How our scan works, and where it can be wrong

What "1,500+ sources" means

It is the number of distinct public data sources our scan can query for a phone number or an email address. They fall into a few groups: breach and leak records, public profiles and account registrations, and public location activity such as Google Maps contributions. The approach is open-source intelligence (OSINT): we look only at information that is already public or already leaked, never at anything behind a login.

Not every source applies to every identifier. The exact sources searched depend on whether you check an email, a phone number, or both.

What "checked" means

Your phone number or email is queried against each applicable source, and a finding is reported when that identifier is associated with a record there. Findings are compiled into one plain-language report with practical next steps. We do not log in to any account, and we do not access private messages or passwords.

Free check versus paid scan

The free digital footprint checker checks your email address against known data breaches, using breach data from Have I Been Pwned (licensed under CC BY 4.0). The paid scan covers your phone number and email address across the wider set of 1,500+ sources and returns a full report, which is what the phone number exposure check and email exposure check lead to. If your main worry is a leaked record, start with the data breach and leak check.

What we do not check

We do not scan photos or run reverse-image searches. We do not search by name alone. We do not access private accounts, passwords or private messages. We do not search the entire internet, and no tool can.

Limits, false positives and false negatives

Results reflect what was publicly available or indexed at the moment your scan ran. A clean result means nothing relevant was found across the sources checked. It does not prove that no information about you exists online (a false negative is possible).

A finding can also be a false positive, for example when a phone number was reassigned or an old account used a shared email. Treat findings as leads to review, not proof of harm. For background on how contact details spread, see how your phone number and email end up online and how OSINT can be used to find someone.

What happens to your data

The phone number and email you submit are used to run your scan and are deleted immediately after your report is delivered. Full details are in our Privacy Policy, and you can read more about Scan My Shadow.