Privacy Policy
Last updated: June 23, 2026
What data we collect
- Email address (for account registration)
- Password (stored as bcrypt hash — industry standard, not plain text)
- Breach check history (SQLite database, linked to your email)
- Session tokens (temporary, expire after 30 days)
What we do NOT collect
- Passwords you check in the password tools — they are processed client-side via k-anonymity
- Browsing behavior or analytics (no Google Analytics, no tracking or third-party cookies)
- Payment details — PayPal handles all payment processing
How we use your data
- Account creation and login
- Premium subscription management
- Email breach check history (for your convenience)
Data Controller
Breach Checker is operated in the European Union. For any privacy-related inquiries, contact the Data Controller at support@breachchecker.online. Full legal entity details are available upon request.
Data sharing
We do not sell, trade, or share your personal data with third parties. Email addresses checked against external APIs (XposedOrNot) are transmitted securely via HTTPS and used only for the breach lookup. We do not store checked emails.
Your GDPR Rights
Under the General Data Protection Regulation (GDPR), you have the following rights:
- Right of access — request a copy of your personal data we hold.
- Right to rectification — correct any inaccurate or incomplete data.
- Right to erasure — request deletion of your account and associated data.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — object to processing of your personal data.
- Right to lodge a complaint — with a supervisory authority such as CNIL (France) or KZLD (Bulgaria).
To exercise any of these rights, contact us at support@breachchecker.online. We will respond within 30 days as required by law.
Data retention
Your account data is retained for as long as your account remains active. Accounts inactive for more than 2 years will be automatically deleted. You may also request deletion at any time by contacting us at support@breachchecker.online.
Third-party services
Breach Checker uses: XposedOrNot (breach database), Qualys SSL Labs (SSL checking), Cloudflare DNS (DNS lookup). Each service has its own privacy policy.
Security
All connections are HTTPS. Passwords are hashed. We follow industry-standard security practices.