Privacy Policy

Last updated: June 16, 2026

What we collect

• Account data: name, email, role within the household.
• Monitored identifiers: email addresses you add for breach monitoring.
• Security signals: MFA status, device sessions, password-hygiene checks.
• Usage: pages visited, actions taken, errors encountered.

What we don't collect

• Your passwords. We check hashes against breach corpora; we never see plaintext credentials.
• Browsing history outside HackFirstAid.
• Children's data beyond the minimum needed to coordinate household safety.

How we use your data

To deliver alerts, score your household's security, route incidents to specialists, and bill you. That's it.

Who can see what

The account holder and co-admins see household-wide data. Each member sees their own data. Children's accounts have minimal visibility by design.

Sharing & sale

We do not sell your data. We share data only with the processors needed to run the service (hosting, email delivery, payments), under data-processing agreements.

Retention

Account data is retained while your household is active and for 90 days after deletion. Audit logs are kept for 12 months. You can request earlier deletion at any time.

Your rights

Access, correction, export, and deletion are available from the Account page or by emailing privacy@hackfirstaid.com.

Contact

Questions? privacy@hackfirstaid.com