Hm...
The tool hashes the email you entered and uses only this hash to perform a search in our database
Not quite what I expected. They might still hash it server side though, but with these kind of tools I'd expect them to do it client side. At least when I allow them to run js.