Privacy Policy

CN Breach Check only processes what the check requires: your email address for 30 minutes at most. We don't use cookies, tracking or advertising.

This is a translation for your convenience. Only the German version is legally binding.

1. Controller

Christian Noack
CN Security & Systems
Eggestr. 4a
32758 Detmold, Germany
Email: admin@christian-noack.com

Further details are in the imprint (German). No data protection officer has been appointed, as there is no legal obligation to do so.

2. Overview

• We don't use cookies or any analytics, tracking or advertising services.
• Fonts and all scripts are hosted on our own server. No data is sent to font or script providers when you visit.
• Your email address is only used for the check and kept for 30 minutes at most (details in section 5).
• The result is not stored; it is shown to you once.
• We don't own a database of leaked data.

3. Hosting and access logs

The website, server functions and database are operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Firebase). Server functions and the database run in the Frankfurt am Main data centre (region europe-west3). The pages themselves are delivered via a worldwide content delivery network (CDN) so they load quickly.

With every request, Google processes technically necessary connection data, in particular IP address, time, requested URL and browser identifier. Requests to our server functions are logged by Google Cloud Logging and kept for 30 days by default. These logs don't contain your email address.

• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is secure and stable operation.
• A data processing agreement under Art. 28 GDPR is in place with Google.
• Access from the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR).

4. Abuse protection

Before submitting, your browser solves a small computational puzzle (proof of work). The verification runs exclusively on our own servers. No data is sent to captcha providers and nothing is stored on your device.

To prevent the service from being misused for bulk queries or for flooding other people's inboxes, we limit the number of requests. For this purpose we store for 24 hours at most:

• an irreversible hash of your IP address, created with a secret key,
• a hash of your email address created the same way (at most three confirmation emails per address and day),
• a counter without any personal reference for all emails sent on a day.

Legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is protecting the service and third parties from abuse.

5. How CN Breach Check works

We only show results to the owner of the address. That's why you confirm it via a link first.

1. You enter your email address and confirm that you are only checking your own address.
2. We create a random one-time link and store your address together with a hash of this link. The link itself is not stored.
3. We send you the link by email.
4. When you open the link, we inform you about the transfer to India and ask for your explicit consent. Only then do we delete the entry and query XposedOrNot (section 6).
5. The result is shown to you once and not stored.

If you don't open the link, it expires after 30 minutes. The entry is then deleted automatically, usually within 24 hours. If sending the email fails, we delete the entry immediately.

Legal basis: Art. 6(1)(b) GDPR. Processing is necessary to provide the service you requested.

Email delivery: We send confirmation emails via the mail server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. A data processing agreement under Art. 28 GDPR is in place with IONOS.

6. Query to XposedOrNot

For the check, we send your confirmed email address to XposedOrNot, based in India. XposedOrNot compares the address with known data breaches and returns the names of the affected services. According to its own statements, XposedOrNot processes searches in memory only and does not log which addresses are searched.

Transfer to a third country: There is no adequacy decision of the European Commission for India. The level of data protection is therefore not comparable to the EU; in particular, your rights may be harder to enforce there. The transfer only takes place with your explicit consent (Art. 49(1)(a) GDPR), which we obtain immediately before the check – after informing you of these risks. Consent is voluntary. Without it, no transfer and no check take place; your address is then deleted automatically. We only transfer the email address, once for the respective check. Since the transfer happens immediately after your consent, it cannot be withdrawn for that check afterwards.

7. Statistics

We count anonymously how many checks take place per day and how many of them have a result. These counters contain no email addresses, IP addresses or other personal data.

8. Recipients at a glance

No other third parties receive data. Nothing is sold or used for advertising.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on Art. 6(1)(f) GDPR (Art. 21).

Since we only keep your address briefly and hashes for 24 hours at most, there is usually no data left afterwards to which these rights could apply. Please send requests to admin@christian-noack.com.

You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

10. Security

All connections are encrypted (HTTPS with HSTS). The database is completely closed to outside access. Confirmation links are 256 bits long, stored only as hashes and usable only once. If you find a vulnerability, please report it to the address in our security.txt.

11. Changes

We update this privacy policy when the service or the law changes. The version published here applies. For the rest of our website, the privacy policy of christian-noack.com (German) applies.

Last updated: 29 October 2026