Terms of Service

Purpose of the service

Leaked.Domains indexes data that has already been exposed in breaches, infostealer logs and other public sources, and makes it searchable. It exists so that security researchers, organisations, and law enforcement can find out what has been exposed about the people and domains they are responsible for, and act on it.

The service is intended for defensive, investigative and research work. It is not intended to help anyone gain unauthorised access to accounts or systems, and it must not be used for that purpose.

Eligibility and accounts

You must be at least 18 years old and legally able to enter into a contract. If you register on behalf of an organisation, you confirm that you are authorised to bind it to these terms.

Accounts are self-serve: you can register and subscribe without a separate contract. We may ask you to verify your identity, your organisation or your control of a domain before granting access to particular data, and we may refuse, limit or withdraw access where we consider it appropriate. Access to sensitive fields, such as cleartext passwords for a domain, requires proof that you control that domain.

You are responsible for keeping your credentials and API keys secure and for everything done through your account. Tell us promptly if you believe it has been compromised.

Where the data comes from

We do not hack, breach or otherwise obtain data unlawfully, and we have no involvement in the incidents that produced it. Everything in the index is collected from sources that are already accessible on the clear, deep or dark web. We aggregate and index it so it can be searched in one place.

We do not provide advice, tooling or assistance for obtaining leaked data, and we do not accept requests to acquire specific datasets on anyone's behalf.

Acceptable use

You may use Leaked.Domains to:

• assess and monitor exposure affecting you, your employer, or clients who have engaged you;
• carry out security research, incident response, threat intelligence and investigations;
• support lawful law-enforcement and regulatory work;
• produce reports and exports for those purposes, within the limits of your plan.

Active tools that probe external targets must only be run against infrastructure you own or have written permission to test.

Prohibited conduct

You must not:

• use credentials or session data found here to access any account or system without authorisation;
• share, resell, sublicense, publish or otherwise redistribute your access or the data you obtain;
• let anyone else use your account, or use it for anyone other than yourself or the organisation that registered it;
• use the service to harass, stalk, dox, extort, defraud or discriminate against any person;
• scrape, bulk-harvest or mirror the index beyond the export limits of your plan, or attempt to reconstruct it;
• circumvent rate limits, credit limits, access controls or authentication;
• use the service where doing so would breach the law that applies to you.

Your responsibility for what you find

You are solely responsible for what you do with data obtained through the service, and for complying with the laws that apply to you, including data-protection law such as PIPA, the GDPR and their equivalents. Depending on where you are and what you do, you may be a data controller in your own right.

If you use the service on behalf of clients, you are responsible for having a lawful basis for doing so and for the scope of any engagement.

Enforcement and suspension

We log account activity, including searches, exports and API calls, to enforce these terms, protect the service, and meet our legal obligations. We reserve the right to embed identifying markers in data delivered through the service so that redistribution can be traced back to the account responsible.

Where we believe these terms have been broken, we may suspend or terminate the account without notice and without refund. Where we are legally required to do so, or where we believe it necessary to prevent serious harm, we will cooperate with law enforcement.

Billing, renewals and refunds

Prices, credit allowances and plan limits are shown on the pricing page. Payments are handled by our payment providers; the provider named on your receipt acts as merchant of record for that transaction and its own terms apply to the payment itself.

Subscriptions renew automatically for the same period until cancelled. You can cancel at any time; cancellation stops future renewals and takes effect at the end of the period you have already paid for. Credits and allowances do not carry over once a subscription lapses.

Refunds

• 14-day window. You may request a refund within 14 days of a first purchase or a renewal, provided the service has not been substantially used in that period, for example by running significant numbers of searches, generating reports or downloading exports.
• After 14 days. Payments are non-refundable, including for unused time on a cancelled subscription.
• Credits. Separately purchased search and API credits are non-refundable once any part of them has been consumed.
• Statutory rights. Nothing here removes rights you have under consumer law that cannot be waived by agreement. Where such a right applies, it prevails over this section.

To request a refund, contact billing@leaked.domains from the address on the account.

Availability and accuracy

The service is provided on an "as is" and "as available" basis. We do not guarantee uninterrupted access, and we may change, suspend or withdraw features, datasets or plan limits.

The data originates from third-party sources of varying quality. We do not warrant that it is accurate, complete or current. A record appearing here does not prove that an account is currently compromised, and the absence of a record does not mean nothing has been exposed. Verify before you act on anything you find.

Liability

To the fullest extent permitted by law, we are not liable for indirect, incidental or consequential loss, or for lost profits, revenue, goodwill or data, arising from your use of the service. Our total liability in connection with the service is limited to the amount you paid us in the twelve months before the event giving rise to the claim.

Nothing in these terms limits liability that cannot lawfully be limited, including for death or personal injury caused by negligence, or for fraud.

You agree to indemnify us against claims, losses and costs arising from your misuse of the service or your breach of these terms.

Intellectual property

The platform, its interface, software, documentation and branding belong to us. Your subscription grants you a limited, non-exclusive, non-transferable right to use the service while it is active. It does not transfer ownership of anything.

Reports and exports you generate may be used within your organisation and shared with clients you produced them for, subject to the restrictions in these terms.

Privacy and personal data

How we handle information about you as a customer is set out in our Privacy Policy, which forms part of these terms.

If you believe your own personal data appears in the index and you want it addressed, contact info@leaked.domains. We explain how we handle those requests in the Privacy Policy.

Termination

You may stop using the service and delete your account at any time from your profile. We may terminate or suspend access for breach of these terms, for non-payment, or where we are required to by law.

Sections that by their nature should survive termination (including responsibility for prior use, liability, indemnity and governing law) continue to apply afterwards.

Governing law

These terms are governed by the laws of the Republic of Korea, and the courts of the Republic of Korea have jurisdiction over any dispute. If you are a consumer, this does not deprive you of the protection of mandatory rules in your country of residence.

If any provision is found unenforceable, the rest remains in force.

Changes to these terms

We may update these terms. If a change materially affects your rights, we will give notice by email or in the application before it takes effect. Continuing to use the service after that point means you accept the updated terms. If you do not, you may cancel.