Privacy policy
What Leakly collects when you use the site, and how to reach us about it.
This privacy policy describes how Leakly ("we", "us") handles information when you visit leakly.com and related pages we operate. It is written for U.S. readers first and uses plain language. If something here conflicts with a later update, the version with the newest Last updated date controls.
Who we are
Leakly is a news site that reports on leaks and rumors with linked sources and status labels. We refer to the operator only as Leakly. For privacy questions, correction requests or rights requests, use the contact form.
What this site does with information
Leakly is a mostly static news site. In ordinary browsing we do not ask you to create an account, and we do not run a newsletter signup on the site today.
- Hosting and request logs: The site runs on Cloudflare Workers. Cloudflare processes HTTP requests needed to deliver pages and assets. Workers observability is enabled, so request metadata used for reliability and debugging (such as request path, timing, status and related edge logs) may be retained by our hosting provider under its terms.
- Cookies: Leakly pages do not set first-party advertising cookies, and our public front-end scripts do not write cookies for tracking. A private operator desk at /_desk/ may set a single HTTP-only session cookie after a token prompt; that path is noindex and not linked publicly.
- Local storage: Our relative-time script updates timestamps in the browser from the page markup. It does not write localStorage or sessionStorage.
- Fonts: Typography is self-hosted from leakly.com. We do not load fonts from Google Fonts or another third-party font CDN.
- Analytics: Leakly runs a first-party, cookieless analytics beacon on our own domain. It does not set cookies and does not store IP addresses. When JavaScript runs, the browser sends a small same-origin POST (or sendBeacon) to /collect with the page URL, hostname, timestamp, referrer, coarse language/screen hints, and a source label. A no-JavaScript 1x1 pixel fallback hits the same endpoint with the page path only. Cloudflare may attach coarse geo (country and city) from the edge. We store: hostname, url, timestamp, referrer, user_agent, optional status/ttfb/cache fields, a bot_class label, geo_country, geo_city, source, and an ingest time. Soft bot classification uses the user-agent string. Events are kept in a Leakly-owned Cloudflare D1 database for operating the private analytics desk (pageviews, visitors as human beacon hits, top pages, referrers, countries, bot vs human) and for site reliability. Retention follows our operational need to review recent traffic windows (on the order of months, not indefinite marketing profiles). We do not sell this data and do not use it for cross-site advertising.
- RSS: You may subscribe to our public RSS feed at /feed.xml with any feed reader you choose. Feed readers are third-party services under their own policies.
- Outbound links and X posts: Stories include static text captures of public posts and HTTPS links to sources, including x.com. We do not load X embed widgets or X scripts on our pages. If you follow a link to X or another site, that site's privacy policy applies.
- Contact form: If you submit the form on /contact/, we receive the name, email address, topic and message you enter. Submissions are emailed through our email provider (Resend) from contact@leakly.com so we can read and respond; the recipient mailbox is not published on the site. We do not store the message body in our analytics database after sending. The form is protected by Cloudflare Turnstile, a honeypot field, an origin check, and rate limits that store only an HMAC hash of the connecting IP (not the raw IP) for a short window. We keep correspondence only as long as needed to handle your request.
What we do not do
- We do not sell personal information.
- We do not host breach dumps, stolen personal files, credentials or malware.
- We do not require an account to read the news.
How long we keep information
Hosting and observability logs follow our provider's retention settings and our need to operate a reliable site. Contact-form messages are kept only as long as needed to respond and, where relevant, to keep a record of a legal or corrections request. Published articles, corrections and public source links are part of the editorial record.
Your choices and rights
Depending on where you live, you may have rights to request access to personal information we hold about you, to ask us to delete it, to correct it, or to opt out of certain sharing or sale of personal information. Leakly does not sell personal information. U.S. residents, including California residents under CCPA/CPRA-style rules, can use the contact form to make an access, deletion or opt-out request. Residents of other regions may have similar rights under local law; use the same form and tell us which right you want to exercise. We may need to verify the request before acting on it.
Children
Leakly is not directed at children under 13, and we do not knowingly collect personal information from children under 13 through the contact form.
Changes
We may update this policy as the site changes. The Last updated date at the top will change when we do. Material changes will be reflected on this page.
Contact
Privacy requests, questions about this policy, and related notices go through the contact form. We do not publish a staff mailbox on this site.