Introducing My Circle: Breach Monitoring for Your Family
You are the family tech person. When a parent gets a “your account was found on the dark web” email, it gets forwarded to you. When a sibling reuses one password across nine sites, you are the one who finds out after something breaks.
Ten days ago, I shipped My Dashboard, a breach command center for your own email, and promised that family monitoring was coming. This is it. My Circle brings the people you look after into that same dashboard, and it does so the only way I was willing to build it: with their explicit permission, revocable at any time.
What is My Circle
My Circle is a new panel inside My Dashboard. You add the email addresses of family members and friends you want to keep an eye on. Each of them gets an invitation. If they accept, their breach exposure appears alongside your own: which breaches, what data types leaked, and how it adds up. If they decline, you see a polite “declined” and nothing else, ever.
You can watch over up to 25 people. It is free, like the rest of XposedOrNot. No plan, no trial, no card.
Consent is the feature, not the fine print
Anyone can type any email into a public breach search. That has always been true, here and everywhere else. What a public search will not give you is ongoing visibility into another person’s exposure, and it should not. The line between “caring family member” and “person keeping tabs on someone” is consent, so I built the consent step into the product instead of leaving it to good intentions.
Here is how the flow protects the person you invite:
- Double opt-in, enforced server-side. You see nothing about them, not even a breach count, until they click accept. There is no preview and no partial view.
- They see who is asking. The invitation names your email address. No anonymous invites.
- Decline means decline. A declined invite shows you a status and nothing more, and that person cannot be re-invited for 30 days. Pestering is rate-limited by design.
- They can leave at any time. Every accepted contact keeps a standing withdraw link: one click, one confirmation, done. The moment they confirm, their data disappears from your circle, and you get a plain notice that they withdrew. No guilt trip, no dark patterns.
- Invites expire. A consent link is valid for 7 days, with at most two gentle reminders. If they never respond, you never see anything.
The awkward part of protecting your family has always been the conversation. My Circle does not remove the conversation, and that is deliberate. It just means you only have to have it once, and the product remembers the answer.
Setting it up
- Sign in at xposedornot.com/login and open My Dashboard.
- Find the My Circle panel and enter the email address of someone you look after.
- They receive an invitation explaining who asked and what they are agreeing to, with accept and decline buttons side by side.
- If they accept, they get a confirmation that monitoring is on, and you get a notice that they said yes. Their breach exposure appears in your circle within moments.
That is the whole setup. The slowest step is the human one, and for most families that is a text message: “I sent you a thing, it is legit, press accept.”
Already convinced? Your dashboard is at https://xposedornot.com/my-dashboard. The rest of this post covers what you see once someone accepts, and where the boundaries are.
What you see once they accept
For each accepted person, My Circle shows their breach history the same way My Dashboard shows yours: breach cards with logos, the exposed data types color-coded, and sensitive breaches flagged. Every breach title links to its full detail page, so “mum was in a 2019 breach” turns into “here is exactly what leaked and here is what to change.”
This is what turns the panel from a curiosity into a to-do list. When you can see that a specific account leaked a password for a specific person, the next conversation is concrete: change that one, turn on two-factor there, stop reusing this.
What you do not see, and what they keep
This section is the contract, so let me be precise.
- You see breach data from my public catalog: breach names and exposed data categories, organized and kept current for you.
- You do not see passwords, message contents, live locations, or anything from their inbox or devices. XposedOrNot does not have those things for your own account either.
- The person monitored keeps a standing withdrawal link. It works for a year from issue and takes a single confirmation. And opting out of XposedOrNot alerts entirely removes every inbound monitor on their email at once.
- The person you monitor is notified at every step: when you ask, when they accept, and their withdrawal link is theirs to use without asking you. There is no monitoring they never agreed to.
And you do not have to take my word for any of this. The entire feature is open source, server and site both. The consent logic lives in monitor.py in the XposedOrNot-API repo if you want to read exactly what happens when someone clicks accept, decline, or withdraw.
The limits, and why they exist
My Circle caps you at 25 monitored contacts, and that count includes pending invites. Invitations to any one person are throttled to 3 per hour and 10 per day, consent links die after 7 days, reminders stop at two, and a decline locks re-invites to that person for 30 days.
None of that is a free-tier squeeze. The caps are the design. A tool that lets one account spray unlimited monitoring requests at strangers is a harassment tool with a family-friendly landing page. The cap and the throttles keep My Circle sized for the thing it is actually for: the small set of people whose security you genuinely carry.
Get started now
My Circle shipped in the open across both repos this week. The notable commits:
API (XposedOrNot-API):
- 8666672 monitor family/friends breaches with double opt-in (the core: invite, accept, decline, withdraw, tokens, reminders)
- 46fe873 allow monitor re-invites via a per-pair invite throttle
- d015dd2 surface monitored-contact withdrawals to the requester
- 190f7f7 per-decision copy for the requester notice emails
Website (XposedOrNot-Website):
- e722499 add the My Circle consent-based monitoring panel
- dc8e988 expand circle breaches with logos and leaked data
- 44751fe link breach titles, color exposed data, flag sensitive breaches
- 3e88e7b show withdrawn contacts in My Circle
If you read the code and spot something, issues and PRs are open. That is the point of building this in public.
Check out some of our posts for you.
