Browser extension
Submission

When you submit a signal via the Extension, it sends the page URL plus the metadata needed to operate the workflow.

RequiredSignal URL
PseudonymAnalyst pseudonym (the Extension UI requires a pseudonym, but it can be any handle and does not need to be your identity).
OptionalAnnotations (tags, note, selected text)
OperationalClient metadata (User-Agent, extension version), page title, submission timestamp


The Extension stores its settings locally in your browser. HWT receives those values only when you submit.
Signals and personal data
Signals (URLs, tags, and notes)

A signal is a URL plus optional context (tags and notes). We treat signals as facts about the web and as part of an OSINT dataset. Signals are not treated as personal data about the person submitting them. HWT does not delete submitted URLs, tags, or notes on request, except where required by law or where removal is necessary for safety/security (for example, during abuse investigations).

Free-text fields are user-supplied: if you include personal data in notes or selected text, you are choosing to submit that content. Do not submit secrets. If a signal contains clearly unnecessary personal data in free text, HWT may redact it where feasible.
Analyst pseudonyms

An analyst pseudonym can be personal data if it identifies (or could be linked to) a natural person. HWT treats pseudonyms as personal data. If you request removal, HWT will delete or disassociate your pseudonym from stored submissions while retaining the underlying signals.
Legal bases (GDPR)

Performance of a requested service (Art. 6(1)(b)): processing what you submit to perform the “submit signal” function.
Legitimate interests (Art. 6(1)(f)): operating and securing HWT; preventing abuse; maintaining reliability; running an OSINT collection/review workflow.
Legal obligation (Art. 6(1)(c)): where we must comply with applicable law or binding requests.


Retention

Signals and signal data: retained for the lifetime of the HWT project (the dataset is the purpose of the service).
Pseudonyms: retained while linked to submissions, until removed/disassociated on request.
Security/access logs: retained for a limited operational period (typically days to weeks), and longer where needed for security/abuse investigations or legal obligations.


Your rights and requests

If GDPR applies to you, you may have rights to access, rectification, restriction, objection, portability, and erasure regarding your personal data.
We honorPersonal data requests

Pseudonym removal/disassociation
Access/clarification about what personal data we hold about your pseudonym


We generally declineSignal erasure requests

Requests to delete signals (submitted URLs, tags, notes) are generally declined because signals are treated as project data (an OSINT dataset), not as personal data about the submitter.
Edge casesLegal and security

Legal obligations: we may remove or restrict content where required by law.
Abuse/security investigations: we may retain relevant logs or records to protect the service and its users.
User-supplied personal data: if a signal contains personal data in free text, we may consider targeted redaction where feasible.