Privacy Policy

Scope and operator

CheckLeaked.cc (“CheckLeaked,” “we,” “us,” or “our”) operates a data-breach exposure search and monitoring service. This policy applies to CheckLeaked services that display or link to it, including the website, developer APIs, browser extensions, and official Discord, Slack, and Telegram integrations.

For account, website, support, payment, and service-usage information described here, the CheckLeaked.cc service operator determines why and how that information is processed and acts as the data controller where that concept applies. Contact the operator at [email protected].

Customers independently determine whether they may lawfully search, monitor, export, or otherwise use information returned by the service. We do not act as a customer’s data processor merely because the customer uses the service; a different allocation applies only if a separate written data-processing agreement says so.

Information we collect and where it comes from

Sources

We obtain information:

• directly from you when you search, create an account, configure monitoring, buy access, or contact support;
• automatically from your browser, device, and interaction with the service;
• from sign-in and integration providers such as Google, Discord, Slack, Telegram, or another provider you choose;
• from payment, reseller, fraud-prevention, infrastructure, and analytics providers;
• from licensed breach-data providers, security-research sources, and publicly accessible incident sources; and
• from another user when that user lawfully submits an identifier for search or monitoring.

Please do not submit information that is unnecessary for the intended search or that you are not legally authorized to use.

Why we use information and our legal bases

Provide the service

Authenticate users; run searches and monitoring; return, save, and export results; operate integrations; manage plans, keys, quotas, and support. Legal basis: contract or steps requested before a contract.

Protect the service

Rate-limit requests; detect abuse, fraud, unauthorized access, and technical failures; investigate incidents; enforce the Terms. Legal basis: legitimate interests in security, service integrity, and protecting users, and legal obligation where applicable.

Process purchases

Create and fulfill orders, deliver license keys, maintain transaction records, resolve disputes, and meet accounting obligations. If you turn on monthly auto-renew with PayPal, we check each charge with PayPal and extend your plan for it until you cancel. Legal basis: contract and legal obligation.

Run the referral program

Credit invites, count visits to invite links, hold and release earned days, prevent self-referral and repeat new-customer bonuses, and apply the days you redeem. Referrers see, for each person who joined through their link, only the month they joined and whether a purchase was made, plus totals; never a name, an email address, or which plan was bought. Because referral days are earned for each paid month and released after a hold, a referrer’s own day balance, release dates, and removed days can show how many months a referred person paid for, roughly when, and whether a payment was later refunded or reversed. If you earn referral days, we may email you when they become available (at most once a day), with a one-click opt-out in every such email. Legal basis: contract (the program terms) and our legitimate interest in preventing fraud.

Improve and measure

Understand feature use, diagnose errors, measure performance and conversions, and improve usability. Legal basis: consent where required for non-essential tracking; otherwise our legitimate interests, subject to your rights.

Communicate

Send service, security, purchase, monitoring, and support messages. If you start a checkout and do not complete the payment, we may send one reminder to the email address you entered, with a link to finish the purchase and a link to stop such reminders; legal basis: our legitimate interest in completing the purchase you started. If your account has a paid plan, we email you three days and one day before it expires and once a few days after, because a plan renews or charges automatically only if you turn on monthly auto-renew with PayPal (we skip these reminders while auto-renew is set to renew the plan); each email has a link to stop these reminders, and the same legal basis applies. If you turn on auto-renew, we email you when it starts, when a payment fails, when it stops or is cancelled, and once a year while it stays on; these messages are part of the subscription and have no opt-out; legal basis: contract. When you create an account, we send up to two getting-started emails in its first days (how to run a first check and what the paid plans add), each with a link to stop them; legal basis: our legitimate interest in helping you use the account you opened. Marketing is sent only on an appropriate legal basis, and you may opt out at any time.

Comply and defend

Respond to valid legal process, meet regulatory duties, and establish, exercise, or defend legal claims. Legal basis: legal obligation and legitimate interests.

