Home · Privacy Policy · Terms of Service · Accessibility · Contact
CCPA / California Privacy Disclosures
This page is the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) disclosure for Leaklet, operated by Misconfigs LLC. It is the notice at collection and the site disclosures page for California residents. The full Privacy Policy still applies.
Notice at collection
If you are a California resident, we may collect the personal information described below when you visit leaklet.com, create a leaklet.com account, subscribe to Pro, email us, or use the Leaklet Chrome extension. We use it to operate Leaklet, take payment, rank opportunity hints, label links, prevent abuse, and answer support or legal requests. We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
Categories of personal information
In the last 12 months we have collected, or may collect, these categories:
- Identifiers: email address, IP address, a cookie that identifies this browser for scan counts, a random install id (or an eight-character prefix of it in operational logs), and a leaklet.com account id.
- Commercial information: Pro payment amount, payment status, billing country, subscription status, Stripe customer or checkout ids, and the limited card details Stripe shows merchants (for example the last four digits). We do not receive or store your full card number.
- Internet or other electronic activity: pages you load on leaklet.com, API path, time, HTTP status, how long a request took, response size, a count of ranked or labeled items, whether the caller used a Pro license, and whether the caller was the Chrome Web Store build, an unpacked build, or leaklet.com. A scan may send a short text sample, page title, page URL, extracted link URLs, and (on some photo or video pages) downscaled JPEG stills so we can rank or label that scan. We do not keep that scan payload after the response.
- Geolocation data: this device's time zone and language, and a country code IPinfo returns from the IP that reached leaklet.com. We use time zone first, then that country, to pick handwritten affiliate program pages for your region. We do not store the time zone, language, or country code with the ranking payload after the response. A coarse region may stay with the scan on your device.
- Account credentials: a one-way hash of your leaklet.com password. We do not store the password itself. If you used Google sign-in, we may hold a Google account id.
We do not collect Social Security numbers, driver's license numbers, financial account numbers, precise geolocation, biometric identifiers, or the contents of your email except when you write to us.
Sources
- You, when you scan a page, create an account, subscribe, or email us
- Your browser or device (IP address, time zone, language, cookies)
- Service providers who process that information for us: Stripe, Resend, IPinfo, Google (Chrome and optional Google sign-in), and the host that serves leaklet.com
Business purposes
- Provide, operate, and secure the Chrome extension and leaklet.com
- Process Pro payments, license keys, and billing
- Rank opportunity hints and label extracted link URLs
- Suggest handwritten affiliate program pages for your region
- Measure reliability, prevent abuse, and answer support or legal requests
Third parties and service providers
We disclose personal information to service providers who process it for the purposes above: Stripe (payments), Resend (license email), IPinfo (country from IP), Google (Chrome and optional Google sign-in), and the infrastructure that hosts leaklet.com and runs ranking. Destination sites you scan may log IP address, user agent, and the URL requested when the extension checks whether a link responds. We do not receive those destination logs. We do not disclose personal information to advertising networks or data brokers.
Do Not Sell or Share My Personal Information
Leaklet does not sell personal information as defined by the CCPA, as amended by the CPRA. Leaklet does not share personal information for cross-context behavioral advertising. We do not run Google Analytics or advertising pixels. There is no sale or share for you to opt out of. If that changes, we will update this page and offer a request method here.
We also do not use or disclose sensitive personal information to infer characteristics about you. A password hash and payment data are used only to sign you in and take payment.
Your California rights
California residents may request:
- To know the categories and specific pieces of personal information we have collected about you
- To delete personal information we hold, subject to legal exceptions
- To correct inaccurate personal information we hold
- To opt out of the sale or sharing of personal information (we do not sell or share)
- To limit use and disclosure of sensitive personal information (we do not use it to infer characteristics)
- Not to be discriminated against for exercising these rights
We cannot remotely wipe chrome.storage or scan history on your device. You can delete history in the extension or uninstall Leaklet.
How to exercise your rights
Email support@leaklet.com with the subject "CCPA request". Say whether you want to know, delete, or correct, and include the email you used on Stripe or for a leaklet.com account if you have one. We will verify the request with information we already have (for example that email or a recent payment). We will respond within 45 days, or tell you if we need more time (up to 45 additional days). You may use an authorized agent. The agent must send proof they can act for you, and we may still need to verify you directly.
Shine the Light
California Civil Code section 1798.83 (Shine the Light) lets residents ask whether we disclosed personal information to third parties for their own direct marketing. We do not disclose personal information to third parties for their direct marketing.
Contact
Misconfigs LLC. Privacy and CCPA requests: support@leaklet.com. Also see the Privacy Policy and Contact page.