Privacy Policy
Table of Contents
1. Overview
Who we are. GalaxyWarden is a service operated by BATECH LLC, a limited liability company registered in the United States, at 3154 Glendale Blvd #1234, Los Angeles, CA 90039-1830. "GalaxyWarden," "DoxxScan," and "Recent Breaches" are trade names of BATECH LLC. In this policy, "we," "us," and "our" mean BATECH LLC. BATECH LLC is the business that determines the purposes and means of processing described here (the "controller" under GDPR, the "business" under CCPA/CPRA).
GalaxyWarden provides security services that help users monitor, detect, and remediate data breaches and personal-data exposure affecting their online accounts and identities. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our services.
This policy applies to all users of GalaxyWarden, including visitors to our website and registered users of our breach monitoring services. For California residents, this notice also serves as our "Notice at Collection" under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).
- We collect data to provide breach monitoring, data-broker removal, and security recommendations
- We do not sell your personal information for money
- We share data with the service providers listed in Section 3 — the analytics and review tools named there, and nothing else. None of them is an advertising tag, so none of it is “sharing” for cross-context behavioral advertising under CCPA/CPRA.
- When you buy a removal product, we transmit the identifying information a data broker needs in order to delete you — on your instruction, under your signed authorization. See Section 3.
- We derive an approximate home/work location and place-pattern from your publicly visible Google Maps contributions when you use that feature. This is sensitive personal information and you can limit its use. See Section 2.
- You have rights to access, delete, and control your data
How We Source Data — Important Disclaimer
GalaxyWarden and DoxxScan™ do not crawl, scrape, or directly access third-party platforms such as Facebook, Twitch, Discord, PayPal, Twitter/X, Instagram, Steam, Reddit, or any other operator’s website or service. We do not log into platforms on your behalf, use platform APIs to enumerate accounts, or extract data from those services in any manner that could violate their Terms of Service.
When we report “exposure” or “link mapping” for a username, email, phone number, real name, or other identifier, the data we surface comes exclusively from one or more of the following lawful sources:
- Public records and public web pages — information that is openly available without authentication (public profile pages indexed by search engines, public WHOIS records, publicly-disclosed court filings).
- Publicly-disclosed data breaches and leaks — records exposed by third parties as part of historical security incidents, paste-site dumps, or stealer-log leaks. Aggregated from public corpus indexes such as Have I Been Pwned (HIBP) and similar publicly-documented breach data.
- Legally licensed third-party data sources — commercial threat-intelligence and breach-data providers (including but not limited to DeHashed and other licensed corpus aggregators) where we hold a paid subscription with documented permission to query the data for security-monitoring purposes.
We do not claim, suggest, or imply that any platform referenced in our marketing materials (Twitch, Discord, Steam, Kick, YouTube, etc.) shares data with us, partners with us, or has authorized us to access their systems. Platform names are referenced solely to describe the breadth of breach corpora we cross-reference on your behalf.
If you operate a platform referenced in our marketing and have questions about our data sources, contact support@galaxywarden.com.
2. Categories of Personal Information We Collect
In the past 12 months, we have collected the following categories of personal information as defined under CCPA/CPRA:
| Category | Examples | Sources | Business Purpose |
|---|---|---|---|
| Identifiers | Email address, username, phone number, gamertag and other aliases you ask us to monitor; Steam ID if you choose to link a Steam account | Directly from you during registration and profile setup | Account creation, breach scanning, exposure alerts, personalized security missions |
| Account Records | Plan and purchase level (free account, Deep Sweep, Protection, Family, or Signals), payment information (processed by third-party), account preferences | From you or payment processors | Manage subscriptions, provide tiered features, process transactions |
| Internet/Network Activity | Security habits (password reuse, 2FA usage), breach and exposure history, session data, and — if you use the gaming features — gaming habits (frequency, platforms) | From you (profile/onboarding), app usage, third-party breach intelligence providers | Risk scoring, AI security insights, mission generation, breach monitoring |
| Commercial Information | Removal products purchased, subscription and renewal history, credit purchases, and — if you use the gaming features — selected gaming platforms (Steam, Epic, etc.) and games monitored | From you (onboarding/profile updates) and from our payment processor | Customize services, analyze engagement, provide relevant recommendations |
| Inferences | Security risk scores, mission progress, completion rates, decay-based risk calculations | Derived from collected data and AI analysis | Provide personalized security recommendations, track improvement over time |
