Privacy Policy

Last updated: 9/9/2026

Introduction

Restealer Limited operates restealer.com, a service that alerts you when credentials for domains you control, or for an email address you ask us to watch, appear in infostealer logs. This Privacy Policy explains what information we collect, why, who we share it with, and the choices you have. It should be read alongside our Terms of Use.

1. Information we collect

1.1 If you subscribe to personal alerts

When you ask us to email you if a specific address turns up in an infostealer log, we collect that email address so we can confirm your request and send you alerts. We use a double opt-in: nothing is stored against your address until you click the confirmation link in the first email. You can also choose, separately, to receive occasional product updates.

1.2 If you create a business account

We collect your account email address, the domains you add, and the records that prove you verified them (for example, a DNS record, an uploaded file, or an email confirmation).

1.3 Everyone

For security, rate limiting, and abuse prevention, we process technical information such as IP addresses and access logs. When you use the public exposure search, our bot-protection provider also processes connection and device information (see section 3).

2. Credential and exposure data

Restealer processes credential records that circulate in infostealer logs so we can match them against domains you have verified, or against an address you subscribed. We only show you records for domains or addresses you control. We do not pay criminals for this data, and we do not contribute to cybercrime in any way.

Accuracy. A record we list is not proof that a site was breached. It means a login for that site was captured, typically by infostealer malware on someone's device, and later posted online. Dates are roughly when a record was published, and can reflect a credential resurfacing in newly-processed data rather than a brand-new leak. Some logs that circulate online are also incomplete, stale, or fabricated, so a small share of records may be inaccurate. Treat results as leads to verify, not as proof, and change any password you are unsure about.

3. Service providers we share data with

We use a small number of third parties to run the service. They process data on our behalf, only as needed to provide their part of the service. We do not sell or rent your personal information to anyone.

  • Mailgun (email delivery): receives your email address so we can send verification, confirmation, and alert emails.
  • Supabase (authentication and database hosting): stores your account and application data.
  • Cloudflare (content delivery and Turnstile bot protection): processes connection and device information, including your IP address, to tell humans from bots on the public search. This is governed by the Cloudflare Turnstile Privacy Policy.

4. How we use your information

  • To send the alerts and emails you asked for
  • To operate, maintain, and secure the service
  • To prevent abuse and enforce our Terms of Use
  • To respond to your questions and requests

5. Your choices, and how to unsubscribe or delete

  • Personal alert subscribers: every alert email has an unsubscribe link (including a one-click option in supported mail apps). Unsubscribing stops the emails. To have your subscription removed entirely, contact us and we will delete it.
  • Business accounts: you can stop using the service at any time by deleting your account or contacting us, and we will remove your account data.
  • You can ask us what personal information we hold about you, and ask us to correct or delete it, by contacting us at the address below.

6. Security and retention

We keep personal information only for as long as we need it to provide the service or to meet legal obligations. Enterprise accounts can provide a PGP public key; where they do, their sensitive credential data is encrypted with that key. In the event of a data breach affecting your information, we will notify you within seventy-two (72) hours of discovery, by email to your registered address.

7. Children

The service is not intended for anyone under 18, and we do not knowingly collect information from children.

8. Changes to this policy

We may update this Privacy Policy from time to time. Where changes are material, we will update the date above and, where appropriate, let you know by email.

9. Contact

For any question about this Privacy Policy, or to make a request about your information, contact us in writing at:

Restealer Limited
D1306/111 Dixon Street
Te Aro
Wellington 6011
New Zealand
Website: https://restealer.com