Scope and operator
This policy applies to IsMyPasswordSecure.com, operated by USTechService Corporation. It describes the categories of information involved, why they are processed, the service providers involved, and the choices available to visitors.
Password strength analysis
Password strength analysis runs in your browser. The password is not submitted to our server, stored in browser storage, included in a form, or sent to analytics. Passphrase generation also runs locally using the browser’s cryptographic random number generator.
Optional breach lookup
If you click the breach-check button, your browser creates a SHA-1 hash locally and sends only its first five characters to the Have I Been Pwned Pwned Passwords range API. The returned suffixes are compared in your browser. The full password and full hash are not sent. HIBP and its infrastructure may process the request’s IP address, browser headers, and five-character prefix under its own policies.
Information involved and why
- Technical request data: IP address, requested URL, date and time, browser and device information, and security signals used to deliver, troubleshoot, and protect the site.
- Optional breach request: a five-character SHA-1 prefix, plus ordinary network metadata processed by Have I Been Pwned only after you choose the lookup.
- Messages you send: your email address, message, and any information you voluntarily include, used to respond, maintain records, and address security or legal issues.
- Outbound-link information: if approved affiliate links are added, the network or merchant may process link and attribution data after you choose the link.
We do not receive the password entered in the checker, its full hash, its strength result, or a generated passphrase.
Site delivery, necessary cookies, and technical logs
The site is delivered through managed Cloudflare infrastructure. Hosting and security systems may process IP addresses, request times, requested URLs, browser information, and related technical data to deliver and protect the site. Password values are not part of site requests.
The hosting and security layer may set strictly necessary visitor, load-management, and bot-protection cookies, including Cloudflare security cookies and an AppGarden visitor cookie. These are used for site delivery, access integrity, abuse prevention, and security—not behavioral advertising.
Optional Google Analytics
Google Analytics is blocked unless you select “Accept analytics.” If accepted, Google may receive page URLs, approximate location derived from IP address, browser and device information, and interaction timing for ordinary page visits. Advertising storage, advertising user data, ad personalization, Google signals, and ad personalization signals remain disabled.
We do not send passwords, generated passphrases, strength scores, breach results, password-derived values, form text, or checker-button activity to Google Analytics. You may decline analytics and continue using the complete site. You can change the saved choice through the “Privacy choices” control in the footer.
No advertising pixels, session replay, or chat interception
The current site does not use behavioral advertising pixels, session-replay software, third-party chat widgets, keystroke-recording tools, fingerprinting scripts, or third-party form-capture tools. Optional Google Analytics is limited as described above. We do not sell personal information or share it for cross-context behavioral advertising. If this changes, we will evaluate consent and opt-out requirements before the technology is enabled and update this policy.
Service providers and other recipients
Technical request data may be processed by the managed Sites and Cloudflare hosting and security services. Have I Been Pwned receives the limited breach request described above only when you click the lookup button. Our email provider processes messages you send. Google processes ordinary page-visit data only after analytics consent. External merchants and affiliate networks process information under their own policies after you choose an outbound link. We do not send password values or password-derived results to any of them.
Browser privacy signals
Because the current site does not sell personal information or share it for cross-context behavioral advertising, a Global Privacy Control or legacy “Do Not Track” signal does not change the site’s behavior. Google Analytics remains blocked unless you affirmatively accept it. We will revisit this disclosure before adding technology that would make additional opt-out behavior applicable.
Retention
We do not retain passwords, generated passphrases, full password hashes, strength results, or breach results. Hosting and security providers retain technical data according to their operational and security practices. If you accept analytics, Google retains analytics data according to the retention setting for this site’s Analytics property. We retain email and related business records only as reasonably needed to respond, document the matter, protect the service, and meet legal obligations.
Your choices and requests
The site does not offer user accounts or maintain a visitor profile that you can edit. You may choose not to run the breach lookup or follow external links. You may decline optional analytics or reopen the footer’s “Privacy choices” control at any time. To ask about, correct, or request deletion of information you intentionally sent to us, email info@ismypasswordsecure.com. We may need to verify the request and may retain information when permitted or required by law.
Children
This site is a general-audience educational service and is not directed to children under 13. We do not knowingly request personal information from children through the site.
Policy changes
Material changes will be posted on this page with a revised effective date. When appropriate, we may also provide a more prominent notice on the site before the change takes effect.
Email and contact
If you email us, we receive the address, message, and information you choose to provide. Do not email passwords, recovery codes, API keys, or other secrets.
Privacy questions can be sent to info@ismypasswordsecure.com.