Privacy Policy

OSINTsearch ("we," "us," "our," or the "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our live data search engine, which provides Social Search, geographically restricted People Search and breach-exposure research (the "Service").

The data controller for personal information processed through the Service is Revealer LLC, the entity that owns and operates OSINTsearch.

This Privacy Policy describes our data practices and your choices. Where we ask for consent to optional processing, you can accept or decline that processing and change your choice later. Using the Service does not by itself indicate consent to optional analytics.

This Privacy Policy applies to all users of our Service. Social Search supports international research where permitted by applicable law. People Search is limited to eligible US records and the geographic restrictions shown in the product. Other features may have additional availability restrictions.

2.1 Requests available to everyone. You do not need an account or a paid plan to contact us about your personal information. You may request:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate personal information
• Deletion / Suppression: Request that we delete the personal information we hold about you as a user (your account, search history, and caches), or, if you are the subject of a listing, request suppression from our results for approved identifiers and platform scopes (see Sections 5 and 9.7)
• Export: Request your data in a portable format
• Opt-Out: Unsubscribe from marketing communications

Scope of deletion versus suppression. The rights above apply to the personal information we hold about you. Registered users can delete their account in Settings after completing the required verification. Successful deletion removes the account profile, private credentials, account-linked search history and private application records. Limited retention and independent suppression records are described in Section 5. You can contact us for other personal-data deletion requests. If you are the subject of a listing in our Service Data (for example, you appear in a Social Search result even though you never created an account), we do not own the underlying source data and cannot delete it there, but approved requests establish persistent suppressionin OSINTsearch results for the approved identifiers and platform scopes. This does not guarantee deletion of every cached or previously saved copy. Removing your information from OSINTsearch does not remove it from the originating third-party sources; you must contact those providers directly for source-level removal (see Section 9.7).

2.2 California residents (CCPA/CPRA). Where the California Consumer Privacy Act applies, eligible residents have the following rights, subject to its exceptions. These rights can apply to personal information about a search subject as well as a registered user:

• Right to know what personal information is collected and whether it is sold or disclosed
• Right to opt-out of the "sale" or "sharing" of personal information where applicable
• Right to limit the use of sensitive personal information where applicable
• Right to delete your personal information and to correct inaccurate personal information
• Right to non-discrimination for exercising your rights
• Right to designate an authorized agent to submit a request on your behalf (with proof of permission)

2.3 Other U.S. states and Global Privacy Control. Residents of states with applicable privacy laws may have access, correction, deletion, portability, opt-out, or appeal rights. The available rights and exceptions vary by state. We honor the Global Privacy Control (GPC) browser signal by keeping optional website analytics off, including when you previously accepted analytics. Section 7 explains the choices available on this site.

2.4 Other jurisdictions. Where applicable data-protection law provides them, you may also have rights to restrict or object to processing, withdraw consent to processing based on consent, receive portable data, and complain to a data-protection authority. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

2.5 How to make a request. Email [email protected] or use our removal form for a search listing. Tell us what you want us to do and provide enough information to locate the relevant account or result, such as the email address, username, or result link. You may tell us your state or country so we can apply the relevant rights. Do not send passwords, full payment-card details, or government-ID numbers. We do not require you to open an account or buy a plan to exercise a privacy right.

2.6 Verification and agents. For access, correction, or deletion, we may need proportionate information to verify your identity or an agent's authority before disclosing or changing personal information. Existing account authentication or control of a relevant email address may help us do this. California requests to opt out of sale or sharing, or to limit qualifying uses of sensitive personal information, do not require identity verification; we may ask only for information needed to identify the information covered by the request. You can send these requests directly to our privacy email without completing the listing form's verification steps.

