Privacy Policy

1. Who we are

MyRecon is an open-source-intelligence tool and written archive operated by a sole proprietor. For data protection purposes, the operator is the data controller (the data fiduciary, in the language of India’s DPDP Act) for the processing described here.

The Grievance Officer is named under Rule 5(9) of India’s Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and answers requests and complaints about this policy. Messages reach a person, not a ticket queue; see section 18 for response times.

2. What we process, and why

Registration on MyRecon is optional. Without it we hold no profile of you; with it we hold only what the account rows below describe. What follows is the complete list of what is processed when you use the site.

Third-party sources

To answer a lookup, our API queries public data providers, RDAP and WHOIS registries, public DNS resolvers, breach databases, and public platform pages. Those providers receive the specific identifier you queried as part of the request, because there is no way to ask them about it otherwise. They handle it under their own privacy policies, not ours.

3. The password checker

The password tool is the one place where you might type a genuine secret, so it is built so that the secret cannot reach us even if we wanted it to.

• The password is hashed in your browser with SHA-1, using the browser’s own cryptography.
• Only the first five characters of that hash are sent, to the Pwned Passwords range API at api.pwnedpasswords.com. That prefix matches hundreds of different passwords, so it identifies nothing.
• The response is padded, so even its size gives nothing away. The match is worked out on your device.
• The password reaches neither MyRecon’s servers nor Have I Been Pwned. It never leaves your browser.
• This tool runs entirely client-side. It is excluded from history, from saved investigations, from shareable links and from exports, so a typed password cannot be written anywhere by accident.

This technique is called k-anonymity. Have I Been Pwned receives your IP address, as it would for any request your browser makes to it.

4. Forms and the email links

The breach-check box

Breach articles carry a box asking for an email address. Submitting it does not send the address to us as a form: the page hands it to the lookup tool on the home page, in your browser, and the tool then runs an ordinary email lookup, processed exactly as section 2 describes. Guest reports may remain in server memory for up to 30 minutes to support sign-in reveal; they are not saved to account history. Because the address is passed in the address bar, it may appear in your browser history. Clear your history if that matters to you, or use the tool on the home page directly.

These boxes ask for an address and nothing else. We recommend you only check addresses that are yours.

The email links

There is no contact form anywhere on this site. Every “contact” control is a plain mailto: link that opens your own mail application with the subject and questions pre-filled. Nothing is transmitted until you press send in your own mail client, and what you send travels through your mail provider to our mailbox. You control exactly what goes in it.

5. Legal bases

For anyone covered by the UK or EU GDPR, these are the bases we rely on:

• Performance of a contract / taking steps at your request (Art. 6(1)(b)), running the lookup you asked for and returning the answer; and, if you sign in or buy a pass, keeping your account and applying the allowance you paid for.
• Legitimate interests (Art. 6(1)(f)), keeping the service available and free from abuse, through rate limiting, the daily guest scan counter, server logs and short-lived caching. Our interest is in a service that stays up and is not used to attack anyone; the data involved is minimal and is not used to profile you.
• Consent (Art. 6(1)(a)), analytics and advertising cookies where consent is required. The site’s current consent message covers advertising; it does not manage Google Analytics consent.
• Legal obligation (Art. 6(1)(c)), where we have to keep or produce something by law, including payment records for tax purposes.

Storing your theme, history and saved investigations in your browser is done on the basis that you asked for it: it is a preference you set and a feature you used, and nothing is transmitted to us.

6. Who we share with

We do not send the identifiers you enter in lookup tools to advertising systems. Providing lookups, advertising, analytics and fraud prevention involves the recipients below, including data collected directly by SDKs in the Android app:

We may also disclose information where we are legally required to, or where it is necessary to establish or defend legal claims, or to protect the rights and safety of others. If this business is ever transferred, the data described here would transfer with it, subject to this policy.

7. International transfers

We operate from India, and the providers above are largely United States companies operating globally. If you use this site from the EEA, the UK or Switzerland, your data will be processed outside your country.

