Hacked? - have i been pwned? Android App
This page describes how the Hacked? - have i been pwned? app handles privacy and what happens to the data you enter in the app.
The Hacked? - have i been pwned? app uses the Have I Been Pwned service as its sole data source. Have I Been Pwned publishes its own privacy policy at https://haveibeenpwned.com/Privacy.
All data transmitted over the internet is sent over HTTPS connections.
Any email address entered in the app is stored in a local database on the device. The Android sandbox ensures that only the app can access this database. The list is never sent anywhere, except when searching for breached accounts.
When you search for an email address in the app, it is sent to the Have I Been Pwned API via the hibp-proxy. The hibp-proxy supplements the request with the access key required to use the Have I Been Pwned API. It does not store the email address in any persistent storage — it only forwards the request to the Have I Been Pwned API and returns the response, which no longer contains the email address. The response is delivered to the device via Firebase Cloud Messaging, a messaging service provided by Google.
The pwned password function checks a password you provide against a list of known breached passwords. The plain-text password is never sent to any service. Instead, it is hashed on the device, and only the first 5 characters of the hash are sent to the Have I Been Pwned API. This process is called k-Anonymity; more details are available in this article. This request goes directly to the Have I Been Pwned API, not through the hibp-proxy.
The app stores limited technical logs via the Android Log service. These logs stay on the device and are never sent to an external system.
If the app crashes, a crash report is sent to Crashlytics for analysis.
The app uses Firebase Analytics to track a small number of key events (e.g. account added, password checked, breach acknowledged). No content data is ever sent to the analytics service — only the fact that an event occurred. This data is used to understand how the app is used.
The hibp-proxy keeps only the bare minimum logs needed to keep the service running and to combat malicious activity. This includes transient web server logs, which may include data entered by the user and, in some cases, the user’s IP address.
The app itself requires no hosting. The hibp-proxy service is hosted on a server in Germany.
The source code for Hacked? - have i been pwned and hibp-proxy is available on their respective GitHub pages.