Last updated: 2 October 2026
What we do not collect
We never log or store the email addresses, phone numbers, domains or passwords you search. Searches are sent by POST so they never appear in URLs or server access logs.
How breach data is stored
Breached identifiers are stored only as keyed HMAC-SHA256 hashes. We cannot turn them back into email addresses or phone numbers.
Passwords
Password checks use k-anonymity: only the first five characters of a SHA-1 hash are sent to the Pwned Passwords range API. With JavaScript enabled, your password never leaves your browser.
Breach alerts
If you subscribe, your address is stored encrypted, used only to send breach alerts and deleted immediately when you unsubscribe.
Statistics
We keep anonymous daily counters of how many lookups were made. They contain no searched values and no IP addresses.
Cookies and advertising
We use a session cookie for security and a cookie to remember your language. Ads, when shown, are requested as non-personalised ads.
Contact
Questions about privacy? Email [email protected].