| Removal Profile Identity Data | Full legal name, previous names, current and previous street addresses, city, state, ZIP, date of birth, phone number, and your typed signature on a Third-Party Authorization (TPA) | Directly from you, after you purchase a removal product | File authorized-agent opt-out and deletion requests with data brokers on your behalf; match you against broker records; maintain the CCPA §1798.135(c) authorization audit trail |
| Precise Geolocation & Location Inferences (sensitive) | Latitude/longitude of an approximate home cluster and work cluster, an uncertainty radius, an inferred neighborhood, and a list of "sensitive place" pins we classify as medical, school, religious, or family based on the place name | Derived by us from your publicly visible Google Maps contributor profile (reviews you have published publicly), combined with city/address strings already present in your breach exposure records | Show you, and only you, what a stalker or doxxer could work out about your daily pattern from your own public activity — so you can delete those reviews. Not used for advertising, profiling, or any purpose other than showing you your exposure. |
| Analytics & Advertising Identifiers | Cookie and pixel identifiers, page views, clicks, referrer, device/browser, IP address, session replays (with inputs masked), and hashed email for conversion measurement | Automatically, via the analytics and advertising tags listed in Section 3 | Measure product usage, diagnose bugs, and measure the performance of our own advertising |
Sensitive Personal Information
CCPA/CPRA treats a short list of data types as sensitive personal information, including precise geolocation and information revealing health, religious beliefs, or a person's racial or ethnic origin. We want to be direct about the one place where we generate sensitive personal information, because it is central to a feature you may choose to use.
- What we derive: an approximate home location and an approximate work location, each expressed as a latitude/longitude with an uncertainty radius (roughly 500m to 5km depending on how much public data exists), an inferred neighborhood name, and a list of places you have publicly reviewed that we classify by keyword as medical, school, religious, or family. Classifying a place as, for example, a clinic or a place of worship is an inference that can reveal health or religious information, so we treat the whole output as sensitive.
- Where it comes from: your own Google Maps contributor page — the reviews you have chosen to publish publicly. We read the same page any member of the public can read. We do not log into Google as you, we do not use private Google account data, and we do not use device GPS, Wi-Fi, or cell-tower location. We never track your live location.
- Why we do it: this is exactly the exercise a doxxer performs. Showing you the result — a circle around your neighborhood and a pin on the clinic you reviewed — is the only way to make the exposure real enough to act on. Every such report includes a link to delete the underlying reviews.
- How long we keep it: the scraped review payload and computed inference are cached for up to 30 days, then discarded and only re-derived if you run the feature again. It is deleted with your account.
- What we never do with it: we do not sell it, we do not share it for advertising, we do not send it to advertising or analytics providers, and we do not use it to build a profile of you for any purpose beyond showing you your own exposure.
- Your right to limit: you may direct us to limit the use of this sensitive personal information to what is strictly necessary to deliver the service you asked for, and you may direct us to delete it. Use the "Limit Use of Sensitive Personal Information" control on our Do Not Sell or Share page, or email privacy@galaxywarden.com. Limiting or deleting it disables the location-exposure report; nothing else about your account is affected.
Date of birth collected in a Removal Profile is also treated as sensitive and is used for one purpose only: matching you against broker records so a deletion request validates. It is not sent to our AI provider, and it is purged on the schedule in Section 6.
We do not otherwise seek out sensitive personal information. We do not ask for your Social Security number, government ID number, financial account credentials, racial or ethnic origin, union membership, sexual orientation, or the contents of your private communications. Breach records surfaced to you may themselves contain sensitive values that a third party exposed — we display those to you as evidence of your exposure and do not use them for any other purpose. If you believe we hold sensitive information we should not, contact us and we will delete it.
3. How We Use and Share Your Information
The free scan, and the email we send you
When you submit an email address, phone number, username or gamertag for a free scan, you are asking us to check it against breach and data-broker sources and to tell you what we find. We use that identifier to run the check, we email the result to the address you give us, and we keep a record that you asked for it — the wording you were shown, the time, and the IP the request came from — so we can show what was agreed and when.
That result email is part of the service you requested. It is not marketing. Marketing email — tips, product updates, anything we send you because we would like to, rather than because you asked — is a separate, optional permission with its own tick box, default off. Declining it never affects your scan, and one click unsubscribes you at any time.
We do not sell the identifier you scan, and we do not share it with data brokers. See “Service Providers We Share Data With” below for the processors that do see it in order to run the check and deliver the email.
