Terms of Service

1. Acceptance of Terms

GalaxyWarden is a service operated by BATECH LLC, a limited liability company registered in the United States, with its address at 3154 Glendale Blvd #1234, Los Angeles, CA 90039-1830. "GalaxyWarden," "DoxxScan™," "Deep Sweep," and "Recent Breaches" are trade names and product names of BATECH LLC. In these Terms, "GalaxyWarden," "we," "us," and "our" mean BATECH LLC, and "Service" means the websites, applications, and services BATECH LLC offers under those names.

By accessing or using the Service, you agree to be bound by these Terms of Service and our Privacy Policy, forming a binding agreement between you and BATECH LLC. If you do not agree, do not use the Service.

Running a free scan. When you submit an email address, phone number, username or gamertag for a free scan, you are asking us to check it against breach and data-broker sources and to tell you what we find. By submitting a scan you accept these Terms and the Privacy Policy. We email the result to the address you provide, and we keep a record of the request — the wording shown to you, the time, and the originating IP — so it is clear what was agreed and when.

That result email is part of the service you asked for and is not marketing. Marketing email — tips, product news, anything we send because we would like to rather than because you asked — is a separate, optional permission with its own tick box, default off. Declining it never affects your scan, and one click unsubscribes you at any time.

2. Service Description

GalaxyWarden is a personal privacy and exposure-monitoring service. It begins with a free exposure scan: you give us an identifier you own — an email address, username, phone number, or gamertag — and we check it against publicly-disclosed breach corpora and licensed breach-intelligence providers, then show you what is exposed and where in a DoxxScan™ report. From there:

• Deep Sweep (one-time purchase) files authorized-agent opt-out and deletion requests on your behalf with the data brokers and people-search sites in our directory, under a Third-Party Authorization you sign. See Section 10A.
• Protection and Family (subscriptions) add continuous monitoring that re-checks your identifiers as new breaches are indexed and alerts you when one surfaces, ongoing broker re-filing and re-scanning, and the AI Concierge described in Section 10B.
• Signals (subscription) is our business-tier breach-intelligence product. Free and consumer accounts are licensed for personal use only — see Section 3A.
• We also publish breach, leak and ransomware coverage at Recent Breaches (recentbreaches.com), which is editorial and free to read.

Some accounts additionally use optional gaming features — a linked Steam account, game-asset and inventory scanning, and platform alias monitoring. Those are additional features of the service described above, not the service itself.

What the Service does not do. We do not delete breach records. Once a record has been published in a breach corpus it is permanently public and outside any single party’s control; Section 10A lists in full what removal can and cannot reach. We do not guarantee that any data broker will honor a request, nor any timeline for one. We rely on third-party breach-intelligence and AI providers to deliver these features; what is shared with each is disclosed in Section 10D.

3. User Accounts

• You must provide accurate information during registration
• You are responsible for maintaining account security
• You must be at least 13 years old to use the Service
• One account per person; no sharing or selling accounts

3A. Free Accounts — Personal, Non-Commercial Use

A free GalaxyWarden account is licensed to you for personal, non-commercial use only. It is meant for an individual looking after their own exposure and reading our published breach coverage for their own purposes.

A free account may not be created or used by, for, or on behalf of a company, employer, client, government body, or other organisation. That includes using it to monitor or research an organisation’s exposure, to do work you are paid or employed to do, to inform a commercial product, report, or service, or to redistribute what you obtain from it inside an organisation. Business, professional, and organisational use requires a paid business-tier subscription — GalaxyWarden Signals.

Personal use does not stop being personal because your employer benefits incidentally. An individual scanning their own work email address to protect themselves is personal use. What requires a business plan is use for an organisation’s purposes rather than your own.

Paid consumer subscriptions (Protection, Family) are likewise licensed for personal and household use.

If you are not sure which side of this line you are on, email support@galaxywarden.com and ask — we would rather answer than have you guess. Where an account is being used for business purposes, we may ask you to move to a business plan, and we may suspend or terminate an account whose use these Terms do not permit.