2.7 Response times. We act without unnecessary delay. Applicable legal deadlines take priority over a general support or listing-review estimate:

• California access, correction, and deletion: Where the CCPA applies, we acknowledge receipt within 10 business days and respond within 45 calendar days of receiving the request. Verification does not restart that period. If a permitted extension is necessary, we explain the reason within the initial period; the total will not exceed 90 calendar days from receipt.
• California opt-outs and limits: Applicable requests to stop sale or sharing, or to limit qualifying sensitive-information uses, are implemented as soon as feasible and within 15 business days of receipt. The longer access/deletion timetable does not apply to these requests.
• EU/EEA and UK requests: Where the GDPR or UK GDPR applies, the normal response period is one calendar month under the applicable rules. A permitted extension for complexity or multiple requests may add up to two months; we notify you of the reason within the initial period. Any verification or clarification affects timing only as allowed by that law.
• Other requests: We aim to respond within 30 days and follow any different deadline or extension procedure required by the law that applies to your request.

2.8 Decisions and complaints. If we cannot fulfill a request in whole or in part, we explain the reason and any available review or appeal procedure. You may ask us to review a decision by replying to our response or emailing our privacy address. This does not limit your right to complain to the relevant regulator or exercise other rights under applicable law. We do not discriminate against you for exercising a privacy right.

We may share information only in the following circumstances:

• Service Providers: With trusted third-party vendors who assist us in operating the Service, including cloud hosting, payment processing (Stripe for card payments and NowPayments for cryptocurrency), transactional email delivery (Resend), and bot protection (Cloudflare Turnstile), each bound by confidentiality and data-security agreements
• AI Features: With Google Gemini when you request dashboard Analysis or an AI summary for a PDF report, as described in Section 9.9
• Legal Requirements: When required by law, subpoena, court order, or government request
• Protection of Rights: To protect our rights, privacy, safety, or property, or that of our users or the public
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users
• Sharing You Initiate: If you export or otherwise share results from your account, you do so voluntarily and are responsible for that disclosure
• With Consent: With your explicit consent for any other purpose

We use the following security controls:

• Website Transport: HTTPS protects browser connections to the OSINTsearch website
• Access Controls: Authentication and role checks protect account and administrative features. Two-factor authentication is available for accounts
• Abuse Prevention: Request validation, rate limits and security challenges help limit misuse
• Password Security: Passwords are hashed using bcrypt with appropriate work factors
• Operational Logs: Logs support troubleshooting and incident investigation

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

We retain your information only as long as necessary:

• Account Data: Retained while your account is active. Successful account deletion automatically removes the account profile, credentials, account-linked search history and private application records. Limited financial and security records may remain where required, with account-identifying details removed where possible. Approved suppression requests remain effective, and minimal replay-prevention records prevent erased correspondence from being restored.
• Search Logs: Search terms and types, timestamps, account identifiers where applicable, IP addresses, and operational metadata support usage accounting, search history, analytics, and abuse prevention. Logs are configured for database cleanup 90 days after creation. New entries do not contain full result payloads, but legacy entries may contain result data.
• Public-Profile and Following Caches: Extracted profile fields, raw profile payloads, and following lists are stored in database caches configured for cleanup 24 hours after their latest update. Updates restart that interval. Cleanup is asynchronous, so entries may remain beyond that interval and following-list entries may still be reused while awaiting cleanup.
• Breach-Summary Cache: Subject-keyed summary data, such as exposure counts and indicators, is cached in server memory. Entries expire for reuse after 24 hours; this is not a scheduled physical-erasure deadline or a statement about provider retention.
• Browser-Session Results: The dashboard saves search inputs and results in your browser's session storage, with fields named raw_data removed and fields named password or hash redacted. Restoring these results does not impose a fixed expiry period; we do not promise a fixed deletion time for these browser-held results.
• Quota & Rate-Limit Records: Plan-usage counters are configured for database cleanup nine days after the usage window starts, not after the latest search. Separate short-lived deduplication and rate-limit records use shorter expiry configurations.
• Usage & Security Logs: Server logs used for security, troubleshooting, and abuse prevention, retained for up to 12 months.
• Payment Records: Retained as required by tax and accounting laws (typically 7 years).
• Support Communications: Retained for up to 2 years or as needed for ongoing issues.

