Privacy

BreachBook measures its aggregate traffic with Google Analytics and collects nothing else about the people who read it.

This site is published by Oak and Main Developers LLC, 2108 N St., Sacramento, CA 95816. Questions about this policy go to corrections@breachbook.org; see about for the publisher of record.

What this site collects

Aggregate traffic measurement, and nothing else. Every page loads Google Analytics 4, which BreachBook uses to measure aggregate traffic: pages viewed, approximate location, and device. Google sets cookies (_ga and _ga_*) to do this and processes the data under Google's privacy policy. You can opt out with Google's browser add-on or any content blocker. Cloudflare Web Analytics also counts page views in aggregate; it sets no cookies.

There is no advertising, no tracking pixel, no embedded video, and no web fonts. There are no accounts, and nothing on this site asks a reader for personal information.

This is enforced, not merely intended. Every page is served with a Content-Security-Policy that permits same-origin styles, images, and scripts, the site's own manifest, and, beyond that, only the Google Analytics and Cloudflare Web Analytics hosts. Any other tracker added by mistake would be blocked by the browser before it could send anything. The build fails if any script other than those analytics tags, a static metadata block, or the scan tool's own script reaches a page.

What the server necessarily sees

This site is served as static files by Cloudflare Pages. Like any web server, Cloudflare's edge handles the network request itself and may keep short-lived operational logs, which are subject to Cloudflare's own privacy policy. BreachBook does not add to those logs, does not receive analytics from them, and does not combine them with anything.

What the site publishes

The record itself: breaches disclosed in filings made to government agencies, which name reporting organizations. Every page names an organization, never an individual, and no page identifies any person affected by a breach. Sources and method are set out on the sources page.

Links to other sites

Pages link to government sources, court records, and federal consumer-protection guidance. Those sites set their own terms and are not covered by this policy.

If that ever changes

Alerts by email are a planned feature and do not exist yet. No subscription form is live, and no email address has ever been collected by this site. If that feature ships, it will not launch before this page states exactly what is stored, why, how long it is kept, and how to remove it — and it will require confirmed opt-in before a first message is sent, with a one-click unsubscribe in every message afterwards. Subscriber records would hold an address and delivery preferences and nothing else: no profiling, no enrichment, no sale or sharing.

Your rights

Oak and Main Developers LLC operates from California, and this policy is written to meet the California Consumer Privacy Act as amended by the CPRA. BreachBook itself holds nothing about a reader to access, correct, delete, or port: the analytics identifiers described above are set by Google and held in Google Analytics. Nothing is sold, and the site carries no advertising, including cross-context behavioural advertising. A request under those rights can be sent to corrections@breachbook.org and will be answered stating what is held, including what Google Analytics holds for this site. If any of that ever ceases to be true, this page changes first.

Corrections and contact

To report an error in a published record, write to corrections@breachbook.org. The corrections policy sets out the standard a correction has to meet and how each one is logged.