1. DATA MINIMISATION PRINCIPLES
LeakTrace performs live indexed-source lookups for the email address submitted for an authorised scan and processes the consent confirmation, lookup results and associated dates. Connected lookup services receive the submitted address or a hash of it, as described below. No uploads or mailbox access are used for exposure checks; no mailbox password or inbox access is required. Scan consent does not authorise access to a mailbox. Account services also process login details, saved monitored addresses, plan and payment references, verification and recovery records, and monitoring preferences. Contact submissions contain the name, reply address, subject and message you provide.
2. STORAGE AND RETENTION
- Unpaid scans: Free and anonymous scan records, associated findings and consent records expire after 90 days. Ending a browser session does not itself erase them. Purchased snapshots and snapshots created under paid monitoring are retained while the account is open, unless separately erased. - Removed monitored addresses: Removing an address stops its monitoring, not its findings. Those findings remain available for authorised re-enrollment for 12 months after removal, then expire unless they form part of a retained paid snapshot. Re-enrollment before expiry preserves that history. A completed verified erasure request removes it separately. - Account closure: Verified account erasure is processed after owner identity/authority review and confirmed billing cancellation, normally within 30 days of approval. It removes personal service data, revokes sessions and disables the account. Restricted billing references and purchase receipts are not indiscriminately deleted; scanned-address content is removed from receipt-linked snapshot shells. Applicable financial retention periods require separate owner/legal review. Older snapshots with uncertain paid provenance are preserved conservatively for review. - Operational records: Verification/recovery records expire 90 days after consumption or link expiry; completed alert and notice records expire 90 days after completion is recorded. Unsent notice drafts expire after 90 days. Unresolved delivery investigations remain pending until their outcome is established. Identified activity and legacy browser-session analytics expire after 90 days; non-identifying aggregate page, country and completed-search counters are kept separately. - Contact and request records: Contact messages expire 12 months after resolution. Access downloads remain available for 90 days after approval. Request identifiers and decision dates are retained as a minimal audit for 3 years after completion; identifying request details are cleared after 90 days, or immediately when their scope is erased. - Enforcement and exceptions: A database worker checks expiry daily while the service is running and handles approved erasure on its next processing cycle. Verified requests in progress and documented legal holds with review dates protect affected records. Records without historical removal, resolution or completion dates start a conservative retention clock when first recorded, rather than being deleted immediately. These controls cover the live application database, not guaranteed deletion of hosting backups, external provider records or recipients' copies.
3. THIRD-PARTY DATA PROCESSING
Exposure lookups send the assessed email address to Have I Been Pwned for the primary breach search and a truncated SHA-256 email hash to LeakCheck. A lookup hash is potentially identifiable and is not anonymous data. Where another connected lookup provider requires the email address, the address is supplied for that lookup; the optional XposedOrNot API+ integration works this way when enabled. Stripe processes checkout and billing information. Resend processes recipient addresses and message content for configured transactional email, monitoring alerts, contact notifications and deletion notices. If you select the paid deletion add-on, eligible notices for existing and future findings associated with monitored addresses are automatically sent after Stripe confirms payment, to operator-reviewed company privacy contacts. A deletion notice discloses its contents to that recipient; submission or delivery does not confirm that data was erased. Hosting and database services process records needed to operate LeakTrace. If you allow optional advertising measurement, LeakTrace sends Meta limited website events for public-page visits, checkout starts and Stripe-confirmed purchases. Purchase measurement may include a browser identifier, browser user-agent and verified amount and currency. LeakTrace does not send scanned email addresses, scan targets, exposure findings or report contents to Meta, and does not sell or license monitored addresses, search history or identity profiles to data brokers.
4. SECURITY SAFEGUARDS
The application uses hashed account passwords, authenticated sessions, expiring single-use verification and recovery links, and server-enforced customer, administrator and owner access restrictions. Scan and monitored email addresses are stored as readable database fields; application-level AES-256 encryption of these fields is not implemented. Password hashing and provider lookup hashing must not be confused with encryption of all stored records. No guarantee is made that every record is encrypted at the application level or that a security incident cannot occur.
5. COOKIES AND SITE ACTIVITY
Sign-in uses an essential session cookie. Allowlisted public-page views and successfully saved live scans are counted in daily aggregates by page and Cloudflare-provided country code. Repeat visits and searches count again, so these figures are activity totals, not unique-person counts. The aggregate analytics record stores no raw IP address, exact location, browser/device identifier or user identity. Optional Meta Pixel and Conversions API measurement is off until you choose to allow it. If enabled, Meta may receive public-page visit and checkout-start events, plus a Stripe-verified purchase event with its value and currency, browser identifier and browser user-agent. The browser may store Meta cookies named _fbp and _fbc after consent. Scan and report pages are excluded; scanned addresses and exposure results are never sent to Meta. Refusing or withdrawing optional measurement does not affect the service; withdrawal stops future events and clears these Meta cookies. Use Cookie settings in the footer to change your choice. Cloudflare still processes network requests to deliver the site; this statement describes the aggregate LeakTrace analytics we store, not every hosting or security log. Country reporting starts on the date shown in the owner dashboard and is not backfilled; ZZ means the country was unavailable. Earlier opted-in browser-session analytics records are not used for the new counters and expire under the 90-day operational retention rule.
6. YOUR REQUESTS AND CHOICES
Use Privacy requests in your account dashboard to submit and track access or erasure requests. Without an account, use /privacy-requests for records of scans performed without an account against an address you control. Save the private tracking code: it lets you check the outcome and obtain an owner-approved scoped JSON access download. Anonymous requests use a single-use mailbox link, with an owner-reviewed identity and authority route where email verification is unavailable. Mailbox verification alone does not approve disclosure or deletion. The owner reviews identity, authority over any family/corporate records, the record inventory and legal exceptions; irreversible erasure requires explicit confirmation. Anonymous requests do not disclose or delete another customer's account-owned records. Use Contact for correction, restriction, objection, portability or other privacy questions where these rights apply. Withdrawing consent does not affect earlier lawful processing. Rights remain subject to applicable law, including required retention. You may complain to the relevant data-protection authority, including the UK Information Commissioner's Office where applicable.