Privacy policy
The short version
We log connection metadata because it is what makes the meter auditable and lets us respond to abuse reports. We do not log the contents of your traffic. We keep logs for 30 days. We do not sell anything to anyone.
What we collect
Account data. Email address, and payment identifiers from our processor. We do not receive or store full card numbers. For a crypto top-up we keep the address the payment was sent from, because that is where a crypto refund goes. If you paid from an exchange and ask us to refund to your own wallet, we keep the exchange withdrawal record you show us and that wallet's address. If a card refund has to go by bank transfer instead, we keep the bank account details it is paid to and the identity check we ran first.
Connection logs. For each request: timestamp, destination hostname, HTTP method, response status code, bytes sent, bytes received, and which of your credentials was used.
Website analytics and cookies. This marketing site sets one cookie of its own that you cannot switch off: the record of your cookie choice. Analytics and advertising measurement load only as your cookie settings allow, and where the law requires us to ask, you are asked first. Every cookie and what it is for is listed in the cookie policy, and Cookie settings in the footer changes your choice at any time.
Support chat. The chat on this site is loaded from support.proxymonkey.io, our own support host, and only if your cookie settings allow preferences cookies. It keeps a conversation cookie so a chat started here carries on in your dashboard. This site sends it no name or email address.
What we do not collect
- Request bodies or response bodies
- Full URLs including paths and query strings — hostname only
- Credentials, cookies or tokens you send through the proxy
- Anything decrypted from a TLS tunnel. We cannot see inside it.
Why we collect it
- To bill you accurately, and to let you check us. The per-request log is the same data your usage export shows.
- To respond to abuse reports. When someone reports that traffic from our network attacked them, connection metadata is how we identify and stop it.
- To keep the service working. Diagnosing failures, capacity planning, detecting pool problems.
How long we keep it
Connection logs are deleted after 30 days. Account and billing records are kept for as long as tax and accounting law requires, typically six years, and then deleted.
Who we share it with
Our payment processors, for the purpose of taking payment. Our infrastructure providers, as processors, to run the service. Law enforcement, where we receive a valid, binding legal order — and we will tell you unless we are legally prohibited from doing so.
Nobody else. We do not sell, rent or trade user data.
California residents (CCPA)
No personal information of yours is sold or shared, as those terms are defined under the California Consumer Privacy Act. The rights described below apