Privacy Policy

About this policy

Have I Been Squatted, Inc. (“we”, “us”, “our”) operates the report site at report.haveibeensquatted.com (the “Report Site”) and the Have I Been Squatted browser extension (“Browser Protection”). This policy explains what information these two products collect, how we use it and the choices you have. We are responsible for this information. Our address is 169 Madison Ave STE 15078, New York, NY 10016, United States.

This policy is separate from our main Privacy Policy, which covers haveibeensquatted.com, accounts and our paid services. If you also use those, the main policy applies to that use.

What Browser Protection sends

Browser Protection checks the sites your browser loads, including frames embedded in a page, against our domain analysis service at api.haveibeensquatted.com. For each automatic check it sends one item: the hostname, such as login.example.com. Like any web request, the check also carries your IP address and browser user agent; see Request logs.

An automatic check never sends:

• the rest of the address, such as paths and query strings;
• page content, form entries, passwords or cookies;
• your stored browsing history, or an identifier for you, your browser or your installation.

A report you choose to send is different: it can include page details and a screenshot. See What a report contains.

Many hostnames never leave your browser. Browser Protection answers locally for browser pages, IP addresses, localhost and .local names, single-label names, bare public suffixes, sites you mark as trusted and hostnames it checked recently. It does not run in Incognito windows.

Browser Protection contains no analytics, advertising or tracking code. Apart from the optional email feature below, which reads a message from the email service you already use, it connects to no server other than api.haveibeensquatted.com.

Email checking in Gmail and Outlook

Browser Protection can check the links in emails you open in Gmail or Outlook on the web. This feature is off until you turn it on, and you can turn it off at any time.

When it is on and you open a message, Browser Protection asks Gmail or Outlook for that message through the session you are already signed in with. It reads the message in your browser and extracts the hostnames it contains, such as those of its links. Only those hostnames are sent for checking, as described above. The message text, attachments, email addresses and your sign-in session never leave your browser, and Browser Protection does not store the message.

What stays on your device

Browser Protection keeps the following in your browser's extension storage. It is not sent to us.

• Recent results: hostnames it checked and their verdicts, for 1 to 48 hours depending on the verdict.
• Sites you mark as trusted, and your settings.
• A short history of your reports: the domain, the category, the date and the kind of evidence you included. It holds at most 20 entries, each for up to 30 days, and never stores addresses, your comments, page details or screenshots. You can clear it in the extension's options.
• Report drafts and screenshots while you prepare a report. They are deleted when you cancel the report, leave the page or close the tab, or after a short time.
• Developer diagnostics, only if you turn them on: the hostnames it checked, their verdicts and timings. Records older than 24 hours are removed while the extension runs, and all records are cleared when you turn diagnostics off or close the browser.

Removing Browser Protection deletes all of this information.

What a report contains

You do not need an account to send a report, and we do not ask for your name or email address. A report contains only what you enter or choose to include.

• Site reports contain the addresses you enter, the category and any comment. Full web addresses are sent as you enter them, so remove anything personal, such as a token in a link, before you submit. Depending on the detail level you choose, a site report also contains no browser details (Minimal), the family and major version of your browser, browser engine and operating system with your device type (Balanced), or their full versions (Detailed). A report never contains your full user agent string.
• Email reports start from a saved email file (.eml or .msg). Your browser opens the file and shows a preview; nothing is sent to us until you press Submit. The preview does not load images or other content from the sender's servers unless you press Load images and confirm. Loading them can show the sender your IP address and that the message was opened. By default the report contains the whole message with its attachments and links. A whole message includes its headers, which usually show your own email address and name as the recipient, and it can contain other personal details. If you choose Links only, the report contains the links you select, the sender's domain, the category and any comment, and not the message. A selected link can itself contain personal information, such as an email address in a tracking link.
• Reports from Browser Protection open on the Report Site, ready for you to review; nothing is sent until you press Submit. At the Minimal level the report contains the site's domain. Balanced and Detailed add the page address, title and description, the redirects that led to the page and summary signals about the page, with personal information removed in your browser first, plus browser details as described above. A screenshot is optional. Browser Protection masks it automatically, and you can hide more of it before you submit.
• Mistake reports, which tell us a site was wrongly flagged, contain the hostname, a reason and any comment.

Security checks on the Report Site

When you press Submit, the Report Site runs an invisible check that tells people apart from automated abuse. To do this it collects information from your browser and device. Our hosting provider runs this check; see Service providers.

We use your IP address to verify that check and to limit each address to 5 reports a minute. We do not store your IP address with your report. The Report Site sets no cookies of its own and contains no analytics or advertising code.

Request logs

Every request to the Report Site or our analysis service carries your IP address, your browser's user agent string, the requested address and the time. For Browser Protection, the requested address contains the hostname being checked.

