Privacy Policy

Am I Being Pwned? is operated by Am I Being Pwned LLC. References to "we", "us", or "our" in this policy refer to Am I Being Pwned LLC.

If you have any questions about this policy or how we handle your data, contact us at hello@amibeingpwned.com.

We collect only the data necessary to provide our service.

Free one-time scan

When you run a free scan, your browser extension IDs are sent to our server and matched against our threat intelligence database. We retain the list of extension IDs submitted in each scan to help us prioritise which extensions to analyse next. We do not collect your name, email address, IP address, or any other identifying information in connection with a free scan. Extension lists are not associated with any individual user.

Account registration

If you create an account, we collect your email address and name via Google OAuth. We do not store your Google password.

Enterprise fleet monitoring

The managed Chrome extension reports the following data for each enrolled device:

• A device identifier you control (set by your MDM)
• Extension IDs, version numbers, and declared permissions

We do not collect browsing history, form data, keystrokes, credentials, or any content from web pages your employees visit.

• To match extension IDs against our risk intelligence database and generate security reports.
• To operate, maintain, and improve the service.
• To send transactional communications such as alert notifications and security findings (enterprise customers only).
• To comply with legal obligations.

We do not sell your data, use it for advertising, or share it with third parties except as described in section 5.

If you are located in the European Economic Area or United Kingdom, we rely on the following legal bases:

• Contract - processing your data to provide the service you have requested.
• Legitimate interests - improving service security and reliability, where those interests are not overridden by your rights.
• Legal obligation - where we are required to process data by applicable law.

We do not sell, rent, or trade your personal data. We do not share it with advertisers, data brokers, or any third party for their own purposes. The only circumstances in which data is ever disclosed are:

• Service providers - trusted infrastructure and hosting providers that process data on our behalf to operate the service. They are contractually prohibited from using it for any other purpose.
• Legal requirements - if we receive a valid legal order requiring disclosure, we will comply. Where permitted by law, we will notify affected users before responding.
• Continuity of service - if the business is acquired or restructured and the service continues to operate, data may transfer to the new operator solely to keep the service running. Any new operator would be required to honour the commitments in this policy. We will give users advance notice and the option to delete their data before any such transfer takes effect.

We retain personal data only as long as necessary to provide the service or as required by law.

• Free scan extension lists are retained indefinitely in aggregate form to help us prioritise which extensions to analyse. They are never linked to an identifiable user.
• Account data is retained until you delete your account.
• Enterprise fleet data is retained for the duration of your subscription plus 30 days, after which it is deleted.

All data is processed and stored within the European Union. We use industry-standard encryption in transit (TLS 1.2+) and at rest. Access to production systems is restricted to authorised personnel only.

If you believe you have found a security vulnerability in our service, please disclose it responsibly to vulnerabilities@amibeingpwned.com.

We use a session cookie to keep you signed in when you have an account. We do not use advertising cookies or third-party tracking pixels. We do not use Google Analytics or similar services.

Depending on your location you may have the following rights regarding your personal data:

• Access the data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Data portability (where applicable)

To exercise any of these rights, email hello@amibeingpwned.com. We will respond within 30 days.

If you are in the EEA or UK and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

Our service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, contact us and we will delete it promptly.

We may update this policy from time to time. If we make material changes, we will update the "Last updated" date at the top and, where appropriate, notify enterprise customers by email. Continued use of the service after the effective date constitutes acceptance of the updated policy.