Breach-data search

Help people and organizations identify exposed accounts, investigate security incidents, and reduce fraud. Where GDPR-style law applies, we rely on legitimate interests in cybersecurity and fraud prevention, balanced against affected people’s rights and the safeguards in this policy.

We do not use account or service data to make decisions that produce legal or similarly significant effects about you solely by automated means. Search results and exposure summaries are informational security signals, not eligibility decisions.

Cookies, local storage, analytics, and support tools

CheckLeaked uses cookies and similar browser storage for sessions, security, language and interface preferences, application variant selection, feature operation, analytics, conversion measurement, and support. Necessary storage may be required to sign in or retain a setting.

If you open an invite link (an address with ?ref= and an 8-character code), we store that code in a first-party cookie, cl_ref, for 30 days. It remembers which invite link you used so the referral can be credited when you sign in or buy, and it is cleared once the invite has been processed. Other ref values in a link are not stored. Once an invite is processed for your account, local storage keeps a note of it so it is not sent again.

Google Analytics (GA4) remains active to measure site usage, engagement, and purchases, with IP anonymization configured. Advertising measurement depends on where you are. In the European Economic Area, the United Kingdom, and Switzerland it starts switched off: Google's advertising consent signals are set to denied until you allow advertising. Everywhere else it starts switched on, and the banner and Settings let you turn it off at any time. Either way, our app configures Google Ads and directs events to our Ads destinations unless you have declined advertising, and Google's consent signals control what those destinations may store on your device. Reddit's advertising pixel (redditstatic.com) has no consent signals, so it is either loaded or not, by the same regional rule. In the European Economic Area, the United Kingdom and Switzerland it is loaded only after you actively allow advertising. Everywhere else it starts switched on unless you have declined advertising or your browser sends a Global Privacy Control signal. To tell which rule applies, your browser asks our network provider, Cloudflare, for the country of your connection; if no country can be determined, the European rule applies. Once loaded, the pixel receives page visits and, later, purchase events. Advertising personalization follows the same consent signals as measurement. Declining advertising leaves Google Analytics active and does not affect searches or purchases.

While GA4 remains active, Google's tag can still send limited consent and conversion-modeling requests to advertising services with advertising consent marked as denied. These requests can include purchase signals. If your permission changes, Google's tag can update earlier conversion signals. Declining advertising therefore does not block every request to Google's advertising services.

Reddit's pixel has no consent-mode equivalent. If you decline advertising it is never loaded, so nothing reaches Reddit. If you withdraw permission later, our app stops handing it further events at once; the pixel code already loaded on the page stays resident until you reload.

LinkedIn's Insight Tag (snap.licdn.com, px.ads.linkedin.com) follows the same regional rule as Reddit's pixel. In the European Economic Area, the United Kingdom and Switzerland it is loaded only after you actively allow advertising with LinkedIn named in the request; a permission given before LinkedIn was added does not cover it, and you are asked again. Everywhere else it starts switched on unless you have declined advertising or your browser sends a Global Privacy Control signal, and the banner and Settings let you turn it off at any time. The tag is only started from a page whose address holds no search, and our app hands it nothing while one does. We switch off its automatic page and click tracking, so LinkedIn receives only what our app hands it: the address of a page without any search term, query string or fragment, and, as conversions, the fact that an account was created or an order was paid, with the amount paid in US dollars and a one-way code derived from the order (so LinkedIn does not count the same sale twice), but no order number or account identifier. With each request LinkedIn also receives the usual IP address and browser information and its own cookies.

When a payment is confirmed, our server may also report that purchase to LinkedIn directly (LinkedIn's Conversions API), which covers orders completed on our payment provider's own checkout page. It sends the amount paid in US dollars, the same one-way order code, your email address as a SHA-256 hash (LinkedIn uses it only to match the purchase to a LinkedIn member) and, if your browser had one, LinkedIn's ad-click identifier. It is never sent if you declined advertising or your browser sent a Global Privacy Control signal when you checked out. When we have no choice from your browser, it is sent only if the countries we know for the checkout or the payment are all outside the European Economic Area, the United Kingdom and Switzerland.

