in codes and alerts; Web3Forms relays feedback; Cloudflare runs our domain's DNS and forwards email sent to caught.org.uk addresses. Some are based outside the UK and process data under their own data protection terms. Map tiles (Esri, OpenStreetMap) are loaded from their servers, which see your IP address, as with any website.

Your rights

You can ask for a copy of your data, or for it to be corrected or deleted, and you can object to how we use it. You can delete your account yourself from the account menu, or email us. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office.

Cookies and browser storage

• caught_session: keeps you signed in (60 days). Only set if you sign in.
• caught_device: set when you vote, to protect the vote count from abuse (up to 2 years).
• Browser storage: remembers your own votes and display choices, on your device only.

These are all strictly necessary for features you use. There are no analytics or advertising cookies — every count described above needs no cookie and stores nothing on your device — which is why there is no cookie banner. Pressing a share button tells us only that a share happened that day; it does not tell us what was shared, where you sent it, or who you are.

What the site is, and isn't

• CAUGHT analyses public satellite and vessel-tracking data. A case means the data raises a question worth checking, not that anyone has broken the law. Data can be incomplete or wrong, and every case says what we don't know.
• The site is provided as it is, without any guarantee, and is not legal advice. Please don't use it to harass anyone.
• Data sources and their licences are listed on the About page.

Corrections and right of reply

If you're connected with a vessel shown on the site, or think anything is wrong, email contact@caught.org.uk with a link to the case. We look at every request, correct or remove what's wrong, and can add your response to the case.