Privacy Policy

Last updated October 27, 2026. Operated by LeakOwl ("LeakOwl", "we", "us"). Questions: support@leakowl.com.

Draft policy text prepared for launch. It has not been reviewed by a lawyer; have it reviewed and fill in the company details before taking real payments.

What we collect

  • Email address — when you start a scan, to deliver your results link, receipts, sign-in links and alerts.
  • The apps you register — the web address you enter, its ownership-verification token and when it was verified.
  • Scan results — issue titles, locations and masked evidence (for example the first and last characters of a leaked key). We do not store full secret values, and we do not store database rows (only column names and row counts).
  • Audit log — security-relevant events (attestation, verification, scans) with a keyed hash of your IP address, not the raw address.
  • Payment information — handled by Stripe. We receive a customer ID, subscription status and amounts, never your card number.

Why we use it

To run the service you asked for, take payment, send transactional email, prevent abuse and fraud (rate limits, audit trail), and comply with law. Marketing email is sent only if you ticked the optional box at signup, and you can unsubscribe in any message.

Who we share it with (processors)

  • Stripe — payments and billing portal.
  • Neon — database hosting.
  • Vercel — application hosting.
  • Resend — sending transactional email (scan links, sign-in links, alerts).
  • ActiveCampaign — your email address is added to our contact list when you sign up; contacts who ticked the marketing box are tagged and are the only ones we send newsletters to.

We do not sell personal data.

Retention

Scan results and your account are kept while your account exists. You can ask us to delete your account and all associated scan data at any time; we will do so within 30 days, except records we must keep for tax or fraud-prevention purposes.

Your rights

Depending on where you live you may have the right to access, correct, delete or export your data, and to object to marketing. Email us and we will respond within 30 days.

Cookies

We use one essential cookie to keep you signed in after you use an emailed sign-in link. No advertising or analytics cookies are set by this app.

Security

Data is encrypted in transit; sign-in links expire after 20 minutes; Stripe webhooks are signature-verified. No system is perfectly secure; report security issues to the address above.

Children

LeakOwl is not directed at children under 16.