LinkedIn uses these signals to measure our campaigns, to report aggregated statistics about the audiences that saw them, and to build audiences so our ads can be shown to you on LinkedIn. If you are signed in to LinkedIn, on this or another device, it can link them to your LinkedIn account. The tag stores its identifiers on this site: li_fat_id (the ad click, up to 30 days), li_giant (up to 7 days) and li_adsId (in local storage, or a cookie for up to 180 days). Once started, its code stays on the page until you reload. Like Reddit's pixel it has no consent-mode equivalent: a withdrawal stops our app handing it anything further at once, and you can also use LinkedIn's retargeting opt-out and its cookie policy.

We save your advertising choice in a first-party cookie for 180 days and share it between the current and classic versions of the site. If the browser cannot save your choice, it applies to the current page and you may be asked again. You can change or withdraw your choice anytime in Settings → Data & privacy. Resetting interface preferences does not reset this choice.

Withdrawing permission immediately stops future events our app directs to Google Ads, LinkedIn Ads and Reddit Ads. Google's code already loaded on the page may finish an in-flight request or send the updates described above. Settings offers an optional reload to start a new page without the app's Ads configuration, Reddit's pixel or LinkedIn's tag; GA4 and its limited requests remain active. The site does not automatically reload your search or checkout. Withdrawing does not retract information already submitted to a provider.

The site also integrates Hotjar for product-behavior and feedback analysis; Tawk.to for live support; and embedded services such as YouTube or Trustpilot when their content is used. These providers may receive IP, device, browser, URL, event, cookie, and interaction information. Tawk.to may also receive your account email when you are signed in so support can recognize you.

You can delete or block storage through your browser and use provider opt-out controls. Blocking necessary storage can prevent sign-in or other features from working. Where law requires consent before non-essential technologies are used, that consent must be a separate, valid choice; this policy is notice and does not itself grant consent.

Provider information: Google, LinkedIn, Reddit, Hotjar, Tawk.to.

When information is shared

We disclose information only as reasonably necessary to:

• infrastructure, hosting, content-delivery, database, security, and email providers, including Cloudflare and our hosting vendors;
• analytics, advertising-measurement, usability, and support providers described above;
• authentication and integration providers you choose to connect;
• payment and commerce providers, including NOWPayments, PayPal (for monthly auto-renew: we send PayPal the plan and a subscription reference, PayPal charges you, and PayPal tells us the subscription's status and charges), and external license-key resellers or checkout providers;
• licensed breach-data and security-data providers when a request must be sent upstream to produce results;
• professional advisers, auditors, insurers, or transaction counterparties under confidentiality duties;
• authorities or other parties when required by valid law, to protect rights or safety, or to investigate abuse; and
• a successor in a merger, financing, reorganization, or sale, subject to appropriate notice and safeguards.

We do not sell personal information for money. Some laws define “sale,” “sharing,” or “targeted advertising” broadly enough that analytics or advertising-measurement disclosures may qualify even without payment. Where such law applies, you may object or request an opt-out at [email protected]. We do not knowingly sell or share personal information of people under 16.

See the privacy notices of Cloudflare, NOWPayments, and PayPal for their independent practices.

International transfers

CheckLeaked and its providers operate in multiple countries. Information may therefore be processed outside your country, including in countries whose privacy law may offer different protection.

Where transfer restrictions apply, we use an available lawful mechanism appropriate to the transfer, such as an adequacy decision, standard contractual clauses, or another legally recognized safeguard, and assess supplementary measures where required. Contact us to request information about the safeguard relevant to your data.

How long we keep information

We keep information only for the period reasonably needed for the purpose described, taking account of account status, user choices, security, provider and licensing obligations, disputes, and legal recordkeeping. The service does not use one retention period for every record.

Account and preferences

While the account is active. A verified account-destruction request deletes the primary account and associated saved-search stores; limited backups, security records, or legally required records may remain until their normal deletion cycle ends.

Saved searches and monitoring

Until you remove the entry or destroy the account, unless a shorter feature-specific period is shown.

