Privacy Policy
Last updated September 10, 2026
This Privacy Policy explains how Have I Been Pwned handles information, advertising, and use by children. Have I Been Pwned is an unofficial educational guide app. Please read this policy before you continue using the app.
Summary
Have I Been Pwned is an unofficial educational guide app. It is not the official Have I Been Pwned website. It does not check emails or look up breaches. We do not collect emails or passwords. Favorites stay on your device. Ads are served by Google AdMob. This app is not directed to children under 13.
1. Unofficial status
Have I Been Pwned is an unofficial, independent Android app. It is not an official product of Troy Hunt, haveibeenpwned.com, or any other breach-notification, antivirus, or security company.
The app is not affiliated with, sponsored by, approved by, or endorsed by the official Have I Been Pwned website or any similar service. Names of third-party products or websites may appear only for educational explanation. Their use does not mean partnership or official support.
This policy applies only to the Have I Been Pwned mobile application.
2. This is a guide app
Have I Been Pwned is a reading and learning app. It teaches general online-security topics through short offline articles. It is a guide, not a scanner, not a monitoring tool, and not a live security service.
You can read guides about data breaches, how email breaches happen, what to do if an email may be exposed, strong passwords, password managers, two-factor authentication, password reuse, and phishing. You may save guides as favorites on this device with the heart button.
The app does not:
• check whether your email has been in a data breach
• look up, search, or download breach records
• scan your device, accounts, or passwords
• connect to the Have I Been Pwned API or any similar lookup service
• create user accounts or require a login
• give personal security scores or live alerts
All guide text is stored inside the app for education. It is not a substitute for official advice from a website, employer, bank, or security provider.
3. Information we collect
We do not require a login and we do not ask for your name, email address, phone number, or passwords. We do not collect, store, or transmit personal content that you type into this app, because the app has no forms for personal data.
Favorites are stored only on your device using local app storage. If you uninstall the app, those favorites are removed with it.
We do not operate our own analytics, crash-reporting, or marketing databases.
4. Advertising
Have I Been Pwned is free and is supported by ads served by Google AdMob.
We display:
• A banner advertisement at the bottom of the screen
• An occasional full-screen (interstitial) advertisement when you leave a guide
Ads are not inserted into the text of educational articles. Full-screen ads are limited in frequency so they are not shown every time you go back.
Google AdMob and its partners may collect and process device information in order to deliver, measure, and improve ads. This can include your advertising ID, IP address, device type, app activity related to ads, and approximate location derived from IP address. Some ads may be personalized based on Google’s advertising profile for this device.
We do not sell your personal information. We do not receive your name or email from AdMob as part of ordinary ad serving.
5. Advertising choices
You can limit or reset advertising identifiers in your Android settings (Google > Ads, or Privacy > Ads, depending on your device). You may also review Google’s advertising controls and opt-out tools in your Google account.
If you are offline, ads may not appear. Guide content remains available without an internet connection.
6. Children’s privacy
Have I Been Pwned is a general-audience educational app. It is not directed to children under 13 years of age, and we do not knowingly collect personal information from children under 13.
We do not ask children (or anyone) for names, emails, photos, or other personal details. We do not offer social features, chat, or user-generated profiles.
Because the app includes Google advertising, it is intended for users old enough to use a device with ads under applicable law, typically 13 years of age or older. Parents and guardians should supervise younger users and may use Android parental controls if they do not want ads or internet access on a child’s device.
If you are a parent or guardian and believe a child under 13 has used this app in a way that involved personal information, please contact us through the Google Play listing for Have I Been Pwned. We do not keep user accounts, so there is no child profile for us to delete. Uninstalling the app removes local favorites from the device.
7. Permissions
The app requests Internet and network-state access so that advertisements can load. It also uses the advertising ID permission required by Google Play for ads. Guide articles themselves do not need the internet.
8. Data retention and security
Local favorites remain on your device until you remove them or uninstall the app. We do not run a server that stores your reading history or personal data.
Information processed by Google for advertising is handled under Google’s own retention and security practices. We cannot delete data held by Google on your behalf; use Google’s privacy tools for that.
9. Third-party services
Advertising is provided by Google AdMob (Google LLC). Google acts as an independent controller for much of the advertising data it processes. Their terms and policies apply to ads shown in this app. We are not responsible for the content of third-party advertisements.
10. Changes to this policy
We may update this Privacy Policy if the app, advertising setup, or legal requirements change. The “Last updated” date at the top of this page will be revised when that happens. Continued use of the app after an update means you accept the revised policy.
11. Contact
For privacy questions about Have I Been Pwned, use the support or contact option on the app’s Google Play listing. We cannot reply to requests that ask us to look up a person by email, because this app does not store emails or user accounts.