What data does Valid Email Checker store about my login attempts?

Every login attempt against your Valid Email Checker account — successful or not — is recorded to a login history table. The record exists for two reasons: so you can see your own login history in Account Settings and flag anything that does not look like you, and so our abuse detection can spot account-takeover patterns early. The data we capture is what you would expect from any security-aware web app, but it is worth knowing exactly what lands in the table.

What we log per login

• User ID — which account the attempt was against.
• Success or failure — boolean. Failed attempts get logged too, so brute-force patterns surface.
• IP address — the client IP we extracted from the request (after any CDN unwrapping).
• Geolocation — the city and country we resolve from the IP using our internal lookup. This is a coarse signal, not GPS-grade.
• Device name and type — derived from the User-Agent string (e.g. "Chrome on Windows", "Safari on iPhone").
• Browser name and version, OS name and version — parsed from the User-Agent.
• Full User-Agent string — kept verbatim for forensic purposes.
• Auth method — password, google_oauth, or magic_link.
• 2FA verified — boolean, plus which method (google_authenticator or email).
• Failure reason — for failed attempts, a short code like wrong_password or 2fa_failed.
• Suspicious flag — set automatically when a successful login arrives from a device we have not seen before on this account.

How the data is used

Three uses, all defensive. First, you can review your own history under Account Settings, Security tab, and see every login that ever happened on your account. If you see a session from a city you have never been in, you can change your password and revoke active sessions. Second, our abuse system flags suspicious patterns — a successful login on a brand-new device fires an alert in our internal dashboards and, on high-risk accounts, can trigger a step-up challenge. Third, in the rare event of a security incident, the log is what we use to scope blast radius.

What we do not log

• Your password (we never see the plaintext — it is hashed at the auth layer).
• Your 2FA secret or backup codes.
• API key values (only the prefix is stored, see where API keys live).
• Browsing or click activity inside the dashboard — only the act of logging in is logged here.