Privacy Shield: Hide Your Email From Public Breach Searches

Here is an uncomfortable property of every public breach checker, including mine: anyone can search anyone.

That is mostly fine, and mostly how it should be. Breach awareness works because checking is frictionless. But “mostly” carries real exceptions. If you have a stalker, an abusive ex, or a harasser, “which breaches is this person in, and what leaked about them” is information you do not want a stranger assembling in ten seconds.

Privacy Shield exists for exactly this. It is free and takes about two minutes. There is one thing worth knowing before you switch it on, and I will come to that.

What Shield does

Turn it on, and your email address stops coming back in public results on XposedOrNot. Specifically, once your address is shielded:

• It is not returned in any public search or lookup.
• It is not returned through the public API either, so a script cannot walk around the website to get it.
• It is no longer indexed for search.
• It is not shared with any third party.

You still see your own results. Shield hides you from everyone else, not from yourself. Sign in and your own exposure is still all there, breach by breach, exactly as before. Protection without blindness.

What Shield does not do

Honesty over comfort:

• It does not remove your data from the breaches themselves. That data sits on criminal forums and in copied files regardless of what any search tool displays. Shield controls what comes through our front door. It cannot reach into a file someone downloaded two years ago.
• It does not cover other breach-search services. Every service sets its own policy. If you are managing a serious safety situation, it is worth checking what the others offer.
• It does not stop someone who already holds a specific dataset. It stops the casual, the curious, and the quietly-building-a-profile crowd, which in many harassment situations is a large share of the actual threat.

If Shield were a lock, it locks our door. It is a good door and worth locking. It is not the only door in the world.

Before you turn it on: this is meant to be permanent

Shield has no off switch on the site. We built it that way on purpose. If a setting is protecting you from someone in your own house, it should not come undone because they picked up your phone.

So if you later want your address searchable again, you write to us and ask, and we lift it. It is a slower door on purpose.

Turning it on

There is one process, and two places to start it. Both send a confirmation email, and Shield switches on only when you click the link inside. Nobody can shield your address except you, because the link goes to your inbox.

Starting from the Shield page, if you are not signed in:

1. Go to xposedornot.com/shield
2. Enter the email address you want hidden.
3. Click Activate Shield. The page will say “Shield Added Successfully” here. It is not on yet. That message only means the email has gone out.
4. Open that email and click the link inside. This click is what switches it on.

What comes back is an acknowledgement:

The email lands within a minute or so. The link inside is the actual switch:

One click, and that is the whole thing:

Starting from your dashboard, if you are already signed in: open My Dashboard, find Privacy in the left menu, then click Enable Shield. It already knows your address, so there is nothing to type. You still get the same email, and you still have to click it.

How to know it actually worked

Two ways, and use both.

Your dashboard is the honest answer. The Privacy panel reads your live status straight back and shows Enabled once Shield is on. If it says Enabled, it is on. The Shield page does not report status, so if you started there, the dashboard is where you go to confirm.

Then check it the way a stranger would. Search your own address on the public site and watch it come back empty.

Who should turn this on

• Anyone managing a harassment or stalking situation. This is the primary audience and the reason the feature exists.
• Executives and public-facing people, whose scattered exposure gets assembled into a convincing phishing pretext. If you are protecting a whole leadership team rather than one address, free domain monitoring covers the other direction.
• Journalists, activists, healthcare and legal professionals, and anyone whose adversaries do homework.
• Anyone who would simply rather not be searchable. No justification required. It is your address.

Why this is free

Some services sell “remove your data” as a premium upgrade, which has always sat wrong with me. Charging the vulnerable for their own safety is a strange business to be in. To be fair, the services that delete records at the source across data brokers are doing a different and harder job. The narrower point still stands: controlling whether you are findable here costs nothing, and the code enforcing it is public.

Check your exposure first, then decide: xposedornot.com. Ten seconds, free. And if you would rather not be findable, that is two minutes more.

If the project is useful to you, a star on GitHub helps other people find it.

Devanand Premkumar, founder, XposedOrNot

—