What FindMore collects, and why.
- You need an accountName, email address, and sign-in sessions. That is the whole profile.
- Results live 30 daysWhat you typed and what we found, kept so you can compare, then deleted automatically.
- We do the lookingFindMore does the looking for you. The app on your device never contacts the sources itself.
- No analytics, no adsNo tracking kits, no ad networks, nothing sold or shared with data brokers.
What we collect
Account
Your name, email address, and password (stored as a hash), or the identifier returned by Google or Apple if you sign in with them. Sessions record the IP address and device description of the sign-in so you can recognise them, and expire after 30 days.
Checks you run
The input you enter (a domain, email address, handle, or IP address) and the result, including the findings shown to you. If you run the IP address check without entering an address, the result records the public address of your connection, its reverse DNS name, and its approximate city and country, never coordinates. Runs are kept for 30 days and then deleted automatically. You can delete any run sooner.
Notifications
If you turn on completion notifications in the mobile app, we keep a push token for that device so we can send a short alert when a background check finishes. The alert never contains what you searched. Turning notifications off, or signing out, removes the token.
What we do not collect
No advertising identifiers, no analytics events, no contacts, no location from your device. Error logs never include what you searched.
Where lookups go
To answer a check, FindMore asks the public data providers below on your behalf. What each receives is limited to the identifier you entered.
- Public DNS, RDAP, and certificate logsUsed for the domain, certificate, registration, and IP address checks.
- Internet ArchiveUsed to find archived copies of a site.
- RIPE NCC (RIPEstat)Used for routing and the approximate location of an IP address.
- GravatarUsed only to check whether a public avatar exists for an email address. The address is hashed first.
- GitHubUsed for the GitHub exposure check and the GitHub part of username presence.
- Have I Been PwnedUsed for the breach exposure check. The address you enter is sent to their API.
- Pwned PasswordsUsed for the password exposure check. The password is hashed on your device and only the first five characters of that hash are sent; the password itself never leaves your device and is never stored.
- Hudson RockUsed for the infostealer exposure check. The address you enter is sent to their API; they return credentials already masked.
- EtherscanUsed for the wallet exposure check. The Ethereum address you enter is looked up on the public chain through their API.
- The sites checked by username presenceEach receives a request for the public profile page or API of the handle you enter, and nothing else.
The catalog currently holds 24 checks. Any check added later will be listed here before it is released.
How long we keep things
- Inputs and results. 30 days, then deleted automatically.
- Account security history. Sign-in, account and device-operation outcomes are kept for 30 days with opaque account references. Passwords, session tokens, device tokens and profile text are excluded.
- Sessions. 30 days of inactivity, or until you sign out.
- Account details and push tokens. Until you delete the account or the token.
Your choices
- Delete any result from its page, or delete your whole account from Account. Deletion is immediate and removes history, saved results, sessions, and device registrations.
- Notifications are off by default and can be switched off at any time.
- Every check is meant for your own footprint, or one you are authorized to assess. See the acceptable use policy.
Contact
Everything this policy describes can be seen and deleted from inside the app: results one by one, or the whole account in one step. A contact address for data requests will be published here before the store release.
Changes to this policy are published on this page with a new effective date.