LeakProbe - Privacy Policy

The short version

LeakProbe detects exposed sensitive data on web pages (API keys, credentials, internal paths). The free tier runs locally. The paid tier connects to a monitoring dashboard. Anonymized crowdsourced data helps identify new leak patterns faster.

What LeakProbe does

LeakProbe scans web pages, JavaScript files, and HTTP responses for accidentally exposed secrets: API keys, access tokens, database connection strings, internal paths, debug information, and other sensitive data that should not be publicly visible. It alerts you to data leaks before attackers find them.

Data collection

LeakProbe does not collect your name, email, browsing history, or any personally identifiable information.

Free tier: all analysis runs locally. No data is transmitted.

Paid tier: requires an account. Monitored domain configurations and aggregated leak findings are synced to the Excalion dashboard. Only the type and location of detected leaks are stored. The actual secret values are never transmitted or stored on the platform.

When you opt in to crowdsourced protection, LeakProbe contributes anonymized leak pattern signatures to a shared database. This includes the type of leak detected (e.g., “AWS key pattern”) and the domain. It never includes actual secret values, page content, or anything tied to you personally.

Network activity

LeakProbe makes network requests for:

• Pattern database updates: fetches updated leak detection patterns and signatures
• Crowdsourced contributions (opt-in): sends anonymized leak pattern data to the Excalion API
• Dashboard sync (paid tier only): syncs aggregated findings and configurations to your Excalion dashboard

Actual secret values detected on pages are never transmitted over the network.

Permissions

• activeTab: to scan the current page and its resources for exposed secrets
• storage: to save your preferences, detection patterns, and scan results locally
• webRequest (read-only): to inspect HTTP responses for leaked data in headers and response bodies

Where your data lives

Free tier: all data stays in chrome.storage.local on your device.

Paid tier: aggregated leak findings and monitored domain configurations are stored on the Excalion platform, associated with your account. Actual secret values are never stored on the platform. Local preferences remain in chrome.storage.local.

If you uninstall the extension, local data is deleted automatically by Chrome. Dashboard data can be deleted from your account settings.

Third-party services

The paid tier syncs data to the Excalion platform under your account. No data is shared with any other third party. Secret values are never transmitted to any service.

Cookies and tracking

LeakProbe does not use cookies and does not track you in any way.

Supported browsers

LeakProbe works on Chrome, Edge, and Brave. This privacy policy applies equally to all supported browsers.

Changes to this policy

Any changes will be reflected in extension updates. The date at the top of this page will be updated accordingly.

Contact

For questions about this privacy policy: hello@excalion.io