Providers process information under their own privacy policies and applicable international transfer arrangements. Google SDK data and server-side invite records also involve processing outside your country; our Firebase Realtime Database is in Singapore.

8. How long anything is kept

• Guest search queries and results: up to 30 minutes in server memory for authenticated reveal, with earlier expiry possible after restarts or capacity eviction; no saved guest account history. Non-email lookup caches may retain results for up to 10 minutes. A visible preview and opaque reveal token remain in this browser tab's session storage until replaced, cleared or the tab is closed. The token alone cannot reveal hidden details without sign-in and any required Deep Search entitlement.
• Signed-in username scans: saved to your account until you delete individual scans, clear your scan history or request account deletion.
• IP address for rate limiting: 60 seconds.
• Server logs: the standard short retention of our hosting providers, used for security and diagnostics and not to profile visitors.
• App invite records: retained while the invite programme operates to prevent duplicate rewards, and deleted when it ends. You can request deletion using the app data deletion steps below; narrowly necessary fraud prevention records may be retained while the programme operates.
• Google SDK data in the app: retention and deletion are governed by Google’s policies and account or advertising controls. Clearing MyRecon’s local storage does not itself delete information already received by Google.
• Accounts: until you ask us to delete yours. Deletion removes the account and its usage counts; payment records we are required to keep are retained for the legal period.
• Payment records: as long as Indian tax and accounting law requires, currently up to 8 years.
• Guest scan counters: two days.
• Browser storage: until you clear it. We cannot clear it for you, and we cannot read it.
• Email correspondence: as long as needed to deal with the matter, and for a reasonable period afterwards as a record.

To resume international checkout, we keep your activation code, account ID, checkout URL and expiry in this tab's session storage. Signing out clears this record, and the browser removes it when the tab session ends. Checking payment sends the code to our server for your signed-in account.

9. Cookies and advertising (Google AdSense & Analytics)

MyRecon’s own code sets no session cookies. Google Analytics uses first-party analytics cookies to measure site visits, and Google advertising (AdSense) uses separate cookies. The full detail and ways to refuse or delete them are in our cookie policy.

In accordance with Google AdSense program policies, please note the following required disclosures:

• Third-party vendor advertising cookies: Third-party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this website or other websites.
• Personalized and non-personalized ads: Google’s use of advertising cookies enables it and its partners to serve ads to your users based on their visit to your sites and/or other sites on the Internet.
• Opt-out options: Users may opt out of personalized advertising by visiting Google Ads Settings (or Google My Ad Center). Alternatively, you can opt out of a third-party vendor’s use of cookies for personalized advertising by visiting the Network Advertising Initiative opt-out page at optout.networkadvertising.org or the Digital Advertising Alliance at aboutads.info (or youronlinechoices.com for European visitors).
• Consent mechanism (EEA / UK / Switzerland): In the European Economic Area, the United Kingdom, and Switzerland, advertising cookies are set only after you have given consent through our Google-certified consent management message. You can reopen this consent prompt and modify your choices at any time using the cookie settings link in the footer of every page.
• Google partner disclosures: Learn more about how Google collects and uses information from sites that partner with it at how Google uses information from sites or apps that use our services.

10. Security

The measures that matter most here are architectural: guest lookups do not create account history, signed-in username scans are scoped to your account, and the password checker never sends us the password you type.

• The site is served over HTTPS and sends HSTS, including subdomains, with preload. API requests are HTTPS-only.
• The API is rate-limited; guest scans are not saved as account history.
• The password checker is built so a password cannot reach our servers at all.
• Credentials for third-party services are held as environment variables, never in the codebase.

No system is perfectly secure. If you believe you have found a vulnerability, please report it privately to aryan@bugsnaps.in before disclosing it publicly; see our contact page.

11. Your rights

If you are in the UK or the EEA, you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time where consent is the basis.

To exercise any of these, email aryan@bugsnaps.in. We do not charge for this and we will not ask you to create an account to do it.