How We Use Your Data
- Service Delivery: Perform breach scans, generate security missions, send alerts and notifications
- AI-Powered Insights: Generate personalized security recommendations using AI analysis
- Account Management: Process subscriptions, manage credits, award badges
- Service Improvement: Analyze aggregate, anonymized usage patterns to improve features
- Legal Compliance: Respond to legal requests and protect our rights
Service Providers We Share Data With
This is the full list of third parties that receive personal information from us, and what each one receives. Some are used only on certain surfaces or only when a feature is enabled; where that is the case, we say so.
| Provider | Purpose | Data Shared |
|---|---|---|
| Have I Been Pwned (HIBP) | Check whether an email you register appears in known breaches | Email address (hashed via k-anonymity where the endpoint supports it) |
| DeHashed — DoxxScan™ Intelligence | Deep breach scanning for exposed credentials, addresses, and phone numbers | The identifiers you register for monitoring — email, username, phone, name, address — used as search queries |
| xAI (Grok) — AI provider | Generate security insights, remediation steps, opt-out email drafts, and Concierge / live-chat replies |
We do not send xAI your name, email address, phone number, street address, username, or IP address. Before a prompt leaves our servers, each of those values is replaced with an opaque placeholder token — for example Never sent, under any circumstance: passwords, password masks or previews, password hashes, Social Security numbers, date of birth, and payment data. There is no token for these; they are withheld entirely and referred to by field name only. What is sent: your subscription tier and plan state; numeric account statistics (how many exposures, how many breaches); for each exposure, the data type (e.g. “email,” “phone”), its risk level, and the name of the source breach; scrubbed remediation descriptions; classifications of broker replies; and, in live chat, exposure counts, severity buckets, up to three breach names, and the URL of the page you are on (scrubbed). What you type is sent as written. When you use the Concierge chat or the live-chat assistant, the text of your messages goes to xAI, minus a few high-risk patterns we redact automatically (Social Security numbers, payment-card numbers, password hashes). Treat the chat box like any message to a third-party AI provider: it will read what you write. See the note below on xAI's data-use terms. |
| Data brokers & people-search sites (634 sites across 582 companies) | Only when you purchase a removal product and sign an authorization. File opt-out/deletion requests so the broker can find and delete your record | Your name, current and previous addresses, date of birth, phone, and the signed Third-Party Authorization PDF — sent only to the brokers in your removal scope, only to effect your deletion request. See "About data brokers" below. |
| Stripe | Process payments and subscriptions | Payment details go directly to Stripe; we store only the Stripe customer/subscription ID and the last four digits of the card. We never store full card numbers. |
| SendGrid | Send breach alerts, verification links, receipts, and broker correspondence | Recipient email address, subject, and full message body |
| Render | Application hosting and managed PostgreSQL database | All application data we store, plus request metadata (IP address, headers, paths). Render is the physical custodian of our database. |
| Cloudflare | CDN and edge delivery, bot and abuse protection (including Turnstile challenges where enabled), and performance monitoring | HTTP request metadata: IP address, headers, user agent, requested paths, and challenge-solve tokens |
| PostHog | Product analytics and session replay | Pageviews, feature events, a persistent analytics ID, IP address, device/browser, and session replays. Replays are recorded with all form inputs and passwords masked, and elements we mark as sensitive suppressed. |
| Google Analytics & Google Ads | Traffic measurement and conversion measurement for our own advertising | Cookie/pixel identifiers, pageviews, conversion events, IP address, device/browser, referrer |
| Google AdSense (recentbreaches.com only) | Serve display advertising on our public breach-news site | Ad cookie identifiers, IP address, and page context for visitors to recentbreaches.com. AdSense is not loaded on galaxywarden.com or on any logged-in surface. |
| LinkedIn Insight Tag | Measure conversions from LinkedIn advertising | Cookie/pixel identifier, IP address, page and event data. Not currently loaded on any page — the tag is configured but disabled, and no rendered page on this site references it. Listed so this table stays complete if it is turned back on. |
| Meta (Facebook) Pixel | Measure conversions from Meta advertising | Cookie/pixel identifier, IP address, page and event data. Not currently loaded on any page — the tag is configured but disabled, and no rendered page on this site references it. Listed so this table stays complete if it is turned back on. |
| Trustpilot | Collect verified customer reviews and display review widgets | Your email address and order reference, so Trustpilot can invite you to review us after a purchase |
| CapSolver | Solve CAPTCHA challenges encountered by our scanners while checking data-broker sites for your listing | The CAPTCHA challenge itself (site key, page URL, challenge token). No customer personal information is sent to CapSolver. |
A note on our AI provider. We use xAI's business API. Under xAI's Enterprise Terms of Service, xAI acts as a processor on our behalf, does not use content submitted through the API to train its foundation models or other AI systems, and deletes submitted content no later than 30 days after the end of the session in which it was submitted.
