Privacy notice

The breach check isn't open yet. Today the only personal data this site collects is your email address, and only if you join the waiting list. The example results use test addresses, and data removal works entirely in your browser. The breach check section below describes how it will work when sign-up opens.

The short version: the breach check and data removal keep nothing. We keep your email address only if you join the waiting list.

Who we are

Debreach is the data controller. Contact: privacy@debreach.com.

Breach check

• You type an email address. We send that address one email with a private link. We do not store the address.
• When the link is opened, we send the address to Have I Been Pwned (haveibeenpwned.com, Australia) to look up breaches, and show you the answer. We do not store the results. We hold them in memory for up to ten minutes so that reloading the page works.
• To stop misuse we count requests per internet address and per email address for up to 24 hours, in memory, in a scrambled form.
• Our lawful basis is legitimate interests: running the check you asked for and protecting the service from abuse.

Data removal

The free data removal page collects nothing. Each opt-out link takes you to the organisation that runs it, and you deal with them directly.

Waiting list

• If you join the waiting list, we store your email address, encrypted, with the date you joined. Our lawful basis is your consent.
• We use it to send you one email when sign-up opens. Nothing else, and we don't pass it to anyone else.
• You can delete your address from the list at any time on the leave the waiting list page. We delete the whole list within 12 months of sign-up opening at the latest.
• To stop misuse we count requests per internet address for up to 24 hours, in memory.

Who else handles your data

• Have I Been Pwned: breach lookups, as above.
• Hostinger: hosts our server.
• Resend (resend.com, United States): will deliver our emails once we start sending them, so it will handle the address each email goes to and keep a record of the email for up to 30 days.

We never sell your personal data, and we don't share it with anyone except the companies listed above, who only handle it to run this service for us. We don't use advertising or analytics trackers, and this site sets no cookies.

Your rights

You can ask for a copy of your data, or for it to be corrected or deleted, and you can withdraw consent at any time: write to privacy@debreach.com. If you're unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.