If you are unhappy with our answer, you may complain to your data protection authority, the ICO in the UK, or your national supervisory authority in the EEA. We would rather you gave us the chance to fix it first.

12. If you are in India

This policy is also published under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and is written to meet the notice expectations of the Digital Personal Data Protection Act, 2023.

• Sensitive personal data. We do not collect passwords, financial information, health data, biometrics or any other category of sensitive personal data or information under the 2011 Rules. The password checker is deliberately built so that a password is never received.
• Your rights as a Data Principal under the DPDP Act include access to a summary of your personal data and the processing, correction and erasure, nomination, and grievance redressal. Exercise them by writing to the Grievance Officer below.
• Grievance Officer: Aryan Walia, aryan@bugsnaps.in, Gurugram, India. Complaints are acknowledged and answered as quickly as we can, and in any event within the period the law requires.
• If a grievance is not resolved to your satisfaction, you may approach the Data Protection Board of India once it is operational.

13. If you are in the United States

For residents of California and other US states with comprehensive privacy laws:

• Search values are excluded from advertising. Google Analytics receives website usage information; Google advertising services, including AdMob in the Android app, receive identifiers, interactions and diagnostic information as described above. Advertising may be personalised where allowed by your choices and applicable consent requirements.
• Google’s advertising cookies operate under Google’s own disclosures. Use Google My Ad Center to turn off personalised ads.
• Advertising choices. Use the website’s cookie settings, Google My Ad Center and your Android advertising ID controls to manage the advertising choices available for those services. You can also email us with a privacy request.
• We do not use the values you enter in lookup tools to build advertising profiles. We do not discriminate against anyone for exercising a privacy right.
• To make a request, email aryan@bugsnaps.in. Signed-in users can also delete saved scans from their account.

14. Children

This site is intended for adults. It is not directed at children under 13, we do not knowingly collect personal information from them, and personalised advertising is not targeted at them. In the EEA, where the digital-consent age is between 13 and 16 depending on the country, the same applies at your national age.

If you believe a child has provided personal information to us, write to aryan@bugsnaps.in and we will delete it.

15. If you were searched for

MyRecon surfaces information that is already public, from sources that publish it. Guest scans are not saved to account history. A signed-in user can save a username scan privately to their account and later delete it.

Removing a saved result here would not remove it from the platform or registry that publishes it. If information about you is public and you want it gone, the source is the place to ask, and we will help you work out where that is. Write to aryan@bugsnaps.in if you have a request about data held by MyRecon.

If you believe the site is being used against you, for harassment, stalking or doxxing, tell us. That use is prohibited by our terms and we act on reports.

16. The Android app

This policy is also the privacy policy for the MyRecon Android app. Many tools process information on your handset or contact public sources directly. Some selected checks and invite verification use the MyRecon API, and the Google AdMob and ML Kit SDKs transmit the data described below.

