Privacy

This site has no open sign-up and no newsletter: only accounts invited by the publisher sign in, for RapidGuard's version with an account (see below). Without an account, here is, exhaustively, what it knows about you.

RapidGuard also has a version with an account, by invitation only: an invited Rapid account has its addresses and usernames checked every night by our server, and receives an email when a new breach appears. It has its own legal notice and privacy policy, in French with an English summary: rapidall.eu/compte/mentions-legales · rapidall.eu/compte/confidentialite.

What the server records

• The web server logs: for each page requested, the IP address, the time, the page and the browser name. They are used to detect failures and abuse (legitimate interest, art. 6-1-f GDPR) and are deleted after 30 days.
• A visit counter, which is just a number: it records neither who nor from where.

Our server keeps nothing you type. Your password never leaves your browser: only 5 of the 40 characters of its hash go out, to Have I Been Pwned. Your email address never reaches us: your browser sends it directly to XposedOrNot and, for LeakCheck, sends our server only 24 characters of its SHA-256 hash. A username, however, reaches us in plain text, because LeakCheck cannot search a username by its hash. Our server passes that hash or username on to LeakCheck, sends you the answer and forgets them: they are written neither to its disk nor to its logs, where the request appears without its value. The name of a site searched in “Recent breaches” never leaves your browser. All these checks go out only when you click.

What your browser keeps

The site keeps in your browser (“local storage”, not a cookie) the display theme and the language you chose, so you find them again on your next visit. These settings never leave your device, are not read by the server, and are erased with your browser's site data. They are strictly necessary for the service you asked for, which is why no consent is requested.

Third parties

• XposedOrNot (xposedornot.com) tells whether an address appears in a known breach. When you click “Check”, YOUR browser sends it the address you typed, directly, without going through our server; when you open the “Recent breaches” tab, it also asks it for its public breach catalogue. XposedOrNot therefore sees that address and your IP address. It states that it does not keep the addresses searched. Its results are shown with its name, as it asks.
• LeakCheck (leakcheck.io) tells whether an email address or a username appears in a known breach: the name and month of each breach, and the types of data exposed taken together — never the data itself. When you click “Check”, it is OUR server that queries it, at most one request per second for the whole site: it passes on 24 characters of the SHA-256 hash of your address, computed by your browser, or your username as you typed it. LeakCheck therefore sees our server's IP address, not yours. A hash is not anonymity: LeakCheck can recognise an address that its files already contain. It states that it does not keep searches. Its results are shown with the words “Powered by LeakCheck”, as it asks.
• Have I Been Pwned (haveibeenpwned.com) provides two things, always requested by YOUR browser, directly: the password test (Pwned Passwords) — your browser computes the SHA-1 hash of the password and sends only its first 5 characters out of 40, never the password — and the public catalogue of breaches (CC BY 4.0 licence), downloaded when you open the “Recent breaches” tab. Have I Been Pwned sees your IP address during these requests.
• Public lists, copied onto our server: 2FA Directory and its passkeys list (2factorauth; MIT and CC BY 4.0 licences), JustDeleteMe (MIT) and datarequests.org (CC0), reduced to the sites in the breach catalogues, as well as the zxcvbn-ts tool (MIT) and its English and French dictionaries (including word frequencies taken from OpenSubtitles by OPUS, ODC-BY licence). Your browser downloads them in full from our server, like the page itself: nothing you type or search for goes with them, and these projects do not see your visit. This information may be incomplete or out of date. The GDPR letter is prepared in your browser: we never send it; you send it yourself if you wish.

Advertising

This site shows no advertising at the moment, and therefore sets no advertising cookie. If it ever does, this page will say so, and a banner will ask for your consent before anything is set.

Your rights

You have the right to access, rectify, erase and object to the processing of data about you (articles 15 to 21 GDPR). Write to the publisher contact@rapidall.eu. You may also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

This page is a courtesy translation. Only the French version, Confidentialité, is authoritative.