Privacy policy
Last updated: 25 October 2026.
The short version (TL;DR)
- The free guide sends nothing to us. It needs no account, and your progress stays in your browser.
- If you create an account, we collect the minimum needed to run it: your email, the identifiers you track, the accounts you follow, and your check history.
- Sensitive fields are encrypted at the field level. We never store passwords for other services, and we never get access to your accounts.
- We never sell your data and run no advertising trackers.
- We use a small number of processors (breach data, hosting, email) and share only what each strictly needs.
- You can export or delete everything yourself, anytime.
- Questions or requests: privacy@secbird.io.
The long version below says the same things with the precision a legal document needs.
Who we are
SecBird ("we") is the data controller for the personal data processed through secbird.io. Contact: privacy@secbird.io.
What we collect and why
The free guide needs no account and sends nothing to us. Everything in this table applies only if you create an account (optional).
| Data | Why | Legal basis |
|---|---|---|
| Account data (email, name, password hash, 2FA settings) | Sign you in, secure your account | Contract |
| Identity identifiers (encrypted) | The identities you asked us to audit | Contract |
| Accounts followed, check attestations, inventories (encrypted) | Your check history and walkthroughs | Contract |
| Monitored email addresses (encrypted) and breach matches | Breach alerts you asked for | Contract |
| Notifications sent | Your notification feed | Contract |
| Technical logs (IP, user agent, timestamps) | Security, abuse prevention, debugging | Legitimate interest |
We do not collect browsing history, advertising identifiers, or the contents of your accounts on other services, and we run no third-party trackers.
Processors we use
- Have I Been Pwned — breach lookups. Receives the email addresses you asked us to monitor, after you verify them.
- Email delivery and hosting providers — named in the sub-processor list; each receives only what the function requires.
The complete, always-current list lives at /legal/sub-processors.
We never sell personal data. We disclose it only when a law we are subject to compels us, and we'll tell you unless legally barred.
Retention
Your data lives as long as your account does. Delete your account and your personal data is deleted — not deactivated. Some data is trimmed earlier on a schedule (old notifications after 12 months). Backups age out on a fixed cycle after deletion.
Your rights
Access, rectification, erasure, portability, restriction, and objection (GDPR arts. 15–21). Export and deletion are self-service in the app; for anything else, email privacy@secbird.io. You can also complain to your data-protection authority — in the Netherlands, the Autoriteit Persoonsgegevens.
Changes to this policy
Meaningful changes are announced in plain language before they take effect.