- It cannot see who you are. Your name, email, phone, address, username, and IP never leave our servers in a readable form. Where the model needs to refer to one of your exposed values, it gets a placeholder token like
<EMAIL_1>and we swap the real value back in on our side before you see the answer. - It cannot see your secrets. Passwords, password masks and previews, hashes, Social Security numbers, date of birth, and payment data are never transmitted — not even in masked form, because a mask still leaks length and structure.
- It can see the shape of your exposure. Your plan, counts, per-exposure data types and risk levels, the names of the breaches involved, scrubbed remediation text, broker-reply classifications, and (in live chat) the page you are on.
- It can see what you type. Your chat messages are forwarded as written, apart from Social Security numbers, card numbers, and password hashes, which we strip automatically. If you paste something into the chat box, assume the AI provider receives it. Every other part of the Service works without the chat assistants.
A note on analytics. We do not run advertising tags. There is no Google Ads tag, no Google Analytics, no LinkedIn Insight tag and no Meta pixel anywhere on this site, so nothing here shares your personal information for cross-context behavioral advertising. You can check that for yourself: view the source of any page and search for googletagmanager — it is not there. The two third-party tools we do run are named above, both are loaded only after you consent, and neither follows you to other websites. You can turn them off on our Do Not Sell or Share My Personal Information page, or send a Global Privacy Control signal from your browser, which we honor automatically.
- Sell your personal information — we do not exchange it for money, ever
- Disclose your breach results, exposure records, removal profile, or location inferences to advertisers, analytics providers, or anyone else for their own purposes
- Use your data for purposes unrelated to our security services
- Give your information to a data broker so the broker can add it to their database, resell it, or market to you
Our core product removes you from data brokers. Filing a removal request necessarily means telling the broker who you are, because a broker cannot delete a record it cannot match. So, to be precise about what we do:
- We never sell, rent, license, or otherwise hand over your personal information to a data broker or anyone else for their commercial purposes.
- We do transmit the identifying information necessary to file an opt-out or deletion request — typically your name, current and previous addresses, date of birth, phone number, and the signed Third-Party Authorization you gave us — and we do so only: at your instruction, after you purchase a removal product; under your signed authorization naming us as your privacy agent; and only to the specific brokers in your removal scope that need it to process the request.
- Every one of those sends is logged in your dashboard, and you are copied on the correspondence. You can see exactly what was sent, to whom, and when.
- You can stop this at any time by cancelling before filings go out or by contacting privacy@galaxywarden.com. We cannot recall a request a broker has already received.
4. Your California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have the following rights under the CCPA/CPRA (exercisable up to twice per 12-month period, free of charge):
| Right | Description |
|---|---|
| Right to Know/Access | Request disclosure of categories and specific pieces of personal information we've collected about you, sources, purposes, and third parties we've shared with. |
| Right to Delete | Request deletion of your personal information (subject to legal exceptions). |
| Right to Correct | Request correction of inaccurate personal information. |
| Right to Opt-Out of Sale/Sharing | Direct us not to sell or share your personal information. We do not sell personal information for money. We do run analytics and advertising measurement tags that may constitute "sharing" — opt out on our Do Not Sell or Share page, or send a Global Privacy Control signal. |
| Right to Limit Sensitive Data Use | Limit use of sensitive personal information to what is necessary to deliver the service. This applies to the location inferences described in Section 2 (approximate home/work location and medical, school, religious, or family place pins derived from your public Google Maps contributions) and to a date of birth held in a Removal Profile. Exercise it on our Do Not Sell or Share page or by emailing privacy@galaxywarden.com. |
| Right to Non-Discrimination | We will not deny services, charge different prices, or provide different quality based on exercising your rights. |
How to Exercise Your Rights
You can exercise your rights through any of these methods:
- In-App: Go to Account Settings Data to export or delete your data
- Email: Send a request to privacy@galaxywarden.com
- Online Form: Submit via our Privacy Request Form
Verification: We will verify your identity using your email address and account information. Response time is 45 days (extendable to 90 days for complex requests). If we deny a request, you may appeal by contacting us.
Authorized Agents: You may designate an authorized agent to make requests on your behalf. Agents must provide written authorization and proof of identity.
5. Your General Privacy Rights
Regardless of your location, you have the following rights:
- Access: Request a copy of your personal data
- Rectification: Request correction of inaccurate data
- Erasure: Request deletion of your data ("right to be forgotten")
- Portability: Receive your data in a structured, machine-readable format
- Withdraw Consent: Withdraw consent where processing is based on consent
- Object: Object to certain processing activities
For EU/EEA residents under GDPR, our legal basis for processing includes: contract performance (providing services), legitimate interests (improving security), and consent (marketing communications).
