What Ubonile does, counted in public
We publish how much Ubonile is used, how requests end, how long we keep data, and a fingerprint of our custody log every day. We keep this page boring on purpose. A false number here would be easy to catch.
So far
These are counted when you open the page.
An answer is counted when it has been received, whether or not an officer has opened it. We count answers, never the people who sent them, and we do not know who most of them are.
How requests end
When someone closes a request, they say how it ended. We count each one.
No request has been closed with an outcome yet.
We never say that Ubonile solved a case. The person who asked chooses the outcome, and we report it as they gave it.
The daily fingerprint
Every action on a case is written to a log: a request going live, a file arriving, an officer opening it. Each entry holds a fingerprint of the entry before it. Change an old entry and every entry after it stops matching.
Once a day we combine the latest fingerprint of every case log into one number and publish it here. It contains no names and no content. It is a number made from other numbers.
How anyone can use it
- Keep a copy of a day's fingerprint somewhere that records the date: a screenshot, an email to yourself, a printout.
- Later, if anyone doubts that our records were left alone, ask us to recompute that day's fingerprint from the case logs.
- If the result matches your copy, the history up to that day was not changed. If it does not match, something was.
Journalists, partners, auditors and the Information Regulator can all do this. The custody report that an officer receives states the final fingerprint of that case's log, so a court can see the same thing. The fingerprint proves that our record was not rewritten. It does not prove that a file is genuine.
The latest fingerprint
- Tue 3 Nov0 case logs, 0 entriese3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
How often we delete data
A deletion job runs every 6 hours. This is what it removes, and when.
- Answers with no verified officer
- At 90 days.
- Answers linked to a verified officer
- Kept until the officer releases them, and reviewed every 12 months.
- Unfinished uploads
- After 24 hours.
- IP address hashes
- After 24 hours.
- Request text
- The public "what to look for" line is removed 30 days after a request closes. A request lives 30 days, or up to 90 if the officer extends it.
- Alerts
- Each ends after 7 days.
- Custody log hashes
- After 7 years. They hold no personal information.
The full list, and what we collect from each kind of person, is on the privacy page.