4. Subscriptions & Payments

Paid subscriptions (Protection and Family for personal and household use; Signals for business and organisational use — see Section 3A) provide additional features. Subscriptions auto-renew unless cancelled. Refunds are handled per our Refund & Service Guarantee, which is the single governing statement of our refund terms for every GalaxyWarden SKU — where any other page conflicts with it, the Refund & Service Guarantee controls. We reserve the right to change pricing with notice.

5. Breach Data Usage & Authorization

Authorization Certification: By using GalaxyWarden's breach monitoring services and by ticking the attestation checkbox presented at the time you add identifiers to monitoring, you certify and represent that:

• You are searching for breach information related to email addresses, usernames, phone numbers, names, and physical addresses that you own or have explicit authorization to monitor.
• You will not use this Service to investigate, monitor, or access information about third parties without their consent.
• You are at least 18 years of age or have parental/guardian consent to use breach monitoring services.
• Any information obtained through this Service will be used solely for your personal security purposes.

Attestation enforcement: The Service enforces this warranty via an attestation checkbox at every identifier-entry surface. Submissions that omit the attestation are rejected server-side. A 30-day swap cooldown is also enforced per account (14 days for Protection subscribers) to deter cycling through different identifiers to monitor people you do not have authorization to monitor.

Data Sources & Accuracy: Breach data is sourced from publicly disclosed security incidents and third-party providers. GalaxyWarden does not guarantee the completeness, accuracy, or timeliness of breach data. The presence or absence of data in our system does not definitively indicate whether your information has or has not been compromised.

User Responsibility: You are solely responsible for:

• Verifying that accounts you monitor belong to you
• Taking appropriate action based on breach notifications
• Any consequences resulting from your use or misuse of breach data
• Compliance with all applicable laws regarding data access and privacy

Prohibited Uses: You may NOT use breach data to:

• Stalk, harass, or intimidate any person
• Gain unauthorized access to any account or system
• Attempt to impersonate or defraud any person
• Violate any local, state, national, or international law

Violation of these terms may result in immediate account termination and potential legal action.

6. Acceptable Use

You agree not to:

• Use the Service for illegal purposes
• Attempt to access other users' accounts
• Interfere with or disrupt the Service
• Reverse engineer or exploit the Service
• Use automated tools to access the Service without permission

7. Intellectual Property

All content, features, and functionality are owned by GalaxyWarden and protected by intellectual property laws. You may not copy, modify, or distribute our content without permission.

8. AI-Generated Content Disclaimer

GalaxyWarden uses artificial intelligence (including xAI/Grok) to generate personalized security insights, remediation mission steps, and risk assessments. AI-generated recommendations are provided for informational purposes only and should not be considered professional cybersecurity advice.

We do not guarantee the accuracy, completeness, or suitability of AI-generated content. Users should exercise independent judgment when acting on AI recommendations. GalaxyWarden is not responsible for any consequences resulting from following AI-generated advice.

9. DoxxScan™ Data Authorization

Premium features include "DoxxScan" capabilities powered by third-party breach intelligence providers. By using DoxxScan features, you authorize GalaxyWarden to:

• Query external breach databases using your email address and associated identifiers
• Store and display breach results associated with your account
• Generate remediation missions based on discovered exposures
• Display partially redacted credentials found in breach databases for verification purposes

DoxxScan data is provided "as-is" from third-party sources. GalaxyWarden does not independently verify breach data and makes no guarantees about its accuracy or completeness.

