Privacy Policy

Last updated: June 27, 2026

1. Who we are

Breach Watchdog is developed by AppDev020, reachable at appdev020@proton.me.

2. What data we process

Email addresses

When you check an email address, it is sent to Have I Been Pwned, LeakCheck and XON to check against known data breaches. This email address is not stored by us on external servers. Monitored email addresses are stored encrypted on your device.

Password check

Passwords are never sent in full. A SHA-1 hash of the password is created; only the first 5 characters of that hash are sent to Have I Been Pwned and XON (k-anonymity model). The original password never leaves your device.

URL scanner

When you scan a URL, the link is sent to Google Web Risk to check for malware and phishing. Google processes this URL in accordance with their privacy policy. We do not store scanned URLs.

Domain check

For a domain check, DNS records (SPF/DMARC) are retrieved via Cloudflare DNS-over-HTTPS and WHOIS data is retrieved via the public RDAP protocol. No personal data is sent.

Purchases

For processing subscriptions we use RevenueCat (revenuecat.com). RevenueCat processes purchase data via Google Play. We do not have access to your payment details. Please refer to the RevenueCat privacy policy for more information.

Crash reports

In case of crashes, Firebase Crashlytics (Google) collects technical information such as the device type, Android version, and stack trace. Device identifiers may be included as part of the crash report. No additional personally identifiable data (such as names or email addresses) is collected.

3. What we don't do

4. Security

Monitored email addresses are stored encrypted on your device via Android Keystore. Report data is stored locally in a secure database.

5. Children

Breach Watchdog is not intended for children under the age of 13.

6. Changes

We may update this policy. The most recent version is always available here or via the link in the Play Store.

7. Contact

Questions? Email appdev020@proton.me