What data sources does DoxxScan query?

Billions of leaked records from breaches that have already been made public, plus our own indexes built from those same public disclosures.

What do you store about me?

Email, scan history metadata, risk scores, and removal progress. We do not store SSNs, IDs or financial account numbers. What you scanned and the result we built from it are kept for 48 hours so your results page and the emailed copy still work, then deleted; our audit log only ever holds a masked version.

How do I report a vulnerability?

Email support@galaxywarden.com. Full policy at /security. Machine-readable contact at /security.txt.

Trust, verified.

No cherry-picked testimonials. No "Featured in" banners we bought. Instead: what GalaxyWarden actually does, what it sees, and what it keeps, in full, inspectable detail.

How it actually works

When you enter an email, username, phone number, or name, our DoxxScan™ engine searches billions of leaked records from breaches that have already been made public. What comes back is not a yes or a no. One email is enough. From it we find the phone number it’s paired with in a leak, then the address paired with that phone, then the names listed at that address. Our comparison page shows how that differs from a checker that only answers the one question you asked.

For removals: we are a California company, and we file every request for you under CCPA §1798.135(c), which gives each company 45 days to answer.

By the numbers

The numbers we publish on marketing pages, here in one audit-ready place:

13.1B+

Leaked records we search, counted from Have I Been Pwned’s public breach index

634

Data-broker sites a Deep Sweep clears — counted by distinct domain

582

Companies we send an authorized-agent removal letter to — one per opt-out mailbox, so a company registered under several names is written to once

Of those sites, the consumer look-up sites where anyone can type your name and get your address — the ones you can go and check yourself

Under 15s

What we promise you will wait for a free scan — the same figure the funnel pages state, so this page cannot disagree with them

Day 30

We go back and re-check the sites we can check automatically, then email you which ones still list you

Where the first figure comes from: 13.1B+ records from 966 breaches catalogued by Have I Been Pwned, counted from their public index on 2026-08-17. Your scan also searches DeHashed, which is not counted here.

What we store, what we do not

We store, for your account:

Your email (verified), scan history (which credentials you chose to scan — not the credentials themselves), risk scores, and removal/remediation progress. That is enough to keep your dashboard working across sessions.

We do not store — ever:

Social Security numbers, IDs, or financial account numbers. We show you passwords that turned up in public breaches so you can change them, then drop them from our result cache.

What we keep for 48 hours, and why:

The address or username you scanned, and the result we built from it. That is what your results page opens from and what we email you a copy of, so it has to exist for as long as those links do. After 48 hours the whole record goes. Our own audit log — the one that records that a scan happened at all — only ever holds a masked version, like j***@gmail.com.

In transit: TLS 1.3. You can check that yourself in any browser, on this page, right now.
Your account password: stored only as a PBKDF2-SHA256 hash, so nobody can read it back — including us.
Checking a password against breaches: the password is hashed on our server first and only the hash goes out. The password itself never leaves us.
Data subject rights: export your data via /account/export, or delete your account and all associated records via /account/delete.
No third-party sale: we do not sell, rent, or license your data, and we take no affiliate or referral money from anyone we link to. Full privacy policy at /privacy.

Security disclosure

If you find a vulnerability, we want to hear from you. Full disclosure policy, scope, out-of-scope list, and hall of fame: /security. Machine-readable contact: /security.txt (RFC 9116). Reach us directly at support@galaxywarden.com. Researchers acting in good faith will not be pursued under the CFAA for actions covered by our disclosure scope.

Responsible-disclosure friendly No-CFAA-against-researchers pledge security.txt published

Names you will see

Privacy products have a naming problem because security is full of jargon. Our conventions:

GalaxyWarden — the company and the platform. What you sign into.
DoxxScan™ — the exposure-scanning engine. What runs when you search an email, username, phone, or name. Every scan, report, and chain map comes out of DoxxScan.
Deep Sweep (formerly sold as “OneShot” / “The Purge”) — the one-time $29 cleanup: full scan + broker removals filed on your behalf, with 30 days of Protection included.
Protection (formerly “Warden Plus”) — the subscription ($14.99/mo, or $129/yr): ongoing monitoring, alerts, and auto-refiling.
BATECH LLC — the legal entity that operates GalaxyWarden.

Who is behind this

BATECH LLC, registered in California. Companies pay him to find the holes in their security before criminals do. Registered domain galaxywarden.com. Contact: support@galaxywarden.com.

Mailing address: BATECH LLC, 3154 Glendale Blvd #1234, Los Angeles, CA 90039-1830 — the same address published on /privacy, /terms and /refund-policy.