Legal
Privacy Policy
Effective 24 September 2026 · Version 0.1
The short version
- We only read your account. We never change, delete, send, or share anything in it.
- We look at file sharing settings, not what's inside your files.
- We look only for security-related emails, not your personal conversations.
- Results are deleted when you leave the page, unless you choose to keep them.
- We never sell your data, show you ads, or use your data to train AI.
This policy explains how Privacy Checkup ("we", "us") handles your personal data when you use our website and app (the "Service"). We act as a Data Fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the DPDP Rules, 2025.
01What we collect
| Data | Why | Source |
|---|---|---|
| Name, email, profile picture | To create your account and address you | Google or Microsoft sign-in |
| File names and sharing settings | To find files open to anyone or to outsiders | Google Drive or OneDrive, read-only |
| Security-related emails | To find sign-in alerts, password changes and leak notices | Gmail or Outlook, read-only |
| Your email address | To check it against known data leaks | You |
| Alert email, phone (optional) | To send you alerts, if you turn them on | You |
| Basic usage data | To keep the Service working and secure | Your browser |
02How we use it
We use your data only to run the checks you ask for, show you the results, and send alerts you've turned on. We process it on the basis of your consent, which you give when you connect an account. You can withdraw consent at any time by removing a connected account or deleting your account.
03Google & Microsoft data
Privacy Checkup's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In practice, this means data from your Google or Microsoft account is:
- used only to provide the checks you can see in the app;
- never used for advertising, never sold, and never used to train AI or machine-learning models;
- never read by a person, unless you ask us to for support, it's needed for security, or the law requires it.
You can remove our access any time from your Google Account or Microsoft account settings, or from the Account page in our app.
04What we never do
- Ask for or store your password.
- Open or read what's inside your files.
- Send, delete, or move any email or file.
- Change who a file is shared with. We only show you where to do it.
- Check an email address that isn't yours.
05How long we keep it
Check results are deleted as soon as you leave the results page, unless you turn on "Keep my past results". Saved results are kept for up to 12 months, then deleted. Your profile is kept while your account is open, and deleted within 30 days of you deleting your account.
06Who we share it with
We share data only with service providers that help us run the Service, under contract, and only as much as they need:
- Leak-check provider: receives your email address to check it against known leaks.
- Cloud hosting: runs our servers.
- Email/SMS provider: sends alerts, only if you turn them on.
- Payment provider: handles Pro payments. We never see your card number.
We may also disclose data where Indian law requires it.
07Security
All data is encrypted in transit and at rest. Access to Google and Microsoft data is limited to automated checks. We complete an independent security assessment every year, as Google requires. If a data breach affects you, we will tell you and the Data Protection Board of India as the law requires.
08Your rights
Under the DPDP Act, you can:
- get a summary of the data we hold about you and how we use it;
- correct, complete, or update your data;
- have your data erased;
- withdraw your consent at any time;
- name someone to exercise these rights for you if you die or can't act yourself;
- raise a complaint with our grievance officer, and then with the Data Protection Board of India.
Most of this can be done from the Account page. For anything else, write to our grievance officer.
09Children
The Service is for people aged 18 and over. We do not knowingly process data of anyone under 18.
10Grievance officer
[Name to be appointed]
Grievance Officer, Privacy Checkup
Email: grievance@privacycheckup.example
[Registered office address, India]
We will respond within the time set by the DPDP Rules.
11Changes
If we change this policy in a way that matters, we'll tell you by email or in the app before the change takes effect.