Account deletion does not erase copies you downloaded or sent elsewhere, records held independently by payment or other providers, or every backup and operational-log copy. Those records follow their applicable retention and access controls. The database expiry intervals above describe configured cleanup, not guaranteed deletion deadlines. Cleanup runs asynchronously and depends on deployed indexes and operation of the cleanup process. Expiry does not by itself establish anonymization, secure erasure, or removal from backups or operational logs. The separate account, server-log, payment, and support retention commitments above still apply.

Listings and suppression. Approved opt-out requests establish persistent suppression for the approved identifiers and platform scopes (Section 9.7). Suppression limits what appears in our results; it is not a guarantee that every result cache or previously saved copy is deleted. Different identifiers or information outside the approved scope may require a separate request. Suppression does not remove information from originating social platforms or third-party providers. To remove information at the source, contact that source directly.

6.1 OSINTsearch cooperates fully with law enforcement agencies and regulatory authorities. We will respond to valid legal process including subpoenas, court orders, search warrants, and national security letters in accordance with applicable law.

6.2 We may disclose your information to law enforcement when required by law, or when we have a good-faith belief that such action is necessary to prevent imminent harm, investigate suspected illegal activity, or protect the rights of OSINTsearch, our users, or the public.

6.3 Unless prohibited by law or court order, we will make reasonable efforts to notify affected users of law enforcement requests for their data.

We use cookies and browser storage for necessary site functionality and, if you allow it, optional visit and referral analytics.

• Necessary Cookies and Storage: Support authentication, security, basic site functionality, and remembering your privacy choice
• Optional Analytics: Help us understand visits, device and connection information, and referral or campaign attribution. Analytics may be associated with your account when you are signed in. These analytics stay off until you choose "Accept analytics"
• Preferences and Search Sessions: Remember interface settings and restore your requested search session. These functions are independent of optional analytics; Section 5 describes browser-session results

Your Analytics Choice: Choose "Accept analytics" or "Essential only" in the notice. You can reopen "Privacy choices" to change that choice at any time. We remember your choice for up to 180 days using a cookie and local storage. If there is no valid saved choice, optional analytics remain off. You can also manage cookies and site storage through your browser; blocking necessary storage may affect site functionality.

Campaign Attribution: After you accept analytics, we remember the first referral or campaign source in this browser for up to 30 days, within the lifetime of your analytics choice. We keep minimal visit records for up to 180 days, including campaign tags, visit time, and an account association when you sign in. These records do not contain your search terms or search results. We use account attribution and recorded payments to measure campaign performance. Account deletion removes account-linked campaign visit records.

Changing Your Choice: Choosing "Essential only" stops future optional activity and referral analytics and clears the related analytics identifiers and referral information from browser storage. It does not automatically delete analytics already recorded on our servers. Sections 2 and 5 explain your rights and our retention practices.

Bot Protection: We use Cloudflare Turnstile on sign-up, login, and password-reset forms. Turnstile may set a cookie or token to evaluate whether you are a real person; this is used solely for fraud and abuse prevention and is not used to track you across the web.

Global Privacy Control (GPC): We treat a GPC signal transmitted by your browser as a choice to keep optional website analytics off, even if you previously accepted them. Requests to suppress information from search results are handled separately through Section 9.7 or by contacting [email protected].

We use third-party service providers for hosting, payments, account security, communications and requested search features. They process the information needed to provide those services. Section 3 describes the purposes for which information is shared, and Section 9 explains third-party search sources and optional AI features.

