Privacy Policy
LAST UPDATED: 2026-01-01
Data Minimization
As a platform built by security engineers, we strictly adhere to data minimization principles. We do not track user IP addresses, do not employ third-party analytics scripts, and only require encrypted email signatures for API authentication.
Handling of Breached PII
BreachRegistry only indexes metadata. We do not host raw Personally Identifiable Information (PII) databases or passwords. We store cryptographically hashed derivatives allowing individuals to verify if they have been compromised without directly re-exposing that data to the public.
Right to Erasure (Article 17 GDPR)
In full compliance with international privacy standards, including the GDPR, you have the right to demand the complete and permanent deletion of your account and all associated data. We provide a direct self-service tool to execute this operation immediately. We also retain security logs (e.g., your IP address) for a limited duration of 30 days strictly to prevent fraud and system abuse under the legitimate interest provision (Article 6(1)(f) GDPR).