LeakGuard

Privacy Policy

Last updated: 2026-08-14 Effective date: 2026-08-14

This Privacy Policy explains how Magellan Software LLC ("LeakGuard," "we," "us," or "our") collects, uses, shares, retains, and protects information when customers use LeakGuard's dark web credential monitoring service (the "Service").

1. Scope

This policy applies to the LeakGuard website, dashboard, account flows, monitoring service, alerts, weekly digests, billing-related workflows, and support communications.

This policy does not apply to third-party websites, services, billing portals, or data providers that operate under their own privacy notices and terms.

2. Information We Collect

Account And Contact Information

We collect information used to create, secure, and manage accounts, such as name if provided, business email address, authentication identifiers, and account settings.

Monitored Assets And Scan-Required Personal Data

We collect customer-submitted domains, monitored business email addresses, alert phone numbers if SMS is enabled, labels, critical-contact flags, domain verification records, and related configuration.

Monitored email addresses and alert phone numbers must remain usable for scans and alerts. In production, LeakGuard stores this scan-required personal data using encryption-at-rest patterns and decrypts it only in trusted server-side paths needed for settings, scans, alerts, and support operations.

Breach Metadata, Scan Results, And Alerts

We collect and generate scan logs, source names, source status, records-checked counts, alert metadata, breach names, breach dates, severity, exposed-data categories, deduplication fingerprints, remediation text, delivery state, and dashboard history.

LeakGuard is designed not to store raw breach dumps, leaked passwords, Social Security numbers, government IDs, payment card data, or full source payloads.

Billing Information

Payments are handled by Stripe. LeakGuard does not store payment card numbers or full payment method details. We may store limited billing metadata such as Stripe customer ID, subscription ID, price ID, plan, subscription status, and current billing-period timestamps.

Stripe may retain customer, subscription, invoice, payment, tax, chargeback, fraud-prevention, accounting, and legal records according to Stripe's policies and applicable obligations. Requests involving Stripe billing records may need to be handled through Stripe-hosted tools, the billing portal, or support workflows.

Communications And Support

We may collect support requests, operational emails, alert delivery status, weekly digest delivery status, and related communications. When the alert-email digest delivery path is activated, LeakGuard may temporarily retain an encrypted delivery target and queue/retry state needed to send a customer monitoring alert. The target is decrypted only in trusted server-side delivery processing and cleared when the event reaches a terminal state. Shadow rollout records do not retain a delivery target; delivery records do not retain plaintext recipients or request content.

Support messages you submit through our /contact form are stored encrypted at rest so our support team can handle your request. They are accessible only to authorized LeakGuard staff after their access is logged, and are retained until your request is resolved plus 180 days, after which they are deleted. Please do not include passwords, recovery codes, API keys, or payment card data in a support message.

Cookies, Logs, And Basic Telemetry

We use strictly necessary cookies and similar storage to operate and secure the Service, including Supabase authentication/session cookies and the lg_consent cookie that records a visitor's choices for optional analytics and optional advertising. These strictly necessary cookies do not require optional consent.