9.1 Two categories of data. To make our privacy commitments clear, we distinguish information about our users from the third-party information returned by searches:

• Your personal information (User PI): the data we collect from you as a registered user or visitor: account details, the lookup terms you submit, usage and device data, and payment metadata. Your privacy rights (Section 2) attach to this data, and we never sell it. Your User PI is never injected into the search-subject profiles we surface to other users.
• Search-subject information (Service Data): information shown in results from public social-media sources and third-party providers, including People Search records and breach-exposure information. It is distinct from information collected from you as a visitor or subscriber. Not all Service Data is public or published by the subject. We offer suppression as described in Section 9.7.

9.2 Sources of Service Data; our role. Social Search queries public social-media sources and third-party providers and links to available public profiles. Breach-exposure information comes from third-party providers and is a separate source category, not necessarily content made public by the subject. We are not the original source of provider records and do not independently verify their accuracy or provenance. Searches run on demand, but results may include cached information. Section 5 describes retained logs, caches, and browser-session results. We cannot delete a record at its originating source.

People Search. Eligible provider records may include names, reported ages, aliases, phone numbers, email addresses, current and previous residential addresses, and property details such as reported sale dates, values, building characteristics and occupancy information. Fields depend on the source response, account access and geographic restrictions. A reported address, valuation or contact association is not independently verified and may be incomplete or out of date. Cross-references and exports can carry these disclosed fields into an investigation.

Address maps. When an address map is displayed, the reported address and your browser connection information are sent to Google Maps to provide that feature. A map pin represents the reported address, not the person's current physical location. The Service does not request GPS location from your device.

9.3 Breach-exposure information and excluded features. The Service includes third-party breach-exposure indicators and available records, with available fields depending on your plan and provider responses. Paid plans include access to available exposure records. Results may be incomplete, outdated, or incorrect and do not establish that an account is currently compromised. Research is limited to your own information or research you are authorized to conduct, subject to applicable law and our Acceptable Use Policy; credential misuse and unauthorized access remain prohibited. Separately, stealer-log access, device-exposure or compromised-device data, and predator or geolocated-offender mapping features are not offered.

9.4 Accuracy and non-confirmation. Service Data comes from third-party sources and public social-media profiles, is not verified by us, and may be incomplete, outdated, or incorrect. Social Search results are similarity or linkage indicators for informational purposes only and do not confirm identity, presence, or activity; a matching profile is not proof that a specific person owns or uses it. The Service is provided on an "AS IS" and "AS AVAILABLE" basis and is not a substitute for independent diligence.

9.5 Not a consumer reporting agency (FCRA). Neither OSINTsearch nor the data it surfaces is a consumer reporting agency or a "consumer report" under the Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.). You may not use the Service for any FCRA-covered purpose, including decisions about credit, insurance, employment (including household workers), housing or tenant screening, education or scholarships, or government licenses or benefits.

9.6 Non-affiliation. We are not affiliated with, endorsed by, or sponsored by any social-media platform whose public profiles Social Search links to, and all trademarks and profiles remain the property of their respective owners.

9.7 Self-serve opt-out (suppression from our results). If your own information appears in Social Search or People Search results and you would like it excluded, you may use our self-serve opt-out at /opt-out. For an email address that appears in results, you confirm ownership by clicking a verification link we email to that address, and it is suppressed as soon as you confirm. For a phone number, name, address, username or other identifier, you confirm a contact email by clicking a link we send, after which the request enters manual human review. Confirming the contact email alone does not establish the claim. General listing review can take up to four (4) weeks, subject to the shorter statutory deadlines in Section 2. The identifier is suppressed once the request is approved. Approved requests establish persistent suppression: we retain the approved identifiers and platform scopes to stop surfacing matching information in OSINTsearch results within that scope. This is not a guarantee that all cached or previously saved copies are deleted. You may also submit a suppression request by contacting us at [email protected]. Verification is requested only where appropriate and permitted for the type of request. Statutory opt-out requests can be made directly by email as described in Section 2.6; the form's verification process is not a prerequisite for those requests.

• Suppression does not delete the underlying information from originating social platforms or third-party providers. It may still appear on other websites. To remove information at the source, contact those providers directly.
• Suppression remains tied to the approved identifiers and platform scopes. New or different identifiers, or information outside that scope, may require a separate request.

