What happens when intimate data leaks

Most data breaches are an inconvenience. You change a password, you watch a card for a few months, and within a year it has stopped mattering.

Breaches involving intimate data behave differently, and the difference is not about volume or severity in the usual sense. It is about what cannot be undone.

Why it is a different category

A password can be changed. A card can be reissued. What somebody wrote to their partner cannot be revoked, and neither can the fact that a particular person had an account somewhere.

Existence is often the whole payload. In several well-documented breaches of services people used privately, the email addresses alone were sufficient to cause serious harm, before anyone read a single message. Ashley Madison in 2015 is the canonical example and the consequences for individuals were severe and in some cases irreversible.

The second property is permanence. Leaked datasets do not get deleted. They circulate, they get indexed, they get merged with other datasets, and they resurface years later.

You can change every credential you have. You cannot change the fact that a record exists.

The merge problem

An individual breach often looks harmless. An email address and a timestamp.

The risk comes from combination. An address from one leak plus a phone number from another plus a location history from a third produces a profile that none of the three contained.

This is why "it was only email addresses" is a weaker reassurance than it sounds, and why data minimisation matters more than breach response.

What actually reduces the risk

Only one thing meaningfully: the data not existing in readable form in the first place.

Everything else is mitigation. Good security practices reduce the probability of a breach and do not change what a breach exposes. Retention limits reduce how much is exposed. Encryption where the operator holds the key protects against some attack shapes and not against an attacker who reaches the running system.

End to end encryption is the only arrangement where a full compromise of the servers does not expose content, because the content is not there in a readable form to expose.

It does not protect metadata. An attacker would still learn that two accounts existed and were paired and were active on particular days. That is a real exposure and it is a much smaller one.

Questions worth asking of any intimate service

What would an attacker who fully compromised your servers be able to read?

How long do you keep data after an account is deleted?

Which third parties receive any of it?

Is there a published security contact and a history of responding to reports?

The first question is the one that separates architectures. Everything else is practice, and practice changes with management.

Where Duoheart stands

Content, which is questions, answers, messages and calls, is encrypted on the devices with a key generated there and never sent to us. A complete compromise of our infrastructure would not expose it, because we do not hold it in readable form.

It would expose the existence of accounts, the pairing between them, and subscription and activity information. We are not going to describe that as nothing.

We also collect less than we could, which is the least glamorous privacy measure and among the most effective. Data that was never collected cannot leak.

What to do as a user

Use an address that is not your primary one for services of this kind. Delete accounts you do not use, properly rather than by uninstalling. And assume, for anything you put into any service, that a copy could exist somewhere in ten years, because for most services that is simply true.