Privacy Policy

Scope and operator

CheckLeaked.cc (“CheckLeaked,” “we,” “us,” or “our”) operates a data-breach exposure search and monitoring service. This policy applies to CheckLeaked services that display or link to it, including the website, developer APIs, browser extensions, and official Discord, Slack, and Telegram integrations.

For account, website, support, payment, and service-usage information described here, the CheckLeaked.cc service operator determines why and how that information is processed and acts as the data controller where that concept applies. Contact the operator at [email protected].

Customers independently determine whether they may lawfully search, monitor, export, or otherwise use information returned by the service. We do not act as a customer’s data processor merely because the customer uses the service; a different allocation applies only if a separate written data-processing agreement says so.

Information we collect and where it comes from

Sources

We obtain information:

• directly from you when you search, create an account, configure monitoring, buy access, or contact support;
• automatically from your browser, device, and interaction with the service;
• from sign-in and integration providers such as Google, Discord, Slack, Telegram, or another provider you choose;
• from payment, reseller, fraud-prevention, infrastructure, and analytics providers;
• from licensed breach-data providers, security-research sources, and publicly accessible incident sources; and
• from another user when that user lawfully submits an identifier for search or monitoring.

Please do not submit information that is unnecessary for the intended search or that you are not legally authorized to use.

Why we use information and our legal bases

Provide the service

Authenticate users; run searches and monitoring; return, save, and export results; operate integrations; manage plans, keys, quotas, and support. Legal basis: contract or steps requested before a contract.

Protect the service

Rate-limit requests; detect abuse, fraud, unauthorized access, and technical failures; investigate incidents; enforce the Terms. Legal basis: legitimate interests in security, service integrity, and protecting users, and legal obligation where applicable.

Process purchases

Create and fulfill orders, deliver license keys, maintain transaction records, resolve disputes, and meet accounting obligations. Legal basis: contract and legal obligation.

Improve and measure

Understand feature use, diagnose errors, measure performance and conversions, and improve usability. Legal basis: consent where required for non-essential tracking; otherwise our legitimate interests, subject to your rights.

Communicate

Send service, security, purchase, monitoring, and support messages. Marketing is sent only on an appropriate legal basis, and you may opt out at any time.

Comply and defend

Respond to valid legal process, meet regulatory duties, and establish, exercise, or defend legal claims. Legal basis: legal obligation and legitimate interests.

Breach-data search

Help people and organizations identify exposed accounts, investigate security incidents, and reduce fraud. Where GDPR-style law applies, we rely on legitimate interests in cybersecurity and fraud prevention, balanced against affected people’s rights and the safeguards in this policy.

We do not use account or service data to make decisions that produce legal or similarly significant effects about you solely by automated means. Search results and exposure summaries are informational security signals, not eligibility decisions.

Cookies, local storage, analytics, and support tools

CheckLeaked uses cookies and similar browser storage for sessions, security, language and interface preferences, application variant selection, feature operation, analytics, conversion measurement, and support. Necessary storage may be required to sign in or retain a setting.

Google Analytics (GA4) remains active to measure site usage, engagement, and purchases, with IP anonymization configured. Our app configures Google Ads and directs events to our Ads destinations only after you allow advertising. Advertising personalization also requires your permission. Declining advertising leaves Google Analytics active and does not affect searches or purchases.

While GA4 remains active, Google's tag can still send limited consent and conversion-modeling requests to advertising services with advertising consent marked as denied. These requests can include purchase signals. If your permission changes, Google's tag can update earlier conversion signals. Declining advertising therefore does not block every request to Google's advertising services.

We save your advertising choice in a first-party cookie for 180 days and share it between the current and classic versions of the site. If the browser cannot save your choice, it applies to the current page and you may be asked again. You can change or withdraw your choice anytime in Settings → Data & privacy. Resetting interface preferences does not reset this choice.

Withdrawing permission immediately stops future events our app directs to Google Ads. Google's code already loaded on the page may finish an in-flight request or send the updates described above. Settings offers an optional reload to start a new page without the app's Ads configuration; GA4 and its limited requests remain active. The site does not automatically reload your search or checkout. Withdrawing does not retract information already submitted to a provider.

The site also integrates Hotjar for product-behavior and feedback analysis; Tawk.to for live support; and embedded services such as YouTube or Trustpilot when their content is used. These providers may receive IP, device, browser, URL, event, cookie, and interaction information. Tawk.to may also receive your account email when you are signed in so support can recognize you.

You can delete or block storage through your browser and use provider opt-out controls. Blocking necessary storage can prevent sign-in or other features from working. Where law requires consent before non-essential technologies are used, that consent must be a separate, valid choice; this policy is notice and does not itself grant consent.

Provider information: Google, Hotjar, Tawk.to.