10. Referral & Affiliate Program

GalaxyWarden offers referral and affiliate programs subject to the following terms:

• Commission Structure: Commission rates vary by tier (Starter 5%, Pro 10%, Elite 15%, Partner up to 25%, Enterprise up to 50%). Rates are subject to change with 30 days notice.
• Payouts: Commissions are paid via account credit, USD bank transfer, or cryptocurrency at GalaxyWarden's discretion. Minimum payout threshold is $50 (or equivalent). Enterprise affiliates may negotiate custom payout terms.
• Bulk Purchases: Enterprise affiliates may pre-purchase subscriptions in bulk. Commission on bulk purchases is calculated at the agreed enterprise rate and paid upon receipt of payment.
• Tax Obligations: Affiliates are solely responsible for reporting and paying taxes on commission income. GalaxyWarden will issue 1099 forms (or equivalent) for U.S. affiliates earning $600 or more per calendar year.
• Prohibited Practices: Self-referrals, fraudulent signups, misleading advertising, spam, or any promotion that violates applicable laws will result in immediate termination and forfeiture of unpaid commissions.
• Termination: Either party may terminate the affiliate relationship at any time. Unpaid commissions for valid referrals will be paid out within 90 days of termination.

10A. Data-Broker Removal & Opt-Out Drafting Authorization

GalaxyWarden provides a Data-Broker Removal dashboard at /protection/broker-removal that ranks data brokers most likely to hold your personal information, surfaces verified opt-out methods per broker (email, web form, fax), and (Protection tier only) drafts opt-out request bodies using AI on demand.

Agency authorization — required before drafting: Before GalaxyWarden will draft an opt-out request that contains your name and address, you must affirmatively tick the attestation: “I am the person named above and authorize GalaxyWarden to draft opt-out requests on my behalf to the data brokers listed below.”

By ticking that attestation you represent and warrant that:

• The first name, last name, city, and state you provide in your Removal Profile are your own.
• You authorize GalaxyWarden to act as your privacy agent under California Civil Code §1798.135(c) (and equivalent provisions in other jurisdictions) to submit opt-out and deletion requests to data brokers on your behalf.
• You will not submit opt-out requests in another person’s name. Doing so may constitute identity fraud under U.S. and EU/UK law and is grounds for immediate account termination.

How requests are sent (WS12.585.120): When you authorize broker removal, GalaxyWarden sends an authorized-agent email to the broker from optout@removals.galaxywarden.com. If you’ve opted in to receive copies, you will be CC’d on the email so you can see the broker’s response. The broker can see you are a party to the request and can route any identity-verification challenge directly to you via the email thread. Some brokers may still send their verification link to your email of record on file with them; in that case you receive it as the named consumer and you click through.

No guarantee of removal. GalaxyWarden does not guarantee that any given broker will honor a removal request, nor any specific timeline for processing. Brokers operate under varying state laws (CCPA, CPRA, VCDPA, CTDPA, etc.) and individual policies; some require additional identity verification steps you must complete personally on their site, and a small number do not honor authorized-agent requests at all. Our service does its best to maximize success per broker but the outcome is ultimately controlled by the broker.

Manual verification may be required. Some brokers send identity-verification challenges (clickable confirmation links sent to your email of record, telephone callbacks, or photo-ID upload requests). These steps can only be completed by you. We surface them in your dashboard and email you when they occur.

If a broker pushes back, we step in. If any broker rejects, ignores, or escalates your request, reply to the email thread (or contact support@galaxywarden.com) and we will personally take it on — whether that means drafting a follow-up, sending the broker a CCPA right-to-cure notice, or escalating to the state attorney general’s office. The base $29 service covers automated submissions; our human follow-up assistance is included at no additional cost where reasonable.

Broker catalog accuracy: Opt-out URLs, methods, and email recipients are sourced from each broker’s officially-published privacy or opt-out page at the time of catalog assembly. Brokers change these endpoints from time to time; we periodically verify them but do not guarantee a working URL at any given moment. If you encounter a broken or outdated opt-out endpoint, please report it via /report-abuse or to support@galaxywarden.com.

