Sorrel Privacy
Last updated November 1, 2026. This covers everything Sorrel Identity at identity.sorrel.cc does today: the free checks, emailed reports, accounts, breach monitoring and the data removal tools.
A privacy tool that's careless with your data defeats the point. We collect as little as the checks need, keep it for as short a time as they need, and don't sell, share or analyse it for anything else.
What happens to what you enter
| What | What we do with it | How long |
|---|---|---|
| An email address you check | Sent to our breach data source to look it up. The result is held in our server's memory under a keyed hash of the address (not the address itself) so a repeat check doesn't hit the source again. Never written to disk. | Up to 6 hours in memory, then forgotten. A restart clears it sooner. |
| An email address you ask a report for | Stored encrypted (AES-256-GCM) with a keyed hash, so we can send the link and open the report. Used to send you one email. | Deleted about an hour after the link expires. Links expire after 15 minutes. |
| A password you check | Never leaves your browser. Your browser hashes it and sends us the first 5 characters of the hash, which we pass on to Pwned Passwords. We don't log those 5 characters. | Not kept. |
| Your IP address | Counted in memory to stop abuse (rate limits). | About an hour, in memory only. |
| Your report | Shown once in your browser. We don't store a copy. | Not kept. |
We also keep daily totals (for example, "120 checks today") with no addresses, IPs or other details attached.
If you create an account
| What | What we do with it | How long |
|---|---|---|
| Your email addresses | Stored encrypted with a keyed hash, so you can sign in by email link and we can watch them for breaches. Each one is confirmed by a link before we add it. | Until you remove it or delete your account. |
| Breach monitoring | We look each watched address up at our breach source on a schedule (weekly today). We keep the number of breaches and an encrypted list of breach names, so we can tell you when a new one appears. | Until you remove the address or delete your account. |
| Passkeys | Your device keeps the private key and your fingerprint or face. We only ever get a public key, the name you give the passkey, and when it was last used. | Until you remove it or delete your account. |
| Sign-in sessions | A random code in a cookie; we store only its hash, when it started, when it was last active and how you signed in. We don't store your IP address. | 30 days, or 14 days without use. |
| Data removal details | If you add them: your name, other names, city, province or state and country, encrypted, used only to fill in request letters. Plus the status you set for each site, with optional notes (encrypted). | Until you change them or delete your account. |
| Security history | Sign-ins, passkey and address changes, alerts sent. No IP addresses or locations. | 1 year. |
We never send removal requests for you, so no broker hears from us about you. You can download everything we hold (Account, then Download my data) and delete your account at any time, which removes all of it from our database straight away.
Cookies and tracking
Only the cookies the service needs, all first-party: one that ties an emailed link to the browser you asked from (so a forwarded or intercepted link is useless to anyone else, 16 minutes), your sign-in session if you have an account (up to 30 days), and a short-lived one while a passkey prompt is open (5 minutes).
The report email loads its logo and header image from identity.sorrel.cc. The image addresses are the same for everyone, so they can't tell us who opened an email or when. Opens and clicks aren't tracked.
No analytics, ad trackers, social widgets or third-party scripts. Our fonts are served from our own server, so loading this site doesn't tell anyone else you visited.
Who else is involved
- XposedOrNot (xposedornot.com) receives each email address you check, from our server, without your IP address. Its own privacy policy covers what it does with lookups.
- Pwned Passwords by Have I Been Pwned receives the 5-character hash prefixes, from our server.
- Render hosts the service, and its network (including Cloudflare) handles traffic and may keep standard request logs. Servers may be in the United States.
- Our email provider (Resend) delivers links and alerts from no-reply@auth.sorrel.cc. It sees the address and the email we send, not your breach results beyond what an alert lists.
Your rights
Under Canada's PIPEDA (and Quebec's Law 25, and similar laws where you live) you can ask what we hold about you, ask us to correct or delete it, or complain. Because we keep almost nothing, and nothing linked to your name, the honest answer is usually "nothing". Email support@sorrel.cc and we'll reply within 30 days. You can also contact the Office of the Privacy Commissioner of Canada.
When this changes
If we start keeping anything new, we'll update this page, with the date, before it goes live.
Sorrel Technology, Edmonton, Alberta, Canada.