Fine Print

See what you've agreed to, in one list.

What Have I Been Pwned's terms say

C privacy grade · haveibeenpwned.com · Tech & telecom

Have I Been Pwned's terms of service and privacy policy have 7 rated points: 0 serious, 2 bad, 3 worth knowing and 2 good. 6 apply whenever you use the site, signed in or not; 1 only once you have an account.

I have a Have I Been Pwned account I only visit it Adds Have I Been Pwned to your list and compares it with the other sites you use.
Signed in or not

Whenever you use Have I Been Pwned

Bad 2

  • Your data is processed and stored in a country that is less friendly to user privacy protection

    Your data is processed and stored in a country that is less friendly to user privacy protection (U.S.A.)

  • Third-party cookies are used for statistics

    Created by Docbot version v3

    Where it says this ↗

Worth knowing 3

  • The terms may be changed at any time, but you will receive notification of the changes

    The Terms of use state, “14. CHANGES TO THESE TERMS (a) We may, from time to time amend these Terms. We will endeavour to provide you with prior written notice on our Website of any such amendments. If you do not agree with any amendments to these Terms, you may stop using our Free Services and/or cancel your Paid Services at any time via your Dashboard. (b) You agree that if you use our Services after the date on which such changes to the Terms have occurred, we will treat your use of our Services as acceptance of the changed Terms.”

    Where it says this ↗
  • The court of law governing the terms is in location X

    The court of law governing the terms is in Australia

    The terms of service state, “Thanks for your interest in the Have I Been Pwned (HIBP) Services. Further down this page you'll find the terms of use, written up by Australian lawyers (HIBP is owned and operated out of Australia)”, “Nothing in these Terms excludes, restricts or modifies any condition, warranty, right or remedy conferred by the Australian Consumer Law (as set out in Schedule 2 of the Competition and Consumer Act 2010 (Cth)) or any other applicable law that cannot be excluded, restricted or modified by agreement.”, “(c) To the fullest extent permitted by law, our liability for a breach of a non-excludable condition or warranty is limited at our option (where permitted by the Australian Consumer Law (as set out in Schedule 2 of the Competition and Consumer Act 2010 (Cth)) to:”, “(a) These Terms are governed by and must be construed in accordance with the laws in force in Queensland. (b) The parties submit to the exclusive jurisdiction of the courts of Queensland and the Commonwealth of Australia in respect of all matters arising out of or relating to the Terms, its performance or subject matter.”, “Registered Office: Level 11, 2 Corporate Court, Bundall 4217, Queensland, Australia”

    Where it says this ↗
  • Your IP address is collected, which can be used to view your approximate location

    Created by Docbot version v3

    Where it says this ↗

Good 1

  • Information is provided about what kind of personal information is collected

    Information is provided about what kind of information they collect

    Created by Docbot version v3

    Where it says this ↗
With an account

If you have a Have I Been Pwned account

Good 1

  • You can delete your content from this service

    The privacy policy states, "Using our opt-out feature Superlative provides an opt-out feature for HIBP that, if used, removes an email address from public visibility. The opt-out feature provides you with 3 different ways to control how your personal data is stored and accessed: 1. Just removal from public searches: The public email address search no longer returns your address. Your address is still stored, you can still see breaches against it by verifying control with the notification service and anyone control the domain your address is on can continue to see breaches against it using the domain search feature. 2. Remove all current and future breaches: No existing breaches impacting your address nor any occurring in the future will be stored against your address. No searches of any kind will return a breach associated with your address. Your address is retained alongside instructions to never load future breaches against it. 3. Remove the email address entirely: The address and associated breaches are permanently removed. If a future breach is loaded that includes your address, it will become publicly searchable again."

    Where it says this ↗

The documents

Ratings by ToS;DR volunteers; they can lag behind the current terms. Not legal advice.