The free scan never stores the email or domain you submit. They're used only for the duration of the request — sent to the HaveIBeenPwned API (for the email) and looked up via public DNS (for the domain) — then discarded.
Only an anonymous statistic is kept: a hash derived from your IP address (one-way, not reversible), the date, and the number of breaches found — with no way to link it back to the actual email or domain checked. This is used solely to rate-limit abuse (5 checks per hour per IP) and to display the public counter.
If you subscribe to continuous monitoring, we keep your email (and domain, if provided) for as long as the subscription is active, so we can re-check periodically and alert you. Payment is handled by Stripe — we never see your card details. Monitoring only starts once you confirm the address via the link emailed to you; payment alone never activates monitoring on an address. On cancellation, monitoring stops immediately and your data is deleted within 7 days.
No tracking cookies, no data resale.