Where enabled, LeakGuard may use optional Google Analytics 4 cookies only after a visitor affirmatively opts in to the analytics purpose through the cookie-consent banner. Optional advertising is a separate purpose: analytics consent alone does not authorize advertising cookies or events. Rejecting the banner, ignoring it, closing it, or clearing cookies means optional processing is not enabled unless the visitor later accepts. Global Privacy Control and browser Do Not Track signals are treated as a rejection. The consent record is versioned. A valid analytics decision recorded under the previous version is retained and treated as advertising not asked. When both analytics and a valid Meta Pixel are configured, the banner reopens with the full optional-cookie choice: analytics only, analytics and advertising, or reject. The earlier analytics decision remains effective until the visitor makes that choice. When only a valid Meta Pixel is configured, visitors can accept advertising or reject; analytics is not active in that setup. Without a Meta Pixel, the earlier analytics choice remains and no advertising processing occurs. Public page-view analytics and Google Analytics configuration use only the site origin and an allowlisted public path. Only on the exact root page, and only after analytics consent, LeakGuard may add exactly one strictly validated Google-minted gclid, gbraid, or wbraid click identifier to that root location. It rejects duplicate or ambiguous click identifiers. It never sends arbitrary query parameters or fragments, UTM parameters in the page location, email/customer/account or monitored data, tokens, or other URL parameters. When no click identifier is present, individually nonduplicated and strictly sanitized utm_source, utm_medium, and utm_campaign values may instead be sent as manual campaign source, medium, and name fields. When analytics and advertising consent are both granted and a Google click identifier is present, Meta does not start until the consented Google tag loads; if it never loads, Meta remains off for that visit. After that readiness signal, the Google click identifier is removed before Meta starts, and no Google click identifier reaches Meta. Meta uses only the exact root page and only the approved PageView and Lead events; it never receives submitted identifiers, customer, monitored, breach, or billing data. Meta remains off when its ID is absent or invalid, advertising consent is absent, the page is not the exact root, a fragment is present, the Google tag does not become ready, or URL cleanup fails. The Meta Pixel is configured with automatic event collection and advanced matching disabled. If advertising consent is withdrawn, LeakGuard revokes Meta consent and clears Meta cookies.

When configured, LeakGuard uses Meta Platforms, Inc.'s Meta Pixel only on the exact root page at https://leakguard.me/ after affirmative advertising consent. The Pixel is code-gated to that exact production HTTPS origin and stays dormant on Preview. It sends only fixed PageView and Lead events with strictly sanitized fbclid, utm_source, utm_medium, and utm_campaign values. Meta may process IP address, device and browser information, referrer, and cookie identifiers. LeakGuard does not use advanced matching or send submitted identifiers or customer, monitored, breach, or billing data to Meta. Automatic event collection remains off. Withdrawing advertising consent revokes this processing and clears Meta cookies.

When analytics is configured and a visitor has granted consent, LeakGuard also sends a small, fixed set of non-identifying product-funnel events (for example signup completed, checkout started, first scan seen, and dashboard view) that carry only fixed enumerated parameters (such as a surface label, plan tier, scan status, or strictly sanitized campaign slug) and an always sanitized, path-only location that may include the top-level /dashboard and /dashboard/onboarding funnel paths. These custom funnel-event locations never include query strings or fragments, including the root click-identifier exception described for public page views and configuration. These events never include email addresses, monitored domains, account or user IDs, scan results, tokens, session identifiers, or Stripe identifiers.

After a successful Google Analytics or Meta waitlist conversion dispatch, LeakGuard may store a fixed, non-identifying, tab-scoped session marker to avoid counting repeat waitlist conversions in the same tab. The marker contains no email address or submitted form value, is not sent to LeakGuard's server, and is removed when the tab closes. LeakGuard also removes it on a best-effort basis when neither optional purpose is granted.

We may collect device/browser metadata, IP address, timestamps, referral/source data, page or route interactions, error logs, and basic product telemetry needed to operate, secure, debug, and improve the Service.

Optional Public Email Scan

When the optional public email scan is enabled, LeakGuard transiently normalizes a submitted email and derives a shortened pseudonymous token for LeakCheck. LeakGuard sends that token, rather than the raw submitted email, to obtain only a count of potential matching exposure records. The page does not persist the email, CAPTCHA token, or result in browser storage or analytics.

LeakGuard retains HMAC-based, minimized server-side rate-limit evidence for up to 25 hours before pruning. The scanner uses Cloudflare Turnstile or hCaptcha for abuse prevention; those providers may process IP address, cookies, and verification telemetry under their own notices. A count may be affected by shortened-token collisions and does not prove identity, ownership, safety, complete source coverage, or a particular account. Marketing opt-in is separate and is never inferred from using the public scanner.

For Pro-tier and above domains that enable DMARC aggregate (RUA) monitoring, we also ingest provider-generated aggregate reports that summarize which sending sources used a monitored domain and whether they passed SPF/DKIM alignment. The stored data is normalized and content-free: it includes third-party sending IP addresses and safe counts, but never message bodies, recipients, subjects, headers, or other message content.