Scope of broker removal — what this service does and does not cover. The Data-Broker Removal service (whether purchased one-time as Deep Sweep, the $29 one-time cleanup, or included with a Protection subscription) is limited to data-broker and people-search sites — the for-profit aggregators in our directory whose business model is republishing your name, address, phone, and relatives. It does not and cannot remove:

• Publicly-disclosed breach corpora (e.g. records indexed in Have I Been Pwned, DeHashed, or similar paid breach databases). Once a record has been published in a breach corpus it is permanently public; the data has been copied, mirrored, and re-hosted by independent parties and is not within any single party’s control to retract.
• Paste-site dumps (Pastebin, Ghostbin, archive.today snapshots of leaks) and screenshots of leaked data hosted on third-party image / forum sites.
• Dark-web marketplaces and forums (Tor-hidden services, private Telegram dump channels, criminal-only forums). These operate outside the legal frameworks (CCPA, GDPR, etc.) that data brokers are subject to, and no removal mechanism exists.
• Stealer-log leaks harvested from malware infections of third-party devices.
• Search-engine cache or independent crawlers that have already indexed a broker page before the broker honors the removal request. The broker is responsible for de-indexing requests to search engines after they remove a record; we cannot directly force a third-party search engine to drop a snapshot.

For these unrecoverable exposures, what GalaxyWarden provides instead is visibility, remediation guidance, and continuous monitoring: your DoxxScan report shows you exactly what is exposed and where, your AI Concierge generates a custom remediation playbook (which passwords to rotate, which accounts to lock down, which identifiers to retire, which credit monitoring to enable), and a Protection subscription continuously watches for new exposures and walks you through fresh remediations as they happen. Continuous breach monitoring and Concierge-guided remediation are not part of the one-time $29 Deep Sweep purchase and require an active Protection subscription.

10B. AI Concierge Actions (Protection tier)

Protection subscribers have access to three AI Concierge actions:

• Run a fresh chain crawl — on-demand recompute of your monitored-credential chain across the breach corpora. Idempotent within a 24-hour window.
• Draft an opt-out email — generates a request body for a specific broker; subject to Section 10A above.
• Personalize a playbook step — generates a 2-3 sentence remediation recommendation tailored to a specific exposure on your account.

Rate limits: AI Concierge actions are capped at 10 per 24-hour rolling window per account. Attempts above the cap are rejected with a clean error response. The cap protects against runaway API costs and abuse; users with legitimate need for more headroom may contact support.

Credential isolation: GalaxyWarden uses a third-party AI provider (xAI/Grok) to power these actions. We never transmit your raw credentials. Specifically, for the three Concierge actions listed above:

• Passwords (plaintext or hashed), Social Security numbers, dates of birth, credit-card numbers, raw breach records, and the full text of any other sensitive credential are never included in prompts sent to the AI provider.
• For opt-out email drafting, the AI is instructed to write the body with placeholder tokens ({{full_name}}, {{street_address}}, etc.); your actual name and address are substituted on our server after the AI response is received. The AI provider does not see your real name or address for these requests.
• For playbook-step personalization, the AI receives metadata only (service name, severity tier, breach year, exposed field types like “email” or “password” without values) and an instruction not to reference any specific credential value.
• A defensive guard scans every assembled prompt for credential shapes (hash patterns, SSN, credit card) and refuses to fire if any are detected.

The Concierge chat assistants — read this. Separately from the three actions above, GalaxyWarden offers conversational AI assistants (the Concierge chat and the site live-chat assistant). To answer accurately rather than hallucinate, those assistants are sent a grounding context about your own account before each reply. That context does not contain your name, email address, phone number, street address, username, or IP address: every such value is replaced with an opaque placeholder token (for example <EMAIL_1>) before transmission and substituted back on our server after the model replies. What the context does contain is your subscription tier and plan state, numeric account statistics, the data type and risk level of each exposure together with the name of the source breach, scrubbed remediation descriptions, broker-reply classifications, and — in live chat — exposure counts, severity buckets, up to three breach names, and the (scrubbed) URL of the page you are on. Passwords, password masks or previews, password hashes, Social Security numbers, dates of birth, and payment data are never sent in any form.

What you type is sent as written. The text of the messages you send to a chat assistant is forwarded to the AI provider, minus high-risk patterns we redact automatically (Social Security numbers, payment-card numbers, password hashes). Do not paste credentials or secrets into the chat box. If you would rather nothing at all reach the AI provider, do not use the chat assistants; every other part of the Service works without them.