When information is shared

We disclose information only as reasonably necessary to:

• infrastructure, hosting, content-delivery, database, security, and email providers, including Cloudflare and our hosting vendors;
• analytics, advertising-measurement, usability, and support providers described above;
• authentication and integration providers you choose to connect;
• payment and commerce providers, including NOWPayments and external license-key resellers or checkout providers;
• licensed breach-data and security-data providers when a request must be sent upstream to produce results;
• professional advisers, auditors, insurers, or transaction counterparties under confidentiality duties;
• authorities or other parties when required by valid law, to protect rights or safety, or to investigate abuse; and
• a successor in a merger, financing, reorganization, or sale, subject to appropriate notice and safeguards.

We do not sell personal information for money. Some laws define “sale,” “sharing,” or “targeted advertising” broadly enough that analytics or advertising-measurement disclosures may qualify even without payment. Where such law applies, you may object or request an opt-out at [email protected]. We do not knowingly sell or share personal information of people under 16.

See the privacy notices of Cloudflare and NOWPayments for their independent practices.

International transfers

CheckLeaked and its providers operate in multiple countries. Information may therefore be processed outside your country, including in countries whose privacy law may offer different protection.

Where transfer restrictions apply, we use an available lawful mechanism appropriate to the transfer, such as an adequacy decision, standard contractual clauses, or another legally recognized safeguard, and assess supplementary measures where required. Contact us to request information about the safeguard relevant to your data.

How long we keep information

We keep information only for the period reasonably needed for the purpose described, taking account of account status, user choices, security, provider and licensing obligations, disputes, and legal recordkeeping. The service does not use one retention period for every record.

Account and preferences

While the account is active. A verified account-destruction request deletes the primary account and associated saved-search stores; limited backups, security records, or legally required records may remain until their normal deletion cycle ends.

Saved searches and monitoring

Until you remove the entry or destroy the account, unless a shorter feature-specific period is shown.

Temporary results and caches

For the feature’s operational period, commonly minutes to seven days. Some API request records are configured to expire after 90 days.

Security and service logs

For the shortest practical debugging, rate-limit, abuse-prevention, and incident-response period, with longer retention only when an investigation or legal duty requires it.

Purchases and support

For fulfillment and support, then as needed for accounting, tax, fraud prevention, chargebacks, disputes, and legal claims.

Analytics

According to our provider settings and the provider’s own retention rules; aggregated or de-identified statistics may be kept longer.

Breach-index records

While the source remains available and processing remains necessary and lawful for cybersecurity purposes, subject to licensing limits, source updates, suppression review, and applicable rights.

Your privacy rights

Depending on your location and the processing, you may have the right to access, correct, delete, restrict, or receive a portable copy of personal data; object to processing based on legitimate interests or direct marketing; withdraw consent without affecting earlier lawful processing; and complain to a privacy regulator.

California and certain other U.S. residents may also have rights to know the categories, sources, purposes, specific pieces, and recipients of personal information; request correction or deletion; opt out of sale, sharing, or targeted advertising where applicable; limit certain uses of sensitive personal information; and receive equal service without unlawful discrimination.

How to make a request

1. Email [email protected] from the address connected to your account when possible.
2. State the right you want to exercise and the information or account involved. Use “California privacy request” or “Breach record review” in the subject when relevant.
3. Provide only the information reasonably needed to verify your identity and authority. Never email a password or full payment credential.

An authorized agent may submit a request where law permits. We may ask for proof of authorization and verify the request directly with you. We generally respond within one month for EEA/UK requests or 45 days for applicable U.S. state requests, subject to lawful extensions. We may deny or limit a request where an exception applies and will explain the reason unless law prevents us.

EEA residents may find their supervisory authority through the European Data Protection Board member list.

UK residents may contact the Information Commissioner’s Office.

Security

We use measures designed to protect information in proportion to its risk, including encrypted transport, access controls, authentication, request verification, rate limits, provider safeguards, logging, cache expiration, and incident investigation. Access is limited to people and providers with an operational need.

No internet service can guarantee absolute security. Protect your account, API keys, bot tokens, devices, and sign-in provider; use unique credentials; and notify us promptly if you suspect unauthorized access. Do not send passwords or unnecessary breach records through email or chat.

Breach-index information and people who are not users

The service searches information associated with third-party security incidents. CheckLeaked did not collect that information from the affected person at the time of the original incident and did not cause the incident. Results may come from licensed services—including, depending on the feature, LeakCheck.io, DeHashed, Snusbase, LeakRadar.io, or Have I Been Pwned—and from publicly accessible security sources.

Breach records can be inaccurate, duplicated, stale, attributed to the wrong person, or unlawfully used by someone else. We restrict use through access controls, quotas, paid entitlements, security monitoring, and the acceptable-use rules in our Terms.

Children

CheckLeaked is intended for people aged 18 or older and is not directed to children. We do not knowingly create accounts for children or knowingly collect their personal information through direct interaction with the service.

A breach source may contain information about a minor without our knowledge. A parent, guardian, or affected person may contact us for a priority review. We do not knowingly sell or share personal information of anyone under 16.

Policy updates

We may update this policy when the service, providers, or law changes. We will post the revised policy with a new effective date. If a change materially affects how we use information already collected, we will provide additional notice or request consent where required. Earlier versions remain applicable to earlier processing to the extent required by law.