Temporary results and caches

For the feature’s operational period, commonly minutes to seven days. Some API request records are configured to expire after 90 days.

Security and service logs

For the shortest practical debugging, rate-limit, abuse-prevention, and incident-response period, with longer retention only when an investigation or legal duty requires it.

Purchases and support

For fulfillment and support, then as needed for accounting, tax, fraud prevention, chargebacks, disputes, and legal claims. Auto-renew subscription records, including the record of the terms you accepted, are kept for at least three years; the PayPal payer email address and payer ID stored with them are removed when you destroy the account.

Referral program

While the account is active; visits to invite links are kept only as daily totals. When you destroy the account, your referral code is deleted, unredeemed days are removed, the hashes of the networks your account viewed its referral details from are deleted, and a hashed marker of the account and its email address is kept to prevent repeat new-customer bonuses. The record that an account joined through an invite is kept, hidden from the referrer, so the same account cannot be invited twice.

Analytics

According to our provider settings and the provider’s own retention rules; aggregated or de-identified statistics may be kept longer.

Breach-index records

While the source remains available and processing remains necessary and lawful for cybersecurity purposes, subject to licensing limits, source updates, suppression review, and applicable rights.

Your privacy rights

Depending on your location and the processing, you may have the right to access, correct, delete, restrict, or receive a portable copy of personal data; object to processing based on legitimate interests or direct marketing; withdraw consent without affecting earlier lawful processing; and complain to a privacy regulator.

California and certain other U.S. residents may also have rights to know the categories, sources, purposes, specific pieces, and recipients of personal information; request correction or deletion; opt out of sale, sharing, or targeted advertising where applicable; limit certain uses of sensitive personal information; and receive equal service without unlawful discrimination.

How to make a request

1. Email [email protected] from the address connected to your account when possible.
2. State the right you want to exercise and the information or account involved. Use “California privacy request” or “Breach record review” in the subject when relevant.
3. Provide only the information reasonably needed to verify your identity and authority. Never email a password or full payment credential.

An authorized agent may submit a request where law permits. We may ask for proof of authorization and verify the request directly with you. We generally respond within one month for EEA/UK requests or 45 days for applicable U.S. state requests, subject to lawful extensions. We may deny or limit a request where an exception applies and will explain the reason unless law prevents us.

EEA residents may find their supervisory authority through the European Data Protection Board member list.

UK residents may contact the Information Commissioner’s Office.

Security

We use measures designed to protect information in proportion to its risk, including encrypted transport, access controls, authentication, request verification, rate limits, provider safeguards, logging, cache expiration, and incident investigation. Access is limited to people and providers with an operational need.

No internet service can guarantee absolute security. Protect your account, API keys, bot tokens, devices, and sign-in provider; use unique credentials; and notify us promptly if you suspect unauthorized access. Do not send passwords or unnecessary breach records through email or chat.

Breach-index information and people who are not users

The service searches information associated with third-party security incidents. CheckLeaked did not collect that information from the affected person at the time of the original incident and did not cause the incident. Results may come from licensed services—including, depending on the feature, LeakCheck.io, DeHashed, Snusbase, LeakRadar.io, or Have I Been Pwned—and from publicly accessible security sources.

Breach records can be inaccurate, duplicated, stale, attributed to the wrong person, or unlawfully used by someone else. We restrict use through access controls, quotas, paid entitlements, security monitoring, and the acceptable-use rules in our Terms.

Children

CheckLeaked is intended for people aged 18 or older and is not directed to children. We do not knowingly create accounts for children or knowingly collect their personal information through direct interaction with the service.

A breach source may contain information about a minor without our knowledge. A parent, guardian, or affected person may contact us for a priority review. We do not knowingly sell or share personal information of anyone under 16.

Policy updates

We may update this policy when the service, providers, or law changes. We will post the revised policy with a new effective date. If a change materially affects how we use information already collected, we will provide additional notice or request consent where required. Earlier versions remain applicable to earlier processing to the extent required by law.