You agree to use AI Concierge outputs as drafts, not finished communications. Review every generated email or recommendation before acting on it. AI-generated content is provided “as is” under Section 11 and Section 8 above; we make no warranty as to accuracy, appropriateness, or legal suitability.

Audit log: Every AI Concierge action your account fires is recorded in an internal audit log (action name, hash of arguments, result status, timestamp). The audit log helps us detect abuse, surface bugs, and respond to authorized inquiries.

10C. Third-Party Abuse Reports & Takedown Process

If a credential (email, phone, name+address) that you own is being monitored on GalaxyWarden without your authorization, you may submit a third-party abuse report at /report-abuse. You do not need to be a user of GalaxyWarden to submit a report.

What we do upon receiving a report:

• We will review the report within 72 hours of receipt and contact the reporter at the email address provided to confirm ownership of the contested credential.
• If we verify the reporter is the legitimate owner of the credential, we will deactivate the offending monitoring subscription and notify the subscriber of the takedown by email.
• The contested credential will be added to a temporary block list to prevent re-monitoring of that specific value for at least 90 days; longer at our discretion if a pattern of abuse is observed.
• We may, at our discretion, terminate the offending account, refund the subscriber pro-rata (or refuse to refund where bad-faith abuse is established), and refer the matter to law enforcement where the facts support such referral.

Rate limit: The abuse-report endpoint accepts up to 20 submissions per day per IP address. Reports submitted from the same IP that we determine to be in bad faith may be deprioritized or referred to abuse-of-process review.

Submitting a knowingly false abuse report may itself violate these Terms and applicable laws. We document the IP address and user-agent string of every submission for this reason.

10D. Data Sharing with Third-Party Service Providers

GalaxyWarden depends on a small number of third-party service providers to deliver its features. This section discloses what data is shared with each and under what conditions.

Have I Been Pwned (HIBP): We send the email addresses you register for monitoring to HIBP’s paid Pwned API to confirm whether those addresses appear in new breaches added to HIBP’s index. We do not send any other field types to HIBP (no phone, name, address, password, or hash). HIBP’s privacy policy applies to data submitted to their API.

DeHashed: We send identifiers you register for monitoring (email, username, phone, name, address) to DeHashed’s licensed API to retrieve breach intelligence. Returned records are stored on GalaxyWarden infrastructure and surfaced in your DoxxScan report. We hold a paid subscription with DeHashed and use the API under their permitted-use policy for security-monitoring purposes.

xAI / Grok: AI Concierge actions, the Concierge chat, and the site live-chat assistant send prompts to xAI’s Grok API. We do not send xAI your name, email address, phone number, street address, username, or IP address: those values are replaced with opaque placeholder tokens (for example <EMAIL_1>) before transmission and substituted back on our server after the reply is received. We never send passwords, password masks or previews, password hashes, Social Security numbers, dates of birth, payment data, or the full text of any breach record, in any form. What we do send is: your subscription tier and plan state; numeric account statistics; the data type, risk level, and source breach name for each exposure; scrubbed remediation descriptions; broker-reply classifications; and, in live chat, exposure counts, severity buckets, up to three breach names, and the scrubbed URL of the page you are on. In addition, the content of the messages you type into a chat assistant is sent as written, minus automatically-redacted high-risk patterns (Social Security numbers, payment-card numbers, password hashes) — so do not paste secrets into the chat box. Under xAI’s Enterprise Terms of Service, xAI processes this data as our processor, does not use API content to train its foundation models or other AI systems, and deletes it no later than 30 days after the end of the session.

SendGrid: We send email notifications (breach alerts, monitored-email verification links, abuse-report receipts) through SendGrid’s SMTP infrastructure. The recipient address, subject, and body of those emails pass through SendGrid’s systems.

Stripe: Subscription payments are processed by Stripe. GalaxyWarden does not store full payment-card numbers; only the Stripe subscription ID and the last 4 digits of the card on file. See Stripe’s privacy policy for details on how they handle payment data.