• Username sweeps run from your device. Your handset contacts the platforms being checked directly, so those platforms see your device’s IP address rather than a server’s. That is deliberate, it is why the results are better, but it is a trade-off you should know about.
• Public breach catalogue alerts compare on your device. The app downloads the public catalogue from haveibeenpwned.com and this site’s feed. Catalogue matching does not send your watched address. If you separately enable per-address email monitoring, the app sends watched email addresses to leakcheck.io and api.xposedornot.com for those checks. You can turn email monitoring off in the app.
• Checking a specific email address sends it off your device. Requested breach and email checks send the address to leakcheck.io or api.xposedornot.com; an address included in a request URL can appear in the provider’s server logs. Optional linked-account and email-profile checks, and incident-specific breach checks, send the email address and any selected incident to the MyRecon API at myrecon.onrender.com. Depending on the enabled provider configuration, our API queries services such as OSINT Industries, People Data Labs, GitHub, Gravatar, XposedOrNot or LeakCheck to answer the request. These optional checks run when you select them.
• Password checks work exactly as section 3 describes: hashed on the device, five characters of the hash sent to api.pwnedpasswords.com, the password itself never transmitted.
• Importing a QR code from a picture happens on your device. The image comes from the system picker and is decoded locally by the bundled Google ML Kit barcode scanner. The picture and decoded QR content are not uploaded by ML Kit. The SDK does send per-installation identifiers, device and app metadata, scan feature events, configuration, performance metrics and error codes to Google for diagnostics and usage analytics, as described in Google’s ML Kit data disclosure. Following a decoded link uses the network as described below.
• Camera permission is for the QR code scanner. The code is read and decoded on your device, and the camera image is never uploaded or saved. Acting on what it finds does use the network: to tell you where a code really leads, the app follows the link’s redirects, so each server in that chain sees a request from your device, and looks the final domain up in the public RDAP registry (rdap.org) to see how recently it was registered.
• Some checks retry through MyRecon. Email, domain, DNS and IP tools may retry a lookup through myrecon.onrender.com when a direct source does not answer. The queried identifier and request IP address then reach our API and hosting provider. Server request logs, rate limiting and any applicable temporary results follow the retention described above. The optional MyRecon email checks and invite verification are separate server requests and do not depend on a retry.
• The self-scan reads your own connection. To tell you what your phone reveals, the app asks ipwho.is about the address you are connecting from, which returns your approximate area, provider and whether you are behind a VPN, and resolves names through cloudflare-dns.com. Both see your IP address, as any website you visit does. Nothing about the phone itself is sent to us.
• Deep Search sends the name or username you choose to public sources. Searches run from your handset against lite.duckduckgo.com, www.bing.com, wikidata.org, orcid.org and api.github.com. Each receives the name or username queried and your device’s IP address. These direct search requests do not pass through MyRecon.
• Other lookups reach the services they need. Domain and certificate work uses rdap.org and api.certspotter.com; GitHub lookups use api.github.com. Each receives the identifier you asked about and your device’s IP address.
• Notification permission is used to tell you when a breach matches something you are watching.
• Invites are verified through MyRecon and Google. While the invite card is visible, the app sends its invite code to read its unlock status. Deep Search unlocks after one invited friend completes a standard username scan. That invited install sends the completed username, invite codes, a hash of its app-specific Android ID and a Play Integrity token to the MyRecon API. Google verifies the app, licence and device; MyRecon runs a qualifying public username scan before granting access. Firebase in Singapore stores the inviter code, claim hash and time; the referral record does not retain the username. These checks do not prove identity or account ownership. Anyone holding an invite code can read its unlock flag. Public Play reviews are optional and do not earn access.
• Local app storage holds your watch list, settings, search history and results on your device. The Android app has no user account or account sync. Server-side invite records and data received by third-party services are separate from this local storage. See how to delete Android app data.

Advertising in the app

The app shows advertising through Google AdMob, including rewarded ads you can choose to watch to unlock an action. The Google Mobile Ads SDK collects and shares your advertising ID, app set ID and other applicable device or account identifiers, your IP address and approximate location estimated from it, app and ad interactions such as launches, taps and video views, and diagnostic and performance information. Google uses this information for advertising, analytics and fraud prevention, under Google’s policies. See Google’s Mobile Ads SDK data disclosure. MyRecon does not pass the search values you enter to AdMob. Google Mobile Ads and ML Kit transmit their collected SDK data over encrypted connections.

You can reset or delete your advertising ID, and manage available ad personalisation controls, in Settings → Privacy → Ads on your Android device. Where a consent message applies to you, it lets you manage advertising choices before ads are requested. These choices do not mean that all SDK identifiers, diagnostics or fraud prevention signals stop being processed.

17. Changes to this policy

Any material change is reflected in the date at the top of this page. Where a change is significant and affects you, we will make it prominent rather than hoping you re-read the page. Continued use of the site after a change means the updated policy applies.

18. Contact and complaints

Questions, requests and complaints about this policy all go to the same place, and a person reads them.

We aim to acknowledge within a few working days and to answer fully within 30 days, which is the outer limit the GDPR allows. See also our contact page, our cookie policy and our terms of use.