Privacy

ExposureGuard stores a normalized identifier hash and encrypted recoverable identifier value to support ownership verification, authorized scans, monitoring, risk assessment, remediation, and account deletion. Raw identifiers are not included in URLs or API responses.

External breach providers

When Have I Been Pwned is configured for a scan, the verified email address may be sent to that external provider solely to check for known breach exposure. The provider response is retained as scan findings, risk context, remediation records, and—if monitoring is enabled—deduplicated monitoring events.

Have I Been Pwned privacy and service information ↗

Your controls

Authenticated users can manage identifiers, monitoring subscriptions, exported account data, and account deletion through the application’s protected API. Retention, processor, and legal requirements remain subject to deployment-specific review; this page does not make a legal compliance guarantee.