// Legal

Privacy policy

Last updated: 2 November 2026

Who is responsible

The controller of the personal data described here is the company below. Write to us about anything in this policy.

Company

Darkeye Industries LLC

Privacy contact

[email protected]

This policy covers darkeye.io, including the blog at darkeye.io/blog. The products we operate under their own domains (HaveIBeenRansom, Breach.House, Connector, DarkManager) publish their own terms.

What we collect and why

• Contact form. Your name, email, company, role, the type of request and your message, plus the IP address and time of sending. We use them to answer you and to prevent abuse. The message is emailed to our team and a copy is kept on our server so it is not lost if email delivery fails. Basis: your request and our legitimate interest in answering it.
• Leak search on the home page. The term you type (an email, domain, phone number, username or similar) is sent to our HaveIBeenRansom index to return aggregate counts only, never the leaked records. Results are cached for 30 minutes so repeated searches do not hit the index again. Your IP address is used, in memory, to rate-limit searches. Basis: legitimate interest in providing the search securely.
• Blog newsletter. Your email address, only after you confirm it from the email we send (double opt-in). Basis: your consent; you can unsubscribe at any time.
• Blog reading statistics. When an article is read we count the view with the country, continent and operating system derived from the request. Your IP address is used only for that lookup and to avoid counting the same reader twice within a short time; it is not stored. No cookies are used for this. Basis: legitimate interest in knowing which reports are useful.
• Staff accounts. Authors and editors of the blog have accounts (user name, email, password hash). Readers do not need an account.
• Security and server logs. Our servers and our content-delivery provider process IP addresses and request details to deliver the pages and protect them from attacks and bots. Basis: legitimate interest in keeping the services secure.

Cookies and local storage

We do not use advertising or cross-site tracking cookies.

• Your theme (dark or light) and sound preferences are kept in your browser's local storage. They never leave your device.
• The blog sets a session cookie (de_blog_session, limited to /blog) only when you sign in or submit a form, for security (CSRF protection) and to keep you signed in.
• Forms are protected by Cloudflare Turnstile, a bot check run by Cloudflare under its own privacy terms.

Leaked data and the people in it

Our work is analysing data that criminal groups publish after attacks. On our public websites we describe incidents at the level of organisations and show aggregate figures. We do not publish personal data found in leaks, and screenshots are redacted before publication. If you believe a page of ours shows personal data about you, write to [email protected] and we will review it and remove it.

Who else processes the data

We use service providers for hosting, content delivery and security (Cloudflare), and email delivery. They process data only on our instructions and under data-processing terms. We do not sell personal data or share it for advertising.

Some of these providers operate outside your country. Where data leaves the European Economic Area or the United Kingdom, the transfer relies on adequacy decisions or the European Commission's standard contractual clauses.

How long we keep it

• Contact requests: as long as needed to handle your request and any relationship that follows from it.
• Newsletter: until you unsubscribe.
• Leak search: results stay in a 30-minute cache; the search term is not stored afterwards.
• Reading statistics: one record per view with country, continent and operating system, never the IP address.
• Security logs: only for the limited time needed to investigate abuse.

Your rights

You can ask for access to your data, its correction or deletion, the restriction of its use, or a copy in a portable format. You can object to processing based on legitimate interest and withdraw consent at any time. Write to [email protected]. You can also complain to your data-protection authority.

Children

Our services are meant for security professionals and are not directed at children.

Changes

When this policy changes we update this page and the date at the top.