Privacy policy

Last updated 1 January 2026

bugatti.lol is built so that the queries you run are not a record of your activity. This policy explains what we hold and why.

Account data

We store your email address, an optional display name, your plan, and a hashed password. We store the date you last signed in. That is the full account record.

Query data

A lookup is sent to our data provider, DeHashed, so that it can be answered. That means the identifier you type leaves our server and reaches a third party, which retains it under their own policy. We cannot answer a lookup without sending it, so please do not look up anything you are not authorised to check.

We do not store the identifier itself. What we keep is a one-way hash of it, the kind of value, the number of results, and the time, which is enough to show you your own recent searches and enforce daily limits. While you are signed in, your recent queries are shown in your own dashboard so you can pick up where you left off; those entries are removed when you sign out or delete your account.

A result shows the actual values the leaked record held, such as the email address, username, IP address, name, and phone number. Knowing what was exposed alongside what is what makes a breach report worth reading.

Leaked passwords and password hashes are the one exception, and they are dropped from every record rather than shown in any form — not the value, not its length, not even a note that the column was present. Everything else a leaked record contained is displayed exactly as it was found, including contact details, addresses, employer and device information. A recovered plaintext password is a working credential for someone else's account, and putting one behind a search box turns this into an account-takeover tool for whoever finds it. Do not use this service to break into an account, and if a leaked password turns out to be yours, change it everywhere you use it.

Cookies

We set one cookie, vs_session, which holds a random session identifier. It is HttpOnly and SameSite=Lax, which means scripts cannot read it and it is not sent on cross-site requests. It expires after 30 days of inactivity.

What we do not do

• We do not sell or share your data with advertisers or data brokers.
• We do not build an advertising profile from your lookups.
• We do not keep the identifier you searched for.

Your rights

You can request a copy of your data, correct it, or have your account and associated records deleted. Contact us and we will action it. We hold no query log, so there is nothing about your searches for us to keep in the first place; note that our provider holds its own record of what it was asked, which we cannot delete on your behalf.

Terms of service

Last updated 1 January 2026

Access and plans

Paid plans are sold as a single payment for standing access. We do not bill on a recurring basis. Your daily quota resets automatically at midnight UTC and does not roll over.

Acceptable use

Use of bugatti.lol is governed by the acceptable use policy below. Breach of that policy results in immediate termination without refund.

Availability

We aim for high availability but do not guarantee uninterrupted service. Sources change, and individual third-party feeds may lag or return partial data. Results are provided as-is.

No warranty

bugatti.lol surfaces records that were already publicly available. We do not warrant that any record is accurate, current or lawfully available in your jurisdiction, and you are responsible for how you use the output.

Liability

To the extent permitted by law, our total liability arising from your use of the service is limited to the amount you paid us. Nothing here limits liability that cannot be limited by law.

Acceptable use policy

Last updated 1 January 2026

This policy exists because the capability we provide can be misused. The line is simple: investigate subjects you own, or subjects you are authorised to investigate.

Permitted

• Checking whether your own accounts appear in a breach.
• Security work on infrastructure you own or are contracted to assess.
• Fraud prevention and brand protection within a lawful basis.
• Journalism and research published responsibly.
• Investigations carried out with documented authorisation.

Prohibited

• Doxxing, stalking, or tracking a person without lawful basis.
• Harassment, intimidation or threats of violence.
• Identity theft, account takeover or credential stuffing.
• Fraud, scamming or impersonation of another person.
• Selling, redistributing or republishing harvested data.
• Bulk scraping, circumvention of quotas, or automated abuse.

Enforcement

We terminate access for prohibited use without refund and without prior notice where the conduct is clearly harmful. We may cooperate with lawful requests from law enforcement.

GDPR

Last updated 1 January 2026

Lawful basis

We process account data under performance of a contract, which is what lets you sign in. We process technical data strictly to keep the service secure and to meet legal obligations.

Your rights

Access, rectification, erasure, restriction, portability and objection. We keep no query log, so there is no processing history on our side to disclose or delete; our provider keeps its own record of the lookups it answered.

Retention

Account data is held for as long as your account exists. Sessions expire after 30 days of inactivity. Deletion requests are completed within 30 days.

Contact

For any privacy or data protection request, use the contact page. You also have the right to lodge a complaint with your local supervisory authority.