BreachGuard - Privacy Policy

The short version

BreachGuard checks your credentials against breach databases using k-anonymity, so your passwords never leave your browser. It can contribute anonymized breach statistics to help protect everyone.

What BreachGuard does

BreachGuard checks if your email or password has been exposed in known data breaches. It warns you in real time, right on the login form, before you submit compromised credentials. It also detects password reuse across sites and scores password strength.

Data collection

BreachGuard does not collect your passwords, emails, or any personally identifiable information. There is no account and no registration.

Breach checks use k-anonymity: your password is hashed locally with SHA-1. Only the first 5 characters of the hash prefix are sent to the breach API. The full hash and plaintext password never leave your browser. The API returns all matching suffixes and the check is completed locally.

Password reuse detection is computed and stored entirely on your device. A local fingerprint is used to detect reuse across sites. This fingerprint never leaves your browser.

When you opt in to crowdsourced protection, BreachGuard contributes anonymized breach statistics (such as “this domain appeared in N known breaches”) to a shared database. It never includes your credentials, email addresses, or any data that could identify you.

Network activity

BreachGuard makes network requests in two cases:

• k-anonymity breach lookups: sends only the first 5 characters of a SHA-1 hash prefix to the breach check API. Your full password hash or plaintext is never transmitted.
• Crowdsourced contributions (opt-in): sends anonymized breach statistics to the Excalion API

Permissions

• activeTab: to detect login forms on the current page and display breach warnings
• storage: to save your preferences and local password reuse fingerprints
• scripting: to inject breach warnings into login forms before submission

Where your data lives

Your preferences, password reuse fingerprints, and breach check cache are stored locally in chrome.storage.local. Password reuse fingerprints are stored locally only and are never transmitted. If you uninstall the extension, all data is deleted automatically by Chrome.

Third-party services

BreachGuard queries a breach database API using k-anonymity (only a partial hash prefix is sent). No full credentials or personal data are shared with any third party.

Cookies and tracking

BreachGuard does not use cookies and does not track you in any way.

Supported browsers

BreachGuard works on Chrome, Edge, and Brave. This privacy policy applies equally to all supported browsers.

Changes to this policy

Any changes will be reflected in extension updates. The date at the top of this page will be updated accordingly.

Contact

For questions about this privacy policy: hello@excalion.io