Mobile Messaging Consent And SMS Security Alerts

SMS security alerts are unavailable unless LeakGuard completes its separately approved transactional SMS activation gates. Where they are available and a customer enables them, we collect the mobile phone number they provide and a record of their consent. SMS alerts are strictly opt-in: a signed-in customer turns on SMS alerts and enters a phone number in their authenticated account Settings (a per-user, self-service web-form opt-in), and can turn them off at any time in Settings or by replying STOP.

Mobile phone numbers collected for SMS security alerts are used solely to deliver those alerts through our messaging provider (Twilio). We do not sell, rent, or share mobile opt-in information, consent, or phone numbers with any third parties, and mobile opt-in data is never shared for marketing or promotional purposes.

Message frequency varies because alerts are event-driven (sent only when a new issue is found). Message and data rates may apply. Reply STOP to unsubscribe or HELP for help.

3. How We Use Information

We use information to:

  • Provide, operate, secure, and maintain the Service.
  • Verify domain ownership or authorization.
  • Run authorized breach-monitoring scans.
  • Generate alerts, weekly digests, dashboard history, and remediation guidance.
  • Process subscriptions and billing state.
  • Detect abuse, troubleshoot errors, prevent fraud, and protect the Service.
  • Respond to support, privacy, security, and legal requests.
  • Improve product reliability, usability, and coverage.
  • Comply with legal, tax, accounting, security, and contractual obligations.

LeakGuard does not sell personal data for money. When Meta Pixel is enabled after advertising consent, sharing limited browser, device, referrer, and cookie data plus fixed PageView and Lead event data with Meta for ad measurement and optimization may be considered sharing for cross-context behavioral advertising under some laws. LeakGuard does not send identifiers, account, customer, monitored, breach, or billing data to Meta, and does not use advanced matching or automatic events.

4. Third-Party Processors And Providers

LeakGuard uses third-party service providers to run the Service. Depending on configuration and plan, these may include:

  • Supabase for authentication, database, storage, and related backend services.
  • Vercel for hosting, routing, logs, and application delivery.
  • Stripe for checkout, subscriptions, invoices, billing portal, payment processing, tax, disputes, fraud prevention, and payment-related records.
  • Resend for email alerts, verification emails, weekly digests, and pre-launch waitlist confirmation and launch-announcement emails. Pre-launch waitlist marketing emails are sent only with explicit consent, include a one-click unsubscribe and our postal mailing address, and unsubscribing suppresses all further waitlist and launch emails.
  • Twilio for SMS alerts where enabled.
  • Google LLC for Google Analytics 4, only where optional analytics is enabled after opt-in consent.
  • Meta Platforms, Inc. for Meta Pixel where configured after affirmative advertising consent, with the limited data and event boundaries described in this policy.
  • Have I Been Pwned (HIBP) for authorized breach monitoring, and LeakCheck for the optional public email scan described above. Additional breach-intelligence sources are named here once they are active.
  • Anthropic where AI remediation guidance is configured. We send only the breach name, the breach date, general categories of exposed data (for example passwords or email addresses), and the domain portion of the affected monitored email address. We do not send the full email address, passwords, or other stored personal data to Anthropic.

Provider availability, processing locations, retention practices, security controls, and contractual terms may vary by provider. LeakGuard should maintain appropriate data processing terms with providers before production launch where required.

HIBP attribution may be required where HIBP data powers the Service.

5. Legal Bases And Business Purposes

Where GDPR or similar laws apply, our legal bases may include performance of a contract, legitimate interests in providing and securing the Service, consent where required, and compliance with legal obligations.

Optional Google Analytics 4 cookies and analytics page-view events are processed only on the basis of affirmative analytics consent. Meta Pixel cookies and events, where configured, require separate affirmative advertising consent. Before a choice is stored, visitors can select Reject in the cookie-consent banner to refuse either optional purpose. After a choice is stored, visitors can turn optional processing off by clearing all cookies and site data for leakguard.me, including lg_consent, and then reloading the site. This also clears authentication cookies and signs the visitor out. Optional processing remains off unless the visitor makes a new choice. Global Privacy Control and browser Do Not Track signals are treated as rejection on load and during the page lifecycle.

Where CCPA/CPRA or similar laws apply, business purposes may include providing services, security, debugging, billing, internal operations, quality assurance, and legal compliance.

