Privacy Policy

Who we are

This policy covers the LoginScout website at loginscout.com and the LoginScout Android app, which shows the same website. “We” means LoginScout.

LoginScout is run by Raja Huzaifah Mansoor, an independent developer in Toronto, Ontario, Canada. Contact: huz@loginscout.com.

Your vault

Your vault holds the logins, card notes, recovery details, and profile you save. It is encrypted on your device with AES-256-GCM before it is saved to your account, and we store only the encrypted copy. Every account is saved this way, free or paid, so it can sync between your devices.

Please know the limits. Your PIN is 4 digits, and we store a check value made from your username and PIN so we can sign you in. Someone with access to our database could use it to guess the PIN and open the vault. If you sign in with Google (or Apple, Discord, or Microsoft where offered), we keep your vault key on our servers and give it only to your signed-in session. We do not try to open vaults, and our admin tools do not show vault contents.

2FA codes (the Authenticator tab) and quick notes (the Notes tab) are saved only on this device, in the browser's or app's storage. They are not encrypted, they are not part of your vault or its backup, and they are not sent to our servers.

The browser extension

The LoginScout browser extension watches for sign-in and sign-up forms on the pages you visit, so it can offer to save a login, fill one in, or create a new account. Everything it reads from a page stays in your browser. The only thing it sends anywhere is the login you save, and that goes encrypted to your own vault at loginscout.com, the same way the website saves it. It does not send browsing history, page contents, or the sites you visit to us or to anyone else. Your PIN is never stored by the extension; the key that unlocks the vault lives in memory until the browser closes. You can switch off automatic saving in the extension's popup and remove the extension at any time.

What else we collect

• Account details. Your vault username, or the email and name from Google (or Apple, Discord, or Microsoft where offered). Your plan, billing status, how many accounts you have saved, and when you signed up.
• Where you came from. When you sign up, the site or campaign link that brought you, and a referral code if a friend invited you.
• Payments. Stripe takes your card details. We never see or store full card numbers. We keep the Stripe customer and subscription IDs and your plan status.
• Support. Tickets, messages, and files you send us, and emails you send to our address.
• Temp mail. Mail sent to inboxes we issue to you, and mail you send from them. The free temp mail page, which needs no account, keeps a scrambled (hashed) form of your IP address so each visitor gets one inbox a day.
• Phone numbers. For burner numbers we keep the order, the number, and the codes it receives. For a private number, where offered, we keep the number and its texts and calls.
• Website icons. When you add a website to a card, our server asks that site, and sometimes Google's favicon service, for its icon. Only the website address is sent. After that, your device loads the icon straight from that website or from Google, and some built-in game logos load from Wikimedia, 1000logos.net and Simple Icons. Those sites see your IP address, like any image on the web.
• Account assistant. It reads the text you type to work out which game or site you mean. If AI help is turned on, that short text goes to Cloudflare Workers AI. Passwords are not sent.
• IP addresses. Our hosting sees your IP address on every request. We use it to block abuse, to rate limit, and to stop PIN guessing (we keep failed sign-in counts by username and IP address).
• Usage and bug reports. Ahrefs Web Analytics counts page visits on the website. On the website, LogRocket records how the LoginScout app is used (clicks and screens) so we can fix bugs. It hides everything you type and all page text, drops the content of requests, does not record your IP address, and links the recording to your username, or to your email and name if you sign in with Google or another provider. LogRocket is not used in the Android app.

Free tools

The password generator, password strength checker, and 2FA code generator run in your browser. What you type into them is not sent to us. The optional leak check sends only the first five characters of a SHA-1 hash of the password to Have I Been Pwned, which cannot recover the password from it.

When you press Generate with AI in the username generator, the description, platform, style, and optional name you entered are sent to Cloudflare Workers AI to make name ideas. We do not store or log that text. Your IP address is used briefly to rate limit requests.

Service providers

These companies process data for us, only to run LoginScout:

• Cloudflare: hosting, our database (D1), receiving temp mail, and Workers AI for AI username ideas and assistant hints.
• Stripe: payments on the website.
• Resend and Postmark: sending email, such as welcome emails, notices, and mail you send from a LoginScout inbox.
• LogRocket: session replay on the website only, with typed text hidden.
• Ahrefs: website visit counts.
• Google: Google sign-in, and website icon lookups through Google's favicon service.
• Apple, Discord, and Microsoft: sign-in, if you choose them where offered.
• 5sim: burner phone numbers for verification codes, on the website.
• Telnyx: private phone numbers, where offered.
• Have I Been Pwned: the optional password leak check.

We do not sell your personal information, and we do not share it for advertising.

Cookies and device storage

If you sign in with Google or another provider, we set one sign-in cookie that lasts up to 30 days, plus short cookies that last 10 minutes while you sign in. The app also uses your device's local and session storage for the encrypted vault, your sign-in state, settings, the 2FA codes and quick notes you add, and how you found us. Ahrefs and LogRocket may use their own cookies or storage on the website.

How long we keep data

• Your account, vault, and support tickets: until you delete your account.
• Temp inboxes: deleted with their mail when they expire, unless you chose to keep the inbox.
• Payment records: Stripe keeps them as long as tax and accounting laws require.
• Server logs: kept for a short time. Failed sign-in counts stay so we can stop PIN guessing.
• LogRocket recordings: kept for a limited time, then deleted by LogRocket.
• 2FA codes and quick notes: on your device until you delete them or clear the app's or browser's site data.

Deleting your account

You can delete your account yourself in Settings, or ask us by email if you can't sign in. The Delete your account page explains the steps, what we delete, and what we keep.

Children

LoginScout is not for anyone under 18. We do not knowingly collect data from children. If you think a child has an account, email us and we will delete it.

Your rights

You can ask what we hold about you, ask us to correct it, or ask us to delete it. You can download your vault any time with Export in Settings. Depending on where you live, you may have more rights under local law. Email huz@loginscout.com and we will reply within 30 days.

Changes to this policy

If we change this policy, we update the date at the top of this page.

Contact

Privacy questions: huz@loginscout.com or Contact us.