Home · Terms of Service · CCPA · Accessibility · Contact

Privacy Policy

Last updated: September 28, 2026

This Privacy Policy explains how Misconfigs LLC ("we," "us," or "our") collects, uses, and protects information when you use Leaklet, including the Chrome extension, leaklet.com accounts, and related download pages (the "Service"). By using the Service, you agree to the practices described here and our Terms of Service.

1. Overview

Leaklet is an AI Affiliate Opportunity Finder & Content Ideas for ecommerce, website publishers, and content creators. Chrome scans do not require an account. When a scan builds the Opportunities list, the extension may send a short text sample, the page title, and the page URL to leaklet.com so Cloudflare Workers AI can rank possible missing opportunities. We do not store that text after the response, and we do not receive full page HTML. Scan history stays on your device. If you have Leaklet Pro, the extension may also keep summaries on your leaklet.com account. After a fresh install, Leaklet may open the Get started page on leaklet.com. Open Leaklet, then go to any video, post, or page you want and scan it. Chrome may ask you to allow access to websites so Leaklet can read that page. The first scan after a fresh install uses one scan from your plan. A likely affiliate label can also match a promo or discount code. Free lifetime and Pro monthly scan counts live on leaklet.com. That server count is the source of truth. A cookie may identify this browser. The numbers shown in the extension are a copy. The Pro monthly count is keyed to your license, as described below. The opportunity request may include the device time zone and language. leaklet.com may look up a country code for the IP that reached the API using IPinfo. A worker uses those only to pick handwritten affiliate program pages for your region on topic matches, as described in section 2A. Time zone is preferred. Country is used when the time zone is missing or not a mapped zone.

You can create a leaklet.com account with the email and password you used on Stripe to retrieve your license key (if you have a valid active subscription), or cancel your subscription, or otherwise manage your account. Completing sign-in sets a session cookie. We store a one-way hash of your password, not the password itself. Email support@leaklet.com if you cannot sign in. We may still hold an email, password hash, Google account id if we received one, and Stripe ids until the account is deleted.

Data controller. For purposes of applicable privacy laws, Misconfigs LLC is the data controller for personal information processed through the Service. Contact: support@leaklet.com.

We do not currently appoint a separate EU or UK representative. If that changes or if applicable law requires one, we will update this Policy.

California notice at collection. If you are a California resident, this Policy describes the categories of personal information we may collect, the purposes for which we use it, and how to exercise your rights. The standalone CCPA / California Privacy Disclosures page is the notice at collection and Do Not Sell or Share statement. We do not sell personal information as defined by the California Consumer Privacy Act (CCPA), as amended by the CPRA. We do not share personal information for cross-context behavioral advertising.

2. Information processed in the extension

When you click Scan, Leaklet reads the YouTube page on the active tab you chose. It may send a short text sample, the page title, and the page URL to leaklet.com so Cloudflare Workers AI can rank possible missing opportunities. We do not keep that text after the response. Leaklet does not check outbound hops or label extracted URLs in the current Chrome extension.

On your device, using Chrome storage, Leaklet may keep:

This information stays on the device until you clear extension data, uninstall Leaklet, or delete history in the popup. If you have Leaklet Pro, the extension may also upload scan summaries: page URL and title, topic and program names, and programs you marked Joined. It does not upload page HTML, photos, or video stills. You can delete that copy on leaklet.com.

Scan counts. On a store install, Leaklet contacts leaklet.com to read and update remaining scans. Free lifetime and Pro monthly counts are stored on our servers. That server count is the source of truth. A cookie on leaklet.com identifies this browser. The extension may also store an install id so the same free-scan bucket can be found again. The popup only displays a copy of the server count. Pro monthly scans are keyed to your license. Deleting cookies or reinstalling does not reset a Pro count. Paid license keys stay on this device. Unpacked developer installs skip these caps.

Leaklet does not collect Chrome browsing history, does not run advertising or third-party analytics in the extension, and does not require login for Chrome scans. A leaklet.com account uses email sign-in. Cloud scan history and analytics are a Pro feature.

2A. Opportunity AI

When a Chrome scan builds the Opportunities list, we may send the page title, the page URL, and a short text sample to leaklet.com. On a YouTube watch page, that sample may include captions the page already exposes. Leaklet only scans YouTube watch, Shorts, live, and channel pages. It does not scan Instagram, blogs, or stores. Leaklet does not download the video file. We run that request on Cloudflare. Cloudflare Workers AI returns ranked hints: review priority, revenue potential, publisher interest, page briefs, and next steps. Those ranks are not commissions, lost earnings, or proof a program exists, or a guarantee you or a publisher will be interested in a potential opportunity. We do not keep that text after the response. If the AI call fails, the opportunity list stays empty.

leaklet.com may send that IP address to IPinfo, a geolocation provider, to look up a country code. The same request may include the device time zone and language. A worker (not the AI model) uses the time zone first, then that country if the time zone is missing or not a mapped zone such as UTC, to pick handwritten affiliate program pages for your region on topic matches. That does not change opportunity ranks, invent commissions, or mean a merchant is in a program. We do not store the time zone, language, or that country code with the ranking payload after the response. A coarse region may be saved with the scan on the device. The Opportunities list may show that region next to Direct programs and Network Programs. Separately, leaklet.com keeps a short operational access log for extension API calls (opportunity ranking and scan counts): the API path, the IP address that reached leaklet.com, a country code IPinfo returns from that IP, the time, the HTTP status, how long the request took, the response size in bytes, how many ranked or labeled items came back (a count only), an eight-character prefix of the random install id this browser minted (not the full id), whether the caller used a Pro license (yes or no, not the key), and whether the caller was the Chrome Web Store build, an unpacked build, or leaklet.com. We use that log to operate the service, measure reliability, and prevent abuse. We do not keep scanned page URLs, page text, photos, license keys, full install ids, or item names in that log. Those rows expire after 365 days.