Render and Cloudflare: Our application and its PostgreSQL database are hosted on Render, and traffic is fronted by Cloudflare (CDN, bot and abuse protection including Turnstile challenges where enabled, performance monitoring). Both providers receive the HTTP request metadata necessary to route and serve traffic, including IP addresses, headers, and request paths. Render is the physical custodian of our database and provides the encryption-at-rest for it.

Data brokers and people-search sites: when you purchase a removal product and sign a Third-Party Authorization, we transmit the identifying information a broker needs to locate and delete your record — name, current and previous addresses, date of birth, phone, and the signed TPA — to the brokers in your removal scope. This is done at your instruction to effect your deletion request. We never supply your data to a broker for the broker to keep, resell, or market against. See Section 10A.

Analytics and advertising providers: our marketing pages load third-party analytics and advertising measurement tags — PostHog (product analytics and masked session replay), Trustpilot (review invitations). Our separate breach-news site recentbreaches.com also serves Google AdSense. These providers receive cookie/pixel identifiers, IP address, and page and event data. They do not receive your breach results, exposed credentials, removal profile, or location inferences, and advertising tags are not loaded on pages that display your results.

CapSolver: our broker scanners use CapSolver to solve CAPTCHA challenges served by broker websites. CapSolver receives the challenge itself (site key, page URL, token) and no customer personal information.

We do not sell user data to any third party for money. We do run the advertising measurement tags described above, which under CCPA/CPRA may constitute “sharing” — you can opt out at /do-not-sell or by sending a Global Privacy Control signal, which we honor. The authoritative, current list of every provider and what each receives is in our Privacy Policy. Where additional providers are added in the future, that list will be updated and the change announced under Section 17 above.

11. Disclaimer of Warranties

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

We do not warrant that: (a) the Service will be uninterrupted or error-free; (b) breach data is complete, accurate, or current; (c) security recommendations will prevent all threats; (d) AI-generated content is accurate or appropriate for your situation; (e) any data broker or people-search site will honor a removal request we file on your behalf, act within any particular timeline, or refrain from relisting you afterwards, as set out in Section 10A; or (f) any record published in a breach corpus can be deleted — it cannot, and no part of the Service claims otherwise.

12. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, GALAXYWARDEN AND ITS OFFICERS, DIRECTORS, EMPLOYEES, AND AGENTS SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, DATA, USE, GOODWILL, OR OTHER INTANGIBLE LOSSES.

IN NO EVENT SHALL GALAXYWARDEN'S TOTAL LIABILITY EXCEED THE AMOUNT PAID BY YOU TO GALAXYWARDEN IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM.

13. Indemnification

You agree to indemnify, defend, and hold harmless GalaxyWarden, its affiliates, officers, directors, employees, and agents from and against any claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from:

• Your use or misuse of the Service
• Your violation of these Terms or any applicable law
• Any unauthorized use of breach data obtained through the Service
• Your affiliate marketing activities, if applicable

14. Governing Law & Jurisdiction

These Terms shall be governed by and construed in accordance with the laws of the State of California, United States, without regard to its conflict of law provisions. Any legal action arising under these Terms shall be brought exclusively in the state or federal courts located in California.

15. Dispute Resolution

Informal Resolution: Before filing any claim, you agree to attempt to resolve the dispute informally by contacting support@galaxywarden.com. We will attempt to resolve the dispute within 30 days.

Binding Arbitration: Any dispute not resolved informally shall be settled by binding arbitration administered by the American Arbitration Association (AAA) under its Consumer Arbitration Rules in California.

Class Action Waiver: YOU AGREE THAT DISPUTES WILL BE RESOLVED ON AN INDIVIDUAL BASIS AND NOT AS PART OF ANY CLASS, CONSOLIDATED, OR REPRESENTATIVE ACTION.

16. Privacy

Your use of the Service is governed by our Privacy Policy and Responsible Use Policy.

17. Changes to Terms

We may update these Terms at any time. For material changes, we will provide at least 30 days notice via email or in-app notification. Continued use after changes constitutes acceptance.

18. Contact

For questions about these Terms: support@galaxywarden.com