6. Data Retention
We keep personal information only as long as it is doing a job. Specifically:
- Active accounts: your account record, monitored identifiers, and breach/exposure results are retained while your account is active, so we can re-scan and show you change over time.
- Removal Profile — one-time-use fields: your date of birth, phone number, previous addresses, and previous names are used to match you against broker records at filing time. We purge them 180 days (6 months) after you enroll in a removal product. The delay exists because brokers can dispute or re-challenge a request for up to 60–90 days and we need the original data to answer them.
- Removal Profile — fields we keep: your email, name, and current address remain while your account is active, because every re-scan needs them to tell your listing apart from a stranger with a similar name.
- Opt-out correspondence: the verbatim body of each opt-out email we send on your behalf is redacted after 90 days and replaced with a SHA-256 hash of the original. The hash lets us prove exactly what we sent if a broker disputes it, without keeping the personal information in the text. The metadata — which broker, when, what status — is kept as your audit trail.
- Authorization records: your signed Third-Party Authorization and the consent timestamp and IP address are retained for at least 24 months, because CCPA §1798.135(c) requires us to be able to prove we were authorized to act as your agent.
- Location inference cache: the Google Maps contribution payload and derived location inference are cached for up to 30 days, then discarded.
- Deleted accounts: when you delete your account we remove your personal data from our production systems within 30 days.
- Backups: our database is hosted and backed up by our infrastructure provider (Render) on their standard rotating schedule. We do not operate a separate backup-purge process, so a copy of deleted data can persist in provider backups until those backups rotate out. Backups are access-controlled and are used only for disaster recovery — we do not restore individual records from them to reconstitute deleted accounts.
- Legal requirements: some records (payment and tax records, abuse and fraud investigations) may be retained longer where the law requires it.
- Aggregate data: aggregate, de-identified analytics that cannot be linked back to you may be retained indefinitely.
7. Security Measures
We implement reasonable administrative, technical, and physical safeguards to protect your information:
- Encryption in transit: all traffic to and from our service is encrypted with HTTPS/TLS.
- Encryption at rest: our database and disks are encrypted at rest by our hosting and database provider (Render) as part of their managed platform. To be precise: we rely on provider-level disk and database encryption. We do not currently apply an additional application-level or field-level encryption layer on top of it, and we will not describe our storage as "end-to-end" or "field-encrypted," because it is not.
- Access Controls: Role-based access with multi-factor authentication for admin systems
- Password Security: Your GalaxyWarden account password is stored only as a salted one-way hash using an industry-standard algorithm. We cannot read it. Passwords found in third-party breach data are never stored in plaintext or sent to our AI provider.
- Regular Audits: Security practices reviewed and updated regularly
- Incident Response: Procedures in place to respond to data breaches
While we strive to protect your data, no system is 100% secure. We encourage you to use strong, unique passwords and enable 2FA on your account.
8. Children's Privacy
GalaxyWarden is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately at privacy@galaxywarden.com, and we will promptly delete such information.
For users between 13-16 in California, we require opt-in consent before any sale or sharing of data (though we do not sell or share data for advertising).
9. Do Not Sell or Share My Personal Information
googletagmanager; it is not there. The only third-party tools on this site are PostHog, and Trustpilot, both consent-gated and neither used for advertising. The opt-out below still applies to those, and a Global Privacy Control signal still suppresses them.
What is never shared with an advertiser or analytics provider: your breach results, your exposed credentials, your removal profile, your broker correspondence, and your location inferences. Advertising tags do not load on pages that display your results.
You can manage your privacy preferences at any time on the Do Not Sell or Share page or in your Account Settings. If our practices change, we will update this policy and give notice.
We honor Global Privacy Control (GPC) browser signals as valid opt-out requests.
10. Contact Us
For questions about this Privacy Policy or to exercise your rights, contact us:
- Entity: BATECH LLC (operating as GalaxyWarden), 3154 Glendale Blvd #1234, Los Angeles, CA 90039-1830, United States
- Email: privacy@galaxywarden.com
- In-App: Account Settings Data
We will respond to inquiries within 45 days. If you are not satisfied with our response, you may file a complaint with your local data protection authority or the California Privacy Protection Agency.
Policy Updates
We review and update this policy at least annually or when our practices change. Material changes will be notified via email or in-app notification. Continued use after changes constitutes acceptance of the updated policy.