How to document doxxing without spreading it
Create a useful incident log with exact URLs, timestamps, screenshots, redacted copies and case references.
Save the minimum useful evidence
Record the exact URL, account or publisher, local date and time with time zone, the type of exposed data and any threat attached to it. Keep a full screenshot where safe, including the surrounding context. Capture a separate record for each copy.
Separate originals from shared copies
Keep originals in a folder with restricted access. Redact the actual address, ID number or unrelated bystanders before sharing evidence. Export the redacted copy and reopen it to verify that obscured text cannot be selected or recovered by removing a shape. Share a direct link or case number only with people who need it.
Build a simple timeline
14:22 UTC · Source URL recorded · Exposed data: home address · Report submitted to the platform · Reference: [case ID].
When something is removed, write down the date and check whether the search result also changed. This helps you choose the right follow-up without re-opening every link. See Doxxing removal request template and How to remove personal information from Google Search.