Privacy policy

1. Who this covers

DarkSint is responsible for the personal data described here. Reach us at support@darksint.com.

This policy covers two different groups, and the difference matters. The first is you, an account holder or visitor. The second is people whose details appear inside leak data that DarkSint reports on, who never signed up for anything. Section 4 is about them.

2. What we collect about you

Account

Email address, name, optional organisation, a hash of your password (never the password), your role and status, and the IP address you registered from.

Authentication

Hashed session tokens with their device and IP, your two-factor secret (encrypted), and hashed API keys. Sign-in attempts are counted to block brute force.

Usage

Every search: what was searched, which type, when, whether it succeeded, and how many results it returned. This is a deliberate audit trail: it is how abuse is detected and how you can see your own history.

Revealed records

The credentials you spend credits to reveal, encrypted at rest and readable only by your account, along with any notes or remediation status you add.

Billing

Your plan, subscription state and credit ledger. Card details do not reach us. If paid subscriptions are enabled, checkout details are handled directly by the merchant of record.

Security log

An audit record of significant actions (sign-in, key creation, plan change) with IP address, user agent and request ID.

Free exposure check

If you run the public check without an account: the address being checked, a hashed one-time code held for 15 minutes, and a counter of how many checks came from your IP that day.

We do not use advertising trackers, we do not build behavioural profiles, and we never sell personal data.

3. Why we process it, and on what basis

• To provide the service you asked for: running searches, reveals, exports and monitors, and billing you for them. Basis: performance of our contract with you.
• To keep the service and its shared data source safe: rate limits, abuse detection, audit logs, fraud prevention. Basis: our legitimate interest in a service that is not abused.
• To contact you about the service: verification, password resets, monitor alerts, material changes to these documents. Basis: contract, and legitimate interest for service notices.
• To meet legal and tax obligations, and to respond to lawful requests. Basis: legal obligation.

We do not send marketing email unless you ask for it, and you can stop it at any time without losing access to anything.

4. People who appear in leak data

DarkSint does not collect breaches. It queries a third-party source of data that is already circulating, and shows what that source returns. Personal data in those results (an email address, a username, a password, a URL) relates to people who have no relationship with us.

We process it on the basis of legitimate interest: letting an organisation find and remediate its own exposure, and letting an individual find their own. We have narrowed that processing deliberately:

• Results are masked by default. A credential is only decrypted and shown when a user spends a credit to reveal it.
• The public exposure check on this site requires a one-time code sent to the address being checked, so a report about an address only ever reaches someone who can read that address's mail.
• The public report is aggregate only: counts, sources, dates, password strength. It never returns an individual record.
• Users are contractually bound by the Responsible Use policy to search only what they own or are authorised to investigate, and every search is logged against them.
• Revealed records are encrypted and visible only to the account that revealed them, never shared between accounts.

If your data appears in DarkSint and you want to know what we hold or want it removed from our systems, write to support@darksint.com. We will verify who you are before acting, and we will be straight with you about the limit here: we can remove what is in our systems, but we cannot remove a leaked record from the internet or from the upstream source.

5. Who else sees it

Leak-data source

The identifier or domain you search is sent to a third-party provider so it can be looked up. We do not send them your account details.

Merchant of record

Paddle, our merchant of record, handles checkout, invoicing and tax, and receives billing details directly; we never see your card.

Email delivery

A mail provider delivers verification codes, password resets and monitor alerts, and therefore sees the recipient address and message.

Hosting

Our servers and database run on infrastructure operated by a hosting provider, who can access it only as needed to run it.

These are processors acting on our instructions under contract, not independent recipients. We also disclose data where the law requires it, and would tell you unless legally barred from doing so.

6. How long we keep it

Account data

While the account exists, then deleted on request.

Search history and audit logs

Kept while the account exists, because they are the abuse-detection and accountability record. Deleted with the account.

Revealed records

Until you delete them or the account is deleted.

Export files

Deleted automatically 48 hours after generation.

Free-check codes

15 minutes, then gone. Daily counters expire after 24 hours.

Billing records

Kept as long as tax and accounting law requires, typically several years.

7. Your rights

Where the GDPR, the UK GDPR or Turkish KVKK applies to you, you can ask for a copy of your data, correct it, have it deleted, restrict or object to processing, and receive it in a portable format. You can also complain to your data protection authority.

Account settings let you change your details, revoke sessions and keys, and delete individual revealed records. For a full account deletion or a copy of everything we hold, write to support@darksint.com. We will verify your identity and complete it within 30 days.

Exercising any of these rights costs nothing and will not get your account treated differently.

8. Cookies and local storage

DarkSint sets one cookie. It holds your refresh token, so you stay signed in; it is HttpOnly, SameSite=strict, scoped to the authentication path, and sent over HTTPS in production. It is strictly necessary (without it you would be signed out on every page load), so it does not require consent, and there is no consent banner because there is nothing else to consent to.

Your browser also stores your theme choice and whether the sidebar is collapsed. That never leaves your device and never reaches us.

There are no analytics, advertising or third-party tracking cookies.

9. Security and location

Passwords are hashed with Argon2id. Revealed credentials and two-factor secrets are encrypted with AES-256-GCM. Sessions rotate and a reused token revokes the whole family. The Security page describes this in full, including what we do not claim.

Data is processed on infrastructure that may sit outside your country. Where data leaves the EEA or the UK we rely on the European Commission's standard contractual clauses or an equivalent safeguard.

If a breach is likely to put you at risk we will tell you and the relevant authority without undue delay.

10. Changes

When this policy changes materially we will tell you before it takes effect, by email or in the product. The date at the top always reflects the last substantive change.