Privacy

This page describes what getleakwatch.online stores. The operator is Rich Labs (Richlabs), in Canada. No street address or company number is published. Privacy questions and account-deletion requests go to support@getleakwatch.online.

When you run a free scan we require an email and store it on the scan so we can send the summary. We also store the target URL with the query string removed, the time, a severity summary, and masked findings (first four and last four characters of any secret, plus a hash used to tell a later scan whether the same issue is still there). A readable table is stored as the table name, the column names, and at most one example row with every value masked. We do not store user rows, full secrets, environment-file bodies, or source maps. Scans that are not still running are deleted after 30 days, along with their findings, share links, and Proof Report unlocks. The data page describes that job. The free report names every finding and shows the most serious one in full. Other locations, evidence, and fix prompts stay closed until a $19 Proof Report is bought for that scan, or a Pro plan on the matching account opens it. Monitoring at $9 per month does not open the first report. The email itself does not include those locations.

Accounts store your email, a hashed session token, the apps you add, verification tokens, and scan history. Magic-link tokens are stored only as a hash and expire after 30 minutes. The session cookie is HTTP-only.

If Stripe is configured, Stripe processes subscription payments. We store the Stripe customer id, subscription id, and status. If Resend is configured, Resend delivers the scan summary, sign-in links, and monitoring mail. Those messages are part of the service you asked for. If you tick the optional product-updates box on the scan form, that opt-in is stored in our database and sent through Resend. We keep the email, the time you agreed, and the checkbox wording. Resend sends those updates from updates@getleakwatch.online. Each one includes an unsubscribe link, and the footer names Richlabs, Canada, and support@getleakwatch.online. The box is off by default. The scanned URL is not stored on that list. Sign-in and payment do not add you. Query strings are removed from the URL before a free scan is stored.

A free scan also stores a normalized email, the network address, and the site hostname for about 40 days so the same person cannot repeat it by opening another account. Short rate-limit counters store an IP address or hostname key for about an hour. Server logs may include error messages. They are written not to include secret values.

You can stop monitoring by deleting an app in the dashboard, which deletes its scan history. To delete an account, email support@getleakwatch.online from the address on the account. We do not sell personal information. Google Analytics, measurement id G-4926MP0YL6, stays off until you choose Allow analytics. Until then Google does not receive a page view from this site. If you allow it, Google receives the page address and ordinary browser details. Scan evidence and magic-link tokens are not sent as separate analytics events. The choice is stored in this browser. The session cookie is used to keep you signed in. A short-lived cookie can remember which report to open after a magic link.

Privacy contact: support@getleakwatch.online.