Our request logs keep this information for 7 days, after which it is deleted automatically. We use these logs only to run, secure and fix our services. They never contain the contents of a report.

To limit how often one connection can use it, the analysis service may keep a counter named after a one-way hash of your IP address. The counter holds request times only.

We run on Cloudflare, which also processes this information to operate and protect its network, as described in Cloudflare's privacy policy.

Domain analysis data

When Browser Protection checks a hostname, our service analyzes that domain. We may keep the result for up to 24 hours to answer repeat checks faster, and we may keep the domain and our findings about it in our domain intelligence data. These records describe domains, not people. They do not contain your IP address, your user agent or any identifier for you or your browser.

How we use and share reports

We use reports to:

• investigate the reported site or email;
• improve how Have I Been Squatted detects malicious and lookalike domains;
• warn people, including our customers, about the site;
• ask hosting providers, domain registrars, email providers and blocklist operators to block or remove the site.

For this we share evidence about the reported site or email with those providers, such as its domain, addresses, screenshots, page details and the reported message's links and content. A shared message can show your email address; to leave the message out, choose Links only. Those providers may pass the evidence on to the operator of the reported site.

We do not use reports to contact you, even when a reported message shows your email address, and we do not reply to reports.

Where reports are kept, and for how long

Reports are stored in a private system that only the Have I Been Squatted team can read. We delete reports 90 days after we receive them.

Evidence we have already shared with a provider to block or remove a site is kept by that provider under its own policy. What we learn about a malicious domain, as opposed to the person who reported it, may stay in our domain intelligence data for longer.

Service providers

We use these providers to run the Report Site and Browser Protection:

• Cloudflare: hosting, network, security checks, the analysis service and request logs.

We may use other providers to store and review reports. Our providers process information to provide their services to us. Cloudflare also uses information from its security check to improve its bot detection. For that use it is an independent controller, as described in the Turnstile Privacy Addendum.

We do not sell your information

We do not sell personal information, share it for cross-context behavioral advertising, or use it to build a profile of you. Browser Protection shows no ads, and we do not buy or sell browsing data. We do not track you across other sites, so we do not change how we handle your information when your browser sends a Do Not Track or Global Privacy Control signal.

Chrome Web Store Limited Use

Browser Protection's use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use the hostnames Browser Protection sends only to provide and improve its protection against malicious domains. We do not transfer them for any other purpose or use them for advertising, and we do not let people read them unless it is necessary for security, to comply with the law, or you agree.

Legal requests

We disclose information to law enforcement or other authorities when the law requires it, such as for a valid subpoena or court order, or when we believe in good faith that disclosure is necessary to prevent death or serious physical harm. We review each request and disclose the information it requires. The information we hold is what this policy describes, such as a report within its 90 days or a request log within its 7 days.

Your choices and rights

• Choose the Minimal detail level, or Links only for email reports, to send less.
• Turn off email checking, clear your report history or remove Browser Protection at any time.
• To see or delete a report, email privacy@haveibeensquatted.com with the reference shown after you submit it. Reports are not linked to you, so without the reference we may not be able to find yours.

Depending on where you live, including the European Economic Area, the United Kingdom and California, you may have the right to access, correct, delete or receive a copy of your personal information, to restrict or object to how we use it, and to complain to a data protection authority. We will not treat you differently for using these rights.

Where the law requires a legal basis, we process this information because it is necessary for our legitimate interests in protecting people from phishing and fraud and in keeping our services secure.

Where information is processed

We are based in the United States and process information there. Our hosting provider also processes it in the other countries where its network operates. Where data protection law requires a safeguard for information processed outside your country, our providers rely on the EU-U.S. Data Privacy Framework or standard contractual clauses. To get information about these safeguards or a copy of them, email privacy@haveibeensquatted.com.

Children and teens

The Report Site and Browser Protection are not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you are under 18, or under the age of majority where you live, use them only with the permission and guidance of a parent or guardian. Reports may contain personal information, so choose the Minimal detail level and, for email reports, Links only; see Your choices and rights. If you believe a child under 13 has sent us personal information, you or a parent or guardian can contact us and we will delete what we can find.

Changes to this policy

If we make a material change to this policy, we will update the date at the top and describe the change on this page before it takes effect. If Have I Been Squatted is involved in a merger, acquisition or sale of assets, the information described here may transfer, and this policy will continue to apply to it.

On October 17, 2026, we lowered the age requirement from 18 to 13 and added guidance for people under 18.

Contact us

For questions about this policy or your information, email privacy@haveibeensquatted.com or write to Have I Been Squatted, Inc., 169 Madison Ave STE 15078, New York, NY 10016, United States.