Privacy notice
Research prototype · last updated October 2026
Who runs this tool
Exposio is a research prototype built by Abdullah Esmail Mohammed Salem, MSc Cyber Security Engineering student at Óbuda University, Budapest, Hungary, supervised by Balázsné Dr. Kail Eszter. It lets you assess your own digital exposure. It is not a commercial security service.
Contact: not yet set
Ethics approval reference: not yet set
What is processed, where, and why
| Data | Sent to | Purpose |
|---|---|---|
| Your email address — verification | Resend (email delivery provider), EU region — Ireland | To send you a one-time code proving the address is yours. The code itself is never stored; your browser holds a signed, expiring token instead. Mail is sent from exposio.eu, authenticated with SPF, DKIM and DMARC, and processed inside the EU. |
| Your phone number — verification (only if you use the phone check) | Twilio (SMS delivery provider) | To send you a one-time code by SMS proving the number is yours. The number is used for that message and the lookup, and is never stored. Phone checks are only possible on deployments where SMS is configured. |
| Your verified email address or phone number — breach lookup | Have I Been Pwned (email only); DeHashed (only if enabled on this deployment) | To find which known breaches include the identifier. Only breach names, dates and the TYPES of data exposed are used; leaked values are never shown or kept. Have I Been Pwned has no phone search, so a phone check uses DeHashed alone and the report says so. |
| A 5-character fragment of your password's hash | Pwned Passwords (Have I Been Pwned, served via Cloudflare) | Your password is hashed in your browser. Only the first 5 characters of the hash are sent; the full hash and the password never leave your device. |
| Your report summary and chat messages — ExpoBot | Anthropic (AI model provider) | To answer your questions. ExpoBot receives your score, the breached company names, the exposed data types and your messages — not your email address. |
| A keyed hash of your IP address and email address | Exposio servers; Upstash (only if enabled) | To limit how often any one person can request codes, run checks or chat (protection against abuse). Counters expire automatically within 24 hours and can't be turned back into an address without the server's secret key. |
| Standard request data (IP address, time, page requested) | Vercel (hosting provider) | Needed to deliver the website and keep it secure. Exposio does not add your email, password or results to these logs. |
What is stored
Exposio has no database. Your results exist only in your browser tab and disappear when you close it or start a new check. Verification and report tokens are signed, held in your browser's memory, and expire after 10, 15 and 60 minutes. The only server-side traces are the short-lived abuse-protection counters described above.
The providers listed above keep their own records under their own privacy policies — for example, the email provider records that a message was sent to your address.
Legal basis
Running a check is based on your consent (GDPR Article 6(1)(a)), which you give with the checkbox before starting and can withdraw at any time by not continuing. The abuse-protection counters are based on legitimate interests (Article 6(1)(f)): keeping the service available and preventing it from being used against other people.
Transfers outside the EU
Some providers (including Anthropic and Resend) are based in the United States. Transfers rely on the safeguards each provider offers, such as Standard Contractual Clauses; see their privacy policies for details.
Only your own data
Check only email addresses you control and passwords you use. Email checks require a code sent to that inbox for exactly this reason. Exposio does not look up phone numbers, social media profiles, or anyone else's information.
Your rights
You have the rights of access, rectification, erasure, restriction and objection under the GDPR. Because Exposio keeps no personal data, there is usually nothing held to access or delete; write to the contact above with any question. You can also complain to the Hungarian data protection authority (NAIH, naih.hu) or the authority in your country.