Privacy

Privacy policy

Last updated 2026-11-09

Agent Leak Test exists to help you protect your personal data, so we collect as little as we can. This page explains exactly what happens when you use the site.

The short version

• We never store your email address. We store only a masked form, like j***@g***.com.
• We never store IP addresses. Our visitor counter uses them briefly to tell visitors apart, then discards them.
• Everything about a test is deleted 1 hour after the test is created.
• Request logging is switched off for our server code.
• No accounts, no advertising, no ad trackers, no cookies for statistics.

What we store during a test

When you start a test, we create a random test ID and store which tool you chose and when. When a request arrives at your test URL, we store:

• the time, the HTTP method (such as GET) and the status code we replied with;
• the request headers, with every email address masked and each value cut to 200 characters;
• for sensitive headers such as Authorization and Cookie, only the header name, never its value;
• whether we found an email address or placeholder, its masked form, and where it was (for example, the User-Agent header).

We read up to 10 KB of each request body to look for email addresses, but we don't store the body. We drop headers that carry IP addresses before anything is saved.

How long we keep it

Test data is kept for 1 hour. Each time anyone starts a new test, we delete every test and request older than 1 hour, and we never show test data older than 1 hour, even if it hasn't been deleted yet.

Public stats

When a test reaches a result, we add 1 to a daily total for that tool and result (for example: 2026-11-08, Cursor, passed). That's all we keep long-term. It can't be linked back to you or your test.

The API key test

The API key test puts a fake key in your prompt. We create that key at random for your test and keep it, with the test, for 1 hour so we can recognise it. It isn't personal data and works nowhere. If a request holds something that looks like a real secret (for example a real API key or token), we never store it: we replace it before saving anything and only keep the fact that it happened, so your results page can warn you to rotate it.

Visitor statistics

We count page views and a few actions: starting a test, seeing a result, copying the test prompt, and opening an FAQ answer. We use two tools, and neither sets cookies:

• Our own visitor counter, running on a server we operate. Your browser sends each report to this website, which rebuilds it from a fixed list of fields before passing it on: the page address (without query details), the website you came from (domain only), screen size and browser language. To tell visitors apart and show the country, it also passes your IP address and browser type to our counter, which turns them into an anonymous visitor ID and country and does not keep the IP address.
• Cloudflare Web Analytics, which counts page views without cookies or fingerprinting. It is not loaded on your private results page.

No page view is sent for your private results page. Actions on that page are counted under a generic address, without your test ID. Nothing about your test, the requests your AI sent, or any email address is sent to either tool.

Our hosting provider

The site runs on Cloudflare. Like any network provider, Cloudflare processes IP addresses to deliver traffic and protect against attacks, under its own privacy policy. We have switched off request logs for our own code and don't receive or store your IP address. To stop anyone flooding the public stats, Cloudflare's rate limiter also counts how many tests are started from each IP address per minute. That counter runs inside Cloudflare and we never see it.

Things to know

• Anyone who has your results link can see your results until they are deleted. The link contains a long random ID that can't be guessed. Don't post it publicly.
• If your AI sends something sensitive other than an email address, such as a name in a URL, it may appear in the stored headers or URL for up to 1 hour.

Who is responsible

This site is run by Agent Leak Test (agentleaktest.com), which decides how the data described here is used. Contact:hello@agentleaktest.com.

Why we process this data

• Running your test (test ID, masked request details): to provide the test you started.
• Rate limiting, public stats and visitor statistics: our legitimate interest in keeping the site working, preventing abuse and understanding which pages are useful, with the safeguards above (no stored IP addresses, no cookies, masked emails, 1-hour deletion).

Cloudflare hosts the site and provides Web Analytics; it may process data in countries other than yours under its own safeguards. We don't sell data or share it with anyone else.

Your rights

Depending on where you live (for example under the EU GDPR or Korea's Personal Information Protection Act), you can ask to see, correct or delete personal data about you, ask us to stop or limit processing it, and object to processing based on our legitimate interests. Email us and we will reply within 30 days. Because we keep no names, accounts, IP addresses or full emails, and delete test data after 1 hour, we usually hold nothing that we can link to you. If your results page is still open, it contains the only copy of your test, and it disappears on its own within the hour.

You can also complain to your local data protection authority.

Contact

Questions about privacy or this policy: hello@agentleaktest.com