LeakLens is designed to minimize data collection by architecture, not just policy. Here is exactly what happens when you use the site.
What we don't do
- We don't require accounts, so we hold no user profiles.
- We don't store email addresses, usernames or IPs you look up, queries are processed in memory and discarded.
- We never see your full password. The password checker runs in your browser; only a 5-character hash fragment is sent to a public k-anonymity service.
- We run no analytics or tracking scripts of our own.
What our servers process
- Request metadata: like any web server, we receive your IP address and request headers. We use them solely for rate limiting and abuse prevention in memory. Hosting (Vercel) maintains its own operational logs under its data-processing terms.
- Third-party queries you trigger: IP geolocation results come from ipwho.is; DNS answers come through public resolvers; header scans fetch the URL you enter. These providers see LeakLens' servers making the request, not you.
- Address-level breach checks: when you run the breach checker or email validator, we query public services with the data you enter: Gravatar and EmailRep receive the email address for breach checks, and GitHub, Bluesky, YouTube, Open Library and Wikidata receive the name for name lookups. Those providers receive the address itself as part of their normal API operation; their responses are combined into your report and are not retained by us.
Cookies & advertising
We store one preference locally in your browser ("essential only" vs "accept all") using localStorage, it never leaves your device.
If, and only if, you accept, we load Google AdSense to display ads. Google and its partners may then set cookies or use device signals to serve and measure advertising, including personalized ads where permitted. You can withdraw consent any time by clearing site data, and manage ad personalization via Google Ads Settings. See also how Google uses data from partner sites.
Children
The site is intended for general audiences aged 13+ and is not directed at children; we knowingly collect no data from children.
Your rights
Depending on your jurisdiction (GDPR, CCPA/CPRA, UK GDPR and similar), you may have rights to access, correct or delete personal data. Because we store almost none, most requests resolve trivially, contact us via the address on our contact page and we will respond within statutory timelines.
How long we keep what little we process
Lookup inputs live only for the duration of the HTTP request, typically milliseconds to a couple of seconds while the report is built, and are not persisted to disk, databases or durable logs by LeakLens. Rate-limit counters are held in memory with fixed windows and evicted automatically; they contain only an anonymized bucket key, not your query content. Our hosting provider (Vercel) retains standard operational HTTP logs per its data-processing agreement for a short retention window, solely for security and debugging, under its published terms.
Google AdSense and partner disclosure
When you consent to advertising, Google AdSense and its partners may collect or receive device identifiers, approximate location from IP, and on-page interaction signals to serve, measure and personalize ads. This processing is governed by Google's advertising policies along with the partner-sites page linked above. LeakLens does not sell your lookup queries or link them to advertising identifiers, because we do not store queries at all.
Contact for privacy requests
Reach us at the address listed on our contact page for access, correction or deletion requests, objections to processing, or questions about this policy. Include the affected domain (not a password or full breach dump) if your inquiry concerns a lookup result. We acknowledge privacy inquiries within 5 business days and resolve them within the timelines required by applicable law (generally 30 days for GDPR, 45 days for CCPA/CPRA).
Changes
Material changes to this policy will be reflected in the "last updated" date above and, for significant changes, via a short notice on the homepage. Continued use after changes constitutes acceptance. The previous version of this policy is available on request via the contact address for 12 months after any material revision.