This policy does not guarantee that LeakGuard is compliant with any specific privacy law.

6. Data Sharing

We may share information:

  • With processors and providers listed above to provide the Service.
  • With your authorized users or administrators through the dashboard.
  • With support, security, legal, accounting, or professional advisers when needed.
  • To comply with law, legal process, or enforceable government requests.
  • To protect rights, safety, security, customers, providers, or the public.
  • In connection with a merger, acquisition, financing, restructuring, or sale of assets, subject to appropriate protections.

We do not sell personal data for money. When Meta Pixel is enabled after advertising consent, sharing limited browser, device, referrer, and cookie data plus fixed PageView and Lead event data with Meta for ad measurement and optimization may be considered sharing for cross-context behavioral advertising under some laws. Mobile opt-in information, consent, and phone numbers collected for SMS security alerts are not sold, rented, or shared with any third parties, and are never shared for marketing or promotional purposes. Optional Google Analytics and Meta Pixel use where configured are not used to send account personal information, monitored assets, breach/customer data, or payment data to either provider. LeakGuard disables Google signals and ad-personalization signals in the analytics configuration described in this policy, and keeps Meta automatic event collection and advanced matching off.

7. Retention

We retain information for as long as needed to provide the Service, maintain account history, support security and audit needs, comply with legal or accounting obligations, resolve disputes, and enforce agreements.

When an account is deleted through the dashboard deletion flow, LeakGuard is designed to remove user-owned domains, monitored emails, scans, alerts, API keys, webhooks, achievements, profile data, and the Supabase Auth account from LeakGuard-controlled application storage. Customers with a recurring Stripe subscription must first cancel it through the billing portal or support and return after Stripe confirms the scheduled cancellation. Deleting the LeakGuard account immediately forfeits remaining LeakGuard access; it does not cancel a Stripe subscription or form a coupled external cancellation-and-erasure transaction.

Alert-email delivery events and batches are designed to be removed with the account. The planned 30-day cleanup for terminal/shadow delivery records is not yet operational.

Legal acceptance evidence may be retained as encrypted/fingerprinted legally retained records after account deletion, with user linkage removed where applicable.

A service-role-only domain-claim forensic audit record (domain name, identifiers, and safe-primitive snapshots, with no secrets or plaintext personal data) may be retained after account or domain deletion for security, anti-abuse, and dispute-resolution purposes.

DMARC aggregate (RUA) report data, where the feature is enabled for a Pro-tier or above domain, is stored as normalized, content-free aggregates (including third-party sending IP addresses and safe counts, never message content) scoped to the owning account, and is removed together with the associated monitored domain or account when either is deleted through the deletion flow.

Stripe billing records, invoices, and any outstanding amounts may remain in Stripe for tax, chargeback, fraud-prevention, accounting, audit, and legal retention obligations. Cancellation, deletion, access, or export requests involving Stripe records may need to be handled through Stripe-hosted tools, the billing portal, or support workflows. After a trusted scheduled-cancellation read, Stripe could theoretically reverse or change the cancellation during LeakGuard erasure; no database lock can lock Stripe, and a coupled Stripe mutation plus irreversible erasure would be unsafe. Support resolves any such anomalous Stripe state.

Backups, logs, provider caches, and legally retained records may persist for a limited period before deletion or rotation according to operational policies and provider practices.

8. One-Click Deletion And Privacy Rights

LeakGuard intends to provide a dashboard account deletion control in Settings. The deletion flow requires typed email confirmation and is designed to delete the LeakGuard account and LeakGuard-controlled customer application data described above. For recurring Stripe subscriptions, cancellation is a separate first step in the Stripe billing portal or through support; deletion unlocks only after trusted cancellation scheduling is reflected in Settings.