9.8 Your responsibility. You are responsible for using third-party data in compliance with applicable laws and our Terms of Service, including the permitted- and prohibited-use restrictions that apply to the public social-media and third-party data our Service surfaces.

9.9 Optional AI features. When you request Analysis in the dashboard or an AI summary for a PDF report, we send selected source evidence to Google Gemini. Depending on the results you include, this can contain names, usernames, contact information, addresses, social-profile details and source labels. Both features use text evidence and do not send profile photographs to Gemini. Exporting a PDF without an AI summary does not send report evidence to Gemini for that export.

AI output may contain errors; review it against the source evidence. Requesting either AI feature is separate from your choice about optional website analytics.

Adults only. Our Service is intended for people aged 18 and over. Our Terms prohibit using the Service to search for, use, or publish information about anyone under 18. We do not knowingly permit minors to maintain accounts and do not solicit their personal information for account registration.

Information from third-party sources. A source may omit, misstate, or fail to update a person's age. Our adults-only rules do not establish that every person represented in third-party content is an adult. If we learn that an account belongs to a minor, or that a result contains a minor's personal information, we review it promptly and take steps to remove the account or suppress the result and address retained personal information, subject to applicable law.

California consumers under 16. The CCPA provides additional restrictions on sale or sharing when a business has actual knowledge that a consumer is under 16; deliberately disregarding age can count as actual knowledge. We do not offer a parental-consent or minor opt-in route to enable these searches. Our 18-and-over restriction remains in place.

If you believe a child's information is involved, email [email protected] with the relevant account or result details. A parent or guardian may contact us on the child's behalf. Please do not send additional sensitive documents unless we explain why limited supporting information is necessary and how to provide it safely.

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date
• Sending an email notification for significant changes

The updated policy will state its effective date. If a change requires your consent, we will request it separately; continuing to use the Service does not by itself provide consent to new optional processing.

What We Collect

12.1 Information You Provide:

• Account Information: Email address, password (stored only as a bcrypt hash), optional two-factor authentication settings, and profile preferences
• Search Inputs: Usernames, email addresses, phone numbers, names, addresses and other criteria you submit to the available search features
• Communications: Information you provide when contacting support or sales
• Payment Information: Card payments are processed by Stripe and cryptocurrency payments by NowPayments; we do not store full card numbers or your cryptocurrency wallet keys

12.2 Information Collected Automatically:

• Usage & Quota Data: Search counts and rate-limit/quota records support your requested service and plan enforcement. Optional visit and referral analytics follow the choice described in Section 7
• Device & Connection Information: IP addresses and device information support account security and service operation. Optional registration-location analytics require your analytics choice
• Log Data: Server access times, error logs, and referring URLs
• Cookies & Bot Protection: Session cookies for authentication and preferences, and Cloudflare Turnstile tokens used to distinguish humans from automated traffic

12.3 Information We Do Not Ask You For:

• Social Security numbers or government-issued ID numbers as lookup inputs
• Biometric templates for identifying a person
• Medical records or genetic information as lookup inputs
• Information about children under 18 for account registration or searches

These are limits on the information we ask you to provide and the features we support, not a statement that every third-party field or unsolicited message is free of sensitive information. Section 9 describes the search fields and output controls; Section 10 explains our rules and reporting channel for minors.

How We Use It

12.4 We use collected information for:

• Service Delivery: To provide, maintain, and improve the search and investigation features you use
• Account Management: To create and manage your account, process transactions, and send administrative communications
• Security: To detect, prevent, and address fraud, abuse, security risks, and technical issues
• Analytics: To understand how users interact with our Service and improve user experience
• Legal Compliance: To comply with applicable laws, regulations, and legal processes
• Communications: To respond to inquiries and send service-related notifications

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

You do not need an account to make a request. Section 2 explains verification, response periods, and available review or complaint routes.