Privacy Policy

1.1. The Service (the leakcheck.io and leakcheck.net websites, the API and the Telegram bot) is provided by a registered company with number 12101959, whose registered office is at 2 Thomas More St, London, United Kingdom, E1W 1WY ("we", "us", "the Company").

1.2. For the personal data described in this Policy, we act as the data controller, except where we process data on behalf of a business customer under our Data Processing Agreement, in which case that customer is the controller and we are the processor.

2.1. Account data — the email address and authentication details you provide when you register, and any details from a third-party sign-in method you choose to use.

2.2. Billing data — the information needed to take payment. Card details are handled by our payment providers; we do not store full card numbers.

2.3. Usage & technical data — logs such as IP address, device and browser information, and product analytics needed to operate, secure and improve the Service.

2.4. Support data — the content of messages you send us by email, Discord or Telegram.

2.5. Breach data — records from third-party data leaks that are indexed in our database (see Section 4).

3.1. We rely on performance of a contract to create and operate your Account and provide the Plan you purchase.

3.2. We rely on legitimate interests to secure the Service, prevent abuse, maintain and improve the product, and to operate a breach-notification database that helps people discover exposure of their data. Where we rely on legitimate interests we have balanced them against your rights and freedoms.

3.3. We rely on legal obligation to keep certain records (for example, for tax and accounting), and on consent where required, for example for non-essential cookies — which you may withdraw at any time.

4.1. Our database contains records that have already been exposed in third-party data leaks and made available in publicly accessible sources. We did not cause these leaks and we do not obtain the data from the individuals concerned.

4.2. We process this data in the legitimate interest of both our Users and the wider public in identifying and remediating exposure. We provide a straightforward way for any individual to have their data made unsearchable (see Section 11).

4.3. Access to detailed breach data is limited to registered Users within their Plan limits, and searches are provided as a security-awareness tool, not for profiling or adverse decisions about individuals.

4.4. Because the database contains records relating to a very large number of individuals whose contact details are frequently outdated or unverifiable, providing an individual privacy notice to every person concerned would involve disproportionate effort within the meaning of Article 14(5)(b) UK GDPR. This Policy serves as the public information notice for that processing: any individual can check their exposure free of charge and request removal as described in Section 11.

5.1. We do not store the queries you submit for a leak check on our servers, and we do not build a history of what you searched for.

5.2. If you prefer not to submit an identifier in plain text, you can search using a SHA-256 hash of your email address and the "email by hash" search type.

6.1. We use strictly necessary cookies to keep you signed in and to keep the Service secure. These do not require consent. Some functional values (such as the free-check counter) are kept in your browser's local storage and are not transmitted to us.

6.2. We do not currently use non-essential (analytics or advertising) cookies on the Site. If we introduce them, we will ask for your consent first, and you will be able to withdraw it at any time.

7.1. We do not sell your personal data. We share it only with service providers who process it on our behalf under written contracts — for example hosting, payment processing, email delivery and analytics.

7.2. We may disclose personal data where required by law, to enforce our Terms, or to protect the rights, safety and property of our Users, the public or us.

8.1. Where personal data is transferred outside the United Kingdom, we rely on an adequacy decision or on appropriate safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum.

9.1. We keep Account and billing data for as long as your Account is active and for as long afterwards as is necessary to meet legal, accounting or reporting obligations.

9.2. Technical logs are kept only for as long as needed for security and troubleshooting. Breach data is retained while it remains relevant to our service and until a valid removal request is fulfilled.

10.1. Subject to the conditions in the UK GDPR, you have the right to access your personal data; to rectify inaccurate data; to erase data; to restrict or object to processing; to data portability; and to withdraw consent where processing is based on consent.

10.2. To exercise any of these rights, contact us using the details in Section 15. We will respond within the statutory time limit, normally one month.

11.1. You can request that data relating to you be made unsearchable on the Service. This makes it unsearchable through LeakCheck but does not remove it from the original source of the leak.

11.2. Removal steps depend on the identifier concerned and are set out in our Data removal guide. Email-based removals can be submitted to removal@leakcheck.net.

12.1. We apply appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls and the principle of least privilege. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13.1. The Service is not directed to children, and Accounts may only be created by individuals who have reached the age of legal capacity applicable to them.

14.1. We may update this Policy from time to time. The current version is always available on the Site, and material changes will be indicated by updating the "Last updated" date.

15.1. For privacy questions or to exercise your rights, contact us at the@leakcheck.net. The controller is a registered company with number 12101959, 2 Thomas More St, London, United Kingdom, E1W 1WY.

15.2. If you are in the UK and believe we have not handled your data properly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. We would appreciate the chance to address your concern first.