LeakGuard also intends to provide a self-serve account data export in Settings for GDPR/CCPA portability. The export requires typed account-email confirmation and provides a JSON copy of account profile fields, monitored assets, monitored email addresses, scan and alert metadata, posture/remediation records, DMARC aggregate (RUA) report metadata (reporting organization, report id, date range, and pass/quarantine/reject/none counts), webhook/API-key metadata, achievements, and legal document acceptance versions where available. Certain retained or forensic records are not included in the self-serve export and may be available through support or a data-subject access request, including security sign-in/telemetry logs, encrypted IP address and user-agent evidence on legal-acceptance records, domain-claim audit records, DMARC RUA per-source detail (raw sending IP addresses) and inbound routing-token metadata, and Stripe-held billing records such as invoices, receipts, card/payment-method data, tax, charge, dispute, and accounting records.

Depending on where you are located, you may have rights to request access, correction, deletion, portability, restriction, objection, withdrawal of consent, or information about how personal data is processed. California residents may also have rights to know, delete, correct, opt out of sale or sharing, limit use of sensitive personal information where applicable, and be free from discrimination for exercising privacy rights.

To exercise rights, use the dashboard controls where available or contact contact@leakguard.me. We may need to verify your identity and authority before fulfilling a request. Business customer administrators may be responsible for handling requests from their own employees or monitored users, depending on the relationship and applicable law.

LeakGuard does not sell personal data for money, so no monetary-sale opt-out is needed. When Meta Pixel is enabled after advertising consent, its limited browser, device, referrer, cookie, and fixed PageView and Lead event data may be considered sharing for cross-context behavioral advertising under some laws. LeakGuard provides an ad-sharing opt-out through separate advertising consent, Reject before a stored choice, Global Privacy Control or browser Do Not Track, and clearing all cookies and site data for leakguard.me, including lg_consent, then reloading the site. Clearing all site data also signs the visitor out. Optional Google Analytics 4 is consent-based and configured not to receive account personal information or customer monitoring data from LeakGuard. Existing analytics-only consent does not authorize Meta advertising processing. Withdrawal revokes Meta processing and clears Meta cookies.

9. Security

We use reasonable technical and organizational safeguards intended to protect customer data, including Supabase Auth, Row Level Security, trusted server-side service-role access, encrypted storage for scan-required personal data, secret management, and limited raw-data retention.

Authorized LeakGuard staff may access your account information — including your monitored domains and email addresses, subscription status, and breach-alert history — to provide customer support, investigate abuse, and keep the Service secure. Staff access to your data is restricted to authorized personnel, requires multi-factor authentication, and is access-logged.

No system is perfectly secure. We cannot guarantee absolute security or that unauthorized access, disclosure, loss, or misuse will never occur.

10. Customer Ownership And Controls

Customers own their submitted business data. LeakGuard uses customer data only as needed to provide, secure, support, and improve the Service, comply with law, and enforce agreements.

Customers are responsible for ensuring that monitored domains, email addresses, phone numbers, and other assets are submitted with proper authorization and lawful basis.

11. International Transfers

LeakGuard and its providers may process information in the United States and other countries where providers operate. Where optional Google Analytics is enabled after opt-in consent, Google LLC may process analytics data in the United States and other locations where Google operates. Where Meta Pixel is configured after affirmative advertising consent, Meta Platforms, Inc. may process the limited Meta Pixel data described in this policy in the United States and other locations where Meta operates. Those countries may have data-protection laws different from your location.

We do not currently have signed data processing agreements with our service providers. We are working to put appropriate data processing and transfer terms in place, and we will update this policy when they are signed.

12. Children

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from children under 13 or the age required by applicable law. If you believe a child has provided information to us, contact contact@leakguard.me.

13. Changes To This Policy

We may update this Privacy Policy from time to time. If changes are material, we will provide notice through the Service, by email, or by another reasonable method. This update separates optional analytics and advertising consent. When both analytics and a valid Meta Pixel are configured, a valid earlier analytics decision remains effective until the visitor makes a new full optional-cookie choice: analytics only, analytics and advertising, or reject. When only a valid Meta Pixel is configured, visitors can accept advertising or reject; analytics is not active in that setup. Without a Meta Pixel, no advertising processing occurs. The bounded Meta Pixel activation remains governed by separate affirmative advertising consent and the root, event, data, automatic-event, and advanced-matching limits described in this policy. The updated policy will be effective as of the date stated in the updated version.

14. Contact

Privacy requests: contact@leakguard.me