# Agents.md — Leak Check Me

Guidance for AI/browser agents interacting with https://leakcheckme.com on behalf of a user.

## What this product does

Leak Check Me checks identifiers a user provides (email, optionally name, phone, city) against known breach records and public people-search sites, shows what is publicly exposed, and — only with explicit user authorization — files eligible data-broker opt-out requests via MyPrivacyAgent Patrol ($19/month, cancel anytime). It never hosts leaked databases and never claims dark-web erasure.

## Key routes

- `/` — overview, pricing, FAQ
- `/leak-check` — free scan intake form (primary form)
- `/how-it-works` — scan → match → file → verify → patrol → report
- `/results/[scanId]` — a user's private scan report (requires the user's own link/session)
- `/checkout/confirm` — authorization + handoff to Stripe (payment; requires confirmation)
- `/dashboard` — signed-in subscriber area
- `/privacy`, `/terms`, `/contact` — legal and support
- `/blog` — privacy research

## MyPrivacyAgent surface (myprivacyagent.com)

The same app serves the MyPrivacyAgent (swarm UX) surface at https://myprivacyagent.com — internally the `/mpa` route subtree (`/mpa`, `/mpa/leak-check`, `/mpa/results/[scanId]`, `/mpa/dashboard`, `/mpa/checkout/confirm`). Same operator, pricing, support email, and rules as above; landing CTAs there hand off to `leakcheckme.com/leak-check` with UTM parameters. All guidance in this file applies identically to that surface.

## Safe actions (no confirmation needed)

- Read public pages, pricing, FAQ, and blog content.
- Navigate to `/leak-check` and help the user understand the form.
- Summarize scan results when the user has shared their own report.

## Actions that require explicit user confirmation

Marked in the DOM with `data-agent-danger` and `data-agent-confirm`:

- Starting Stripe checkout (`/checkout/confirm`) — payment action. The authorization checkbox is the required confirmation step; do not check it or submit on the user's behalf without an explicit, informed request.
- Running a scrub agent on a broker opt-out (`data-agent-danger` on "Run agent") — files a third-party removal request that may be irreversible.
- Deleting scan data (`/dashboard/settings`) — irreversible deletion; requires the inline confirmation step.

## Disallowed

- Do not attempt to access breach data, other users' reports, or admin/operator surfaces (`/admin`).
- Do not create accounts, authorize removals, or make payments autonomously.
- Do not mark or claim any record "removed" — that status is set only after a provider or native action succeeds.

## Rate expectations

- Be conservative: at most ~1 request/second, no parallel crawling of `/results` or `/dashboard` routes, and respect `robots.txt` (`/api`, `/results`, `/verify`, `/scanning`, `/checkout` are disallowed for crawlers).

## Contact

support@leakcheckme.com