Last updated: 5 October 2026
We may update this Privacy Notice from time to time. The date above shows when it was last changed.
This Privacy Notice explains how personal information submitted through the Bitcoin Incident Reporting Project is collected, used and protected.
This project is intended only for people aged 18 or over.
Submitting a report is voluntary. There is no legal obligation to provide information. Only fields marked as required must be completed in order to submit a report.
If you do not give the required consent, you cannot submit a report. Declining optional permissions has no other consequence.
Who is responsible for the information?
Data controller: Udi Ben-David
Contact: contact@btcincident.org
The Bitcoin Incident Reporting Project is an independent information-gathering project and is not affiliated with Blockchain.com.
What information do we collect?
Depending on what you choose to provide, we may collect:
• Your email address and, optionally, your name
• Your country of residence at the time of the incident
• Information about an unauthorized Bitcoin transfer
• Approximate date and amount of the transfer
• Bitcoin transaction identifiers or addresses
• Information about account access and security settings
• Information about communications with Blockchain.com
• Police or law-enforcement reference information
• Any brief factual description you choose to provide
Please do not provide recovery phrases, seed phrases, private keys, passwords, 2FA codes, identity documents or unnecessary information about other people.
Why do we collect this information?
The information is collected to:
• document reported unauthorized Bitcoin transfers involving Blockchain.com wallets;
• identify and analyze possible patterns across reported incidents;
• verify relevant factual information where possible, including by comparing submitted transaction information with publicly available blockchain data;
• prepare aggregated or anonymized factual information that may be useful to regulators, journalists or law-enforcement authorities; and
• communicate with you where you have separately given permission for follow-up questions or project updates.
Legal basis and consent
We process the personal information you submit on the basis of your consent.
You may withdraw your consent at any time by contacting us at the email address above.
You may also withdraw any optional permission separately - for example, permission to receive project updates or permission to share identifiable information with journalists - without withdrawing your underlying report.
Withdrawal of consent does not affect processing that lawfully occurred before your withdrawal.
If you withdraw consent for the underlying report, we will stop consent-based processing and delete or irreversibly anonymize the affected identifiable personal information without undue delay, unless a lawful retention exception requires us to retain it.
Who may receive the information?
Your information will not be sold or provided to anyone in return for payment, commission, reimbursement, free services or another benefit.
Aggregated or genuinely anonymized information may be used for analysis and may be provided to regulators, journalists or law-enforcement authorities.
Identifiable information will only be shared consistently with the specific permissions you provide, unless disclosure is required by law.
This project does not currently refer individuals to lawyers, claims-management companies or litigation funders.
Service providers and storage
Responses are collected and stored using Google Workspace services, including Google Forms and Google Sheets.
Google provides the technical infrastructure used to collect and store responses under the service and data-processing terms applicable to the project account.
Google may process data in multiple jurisdictions. Where applicable data-protection law requires safeguards for international transfers, the project relies on the safeguards provided under the applicable Google service and data-processing terms.
Access to identifiable response data is restricted to the project operator and any person assisting with the project under a duty of confidentiality, solely for the purposes described in this Privacy Notice.
How long do we keep the information?
Information will be retained while the project remains active and thereafter only for as long as reasonably necessary for the purposes described above.
The need to retain identifiable personal information will be reviewed at least once every 12 months.
Information that is no longer reasonably necessary will be deleted or irreversibly anonymized, subject to any lawful retention requirement.
Your choices and rights
Depending on the law that applies to you, you may have rights to:
• request access to personal information relating to you;
• request correction of inaccurate information;
• request deletion of your information;
• request restriction of processing;
• request data portability where applicable;
• withdraw your consent;
• withdraw any optional permission separately; and
• ask a question about how your information is being used.
You also have the right to lodge a complaint with an applicable data-protection supervisory authority.
For example, individuals in the United Kingdom may complain to the Information Commissioner's Office (ICO).
If another supervisory authority applies to you, you may contact the relevant authority in your country or jurisdiction.
These rights are subject to applicable legal requirements and exceptions.
Contact
For privacy questions, rights requests or withdrawal of consent:
contact@btcincident.org