3. Requests to third-party sites

A scan may ask Chrome for optional host access so Leaklet can read the YouTube page you chose. The current extension does not send HEAD or GET hop checks to destination URLs found on that page.

3A. Payments and license email

When you subscribe to AI Affiliate Opportunity Finder & Content Ideas Pro ($49/month), Stripe processes the payment. Stripe collects the details needed to complete checkout. We can see related records in our Stripe account, including your email address, payment amount, payment status, billing country, subscription status, and the limited card information Stripe shows merchants (for example the last four digits). We do not receive or store your full card number. After a Pro checkout we store your Stripe customer id and checkout email against the license key so Settings can open Stripe billing for that key. If you start checkout from the Chrome extension, we also store that install id against the license so this browser can unlock without pasting.

After you subscribe to Pro, we email your license key from licenses@leaklet.com. Those emails are sent with Resend from a Cloudflare Worker we operate. We can access data tied to that send: the recipient address, the message we send (including a license key), delivery or bounce status, and operational logs such as time and destination.

Stripe, Resend, Cloudflare, and IPinfo process this information so we can take payment, sign you in, deliver a key, rank opportunity hints, and look up a country code from the IP that reached leaklet.com. Chrome is operated by Google. Their own privacy policies apply to services they provide.

3B. Leaklet accounts

You can create a leaklet.com account with the email and password you used on Stripe to retrieve your license key (if you have a valid active subscription), or cancel your subscription, or otherwise manage your account. Completing sign-in sets a session cookie on leaklet.com. The session cookie lasts until you sign out, it expires, or you clear cookies for leaklet.com. We store a one-way hash of your password. We do not store the password itself.

If you still have an older leaklet.com account, we may still hold your email, account id, password hash if you created a password, Google account id if we received one, and Stripe customer or subscription ids when Stripe sent them, until you delete the account.

4. Download and marketing pages

If you visit leaklet download or legal pages hosted on the public internet, the host (for example a static host or CDN) may record standard request metadata such as IP address, browser type, referring URL, path, and time, for security, operations, and abuse prevention. We do not currently run Google Analytics or advertising pixels. A leaklet.com account uses a session cookie, as described above.

5. How we use information

We do not sell your personal information. We do not use scan contents to train our own machine learning models. Opportunity ranking uses Cloudflare Workers AI as described in section 2A. Cloudflare's terms apply to that inference.

6. Permissions

activeTab and scripting let Leaklet read the YouTube page on the current tab after you click Scan. storage saves settings and history on this device. Access to leaklet.com is used to count free lifetime scans, count Pro monthly scans against your license, and to send a short text sample for opportunity ranking, as described in section 2A. The same request may include the device time zone and language, and may receive a country code from IPinfo, as described in that section. Optional http and https access is requested so the extension can read a YouTube page you scan. It is not used to watch your browsing in the background.

7. Data retention

To delete account data we still hold, email support@leaklet.com. Stripe may still hold payment records after you cancel in Stripe or by emailing us. For other personal information we hold (for example an email you sent), contact support@leaklet.com. We will use reasonable efforts to respond as required by applicable law. We cannot remotely wipe chrome.storage on your device; you control that locally. Canceling in Stripe stops new paid periods.

8. Security

We implement reasonable technical and organizational measures. No method of transmission or storage is 100% secure. You are responsible for securing your device and browser.

In the event of a security incident affecting personal information we hold, we may notify affected users and relevant authorities as required by applicable law.

9. Legal bases (EEA/UK)

If you are in the European Economic Area, United Kingdom, or Switzerland, we process personal information under:

10. Your rights

Depending on your location, you may have rights to access, correct, delete, or export personal data, or to object to or restrict certain processing. For account deletion and other requests, contact support@leaklet.com.

If you are in the EEA, UK, or Switzerland, you may also lodge a complaint with your local supervisory authority. California residents may have additional rights under the CCPA. Read the CCPA disclosures. We do not sell personal information as defined by that law.

11. International transfers

Misconfigs LLC is based in the United States. If you email us or load hosted pages from other regions, information may be processed in the U.S. and other countries where we or hosting and payment or email providers operate. Where required, we rely on appropriate safeguards such as standard contractual clauses offered by subprocessors.

12. Children

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children.

13. Your choices

You can use the Chrome extension without an account. You can create a leaklet.com account with the email and password you used on Stripe to retrieve your license key (if you have a valid active subscription), or cancel your subscription, or otherwise manage your account. You may clear history in the popup or uninstall the extension.

14. Changes

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last updated" date. Continued use after changes constitutes acceptance of the updated policy. This Policy does not create contractual warranties beyond those stated in our Terms of Service.

15. Contact

Privacy questions: support@leaklet.com

Misconfigs LLC. Leaklet. AI Affiliate Opportunity Finder & Content Ideas.