Privacy Policy

This Privacy Policy explains how leak.fun ("we", "us") collects, uses, and protects your personal data when you use our breach search service. We treat your data the same way we treat search queries about your own data: carefully, with as little exposure as possible.

Our guiding principle is data minimization: we collect what we need to operate the Service and nothing more. Your search activity is considered sensitive — it can reveal who you are and what you're looking for — and we treat it with the same level of care we'd expect for our own.

We collect the minimum data necessary to run a breach search service:

• Account information — email address, username, and a bcrypt-hashed password (cost factor 12). Email metadata is stored to enable account recovery.
• Session tokens — JWT cookies issued by NextAuth to keep you signed in. The cookie value is signed, not human-readable.
• Search activity — timestamps and rate-limiting counters for abuse detection. We do not persist the contents of search queries beyond the request-response cycle, except when required for incident investigation under our retention policy.
• Technical telemetry — IP address, user agent, and HTTP request metadata, used only for security and abuse-prevention.

We do not request or collect biometric data or any special-category personal data (ethnicity, religion, health, etc.).

We use the data we collect strictly for the following purposes:

• To operate, maintain, and secure the Service
• To authenticate you and keep your session active
• To enforce rate limits, prevent abuse, and detect suspicious activity
• To send transactional emails (password reset, email changes, security alerts)
• To comply with legal obligations and respond to lawful requests

We do not use your information for targeted advertising. We do not build behavioral profiles. We do not run third-party tracking scripts on the authenticated portions of the Service.

We use a small number of strictly-necessary cookies. We do not use cookies for advertising or cross-site tracking.

• Authentication cookies — issued by NextAuth to keep you signed in. HttpOnly, Secure, SameSite=Lax. Expires after 30 days of inactivity.
• Preference cookies — local-storage entries for your theme (light / dark / system) and locale (EN / FR). These never leave your browser.

For details on our cookie practices, see our Cookie Policy.

We do not sell your personal data. We do not share aggregated user data with advertisers, brokers, or analytics companies. We share data only in the following limited circumstances:

• Service providers — infrastructure vendors (hosting, database, email delivery) that process data strictly on our behalf, under contractual data-protection obligations.
• Legal compliance — when required to respond to a valid court order, subpoena, or government request, and only after verifying its legitimacy and scope.
• Security incidents — when we reasonably believe a third party is engaged in fraud, abuse, or attempts to harm other users.

We retain personal data only for as long as necessary for the purposes described above. Specific retention periods:

• Account data — retained for the life of the account. Deleted within 30 days of account deletion, except where law requires longer retention (e.g. tax records).
• Search logs — retained for 30 days for abuse-detection. Anonymized or deleted thereafter.
• Security logs — retained for up to 12 months for incident investigation.

You can request earlier deletion at any time by contacting us at privacy@leakfunapp.com.

We employ industry-standard technical and organizational measures to protect your data:

• Passwords are hashed with bcrypt at cost factor 12 — they are never stored or transmitted in plaintext.
• All traffic is encrypted in transit via TLS 1.3.
• Access to production data is restricted to the minimum number of personnel necessary and audited.
• We monitor for unauthorized access and unusual patterns. Confirmed breaches of personal data are reported to affected users and the relevant supervisory authority within 72 hours where required by law.

No system is perfectly secure. You play a role too: use a strong, unique password, enable two-factor authentication when available, and notify us immediately if you suspect your account has been compromised.

Depending on your jurisdiction (EU/EEA, UK, California, etc.), you may have some or all of the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — request that inaccurate or incomplete data be corrected.
• Erasure — request that we delete your personal data (subject to legal-retention obligations).
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to specific processing activities, including any processing based on legitimate interests.
• Withdraw consent — where processing is based on your consent, withdraw it at any time without affecting prior lawful processing.

To exercise any of these rights, email privacy@leakfunapp.com from the address associated with your account. We respond to verified requests within 30 days. You also have the right to lodge a complaint with your local data-protection authority.

We operate from servers located in the European Union. When we engage service providers outside the EU/EEA, we put in place appropriate safeguards as required by applicable law — typically Standard Contractual Clauses (SCCs) approved by the European Commission, combined with supplementary technical measures where necessary.

We do not transfer your personal data to countries that have not been recognized by the European Commission as providing an adequate level of data protection, unless those safeguards are in place.

The Service indexes data that has already been publicly disclosed by third parties. We are not the original source of this data, and we did not authorize its disclosure. Our role is to provide an index so that affected individuals can discover their own exposure and take action.

If you find your own personal data in our index and would like it removed, contact us at privacy@leakfunapp.com with proof of identity. We will remove verified records from the index within 30 days, although we cannot remove the underlying data from its original public source.

The Service is not intended for individuals under 18 years of age (or the age of majority in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without verifiable parental consent, we will delete that data promptly.

If you believe we may have inadvertently collected information from a child, contact us at privacy@leakfunapp.com.

We may revise this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. Material changes will be communicated via email and/or through a prominent notice on the Service at least 14 days before the changes take effect.

Continued use of the Service after revised terms take effect constitutes acceptance of the updated policy. If you do not agree with the changes, you may close your account before the effective date.

Questions, concerns, or requests regarding your privacy should be directed to:

• Email: privacy@leakfunapp.com
• Subject line: please include "Privacy Request" to help us route your message promptly.

We respond to all verified requests within 30 days, and usually much faster. For urgent security concerns, mark the email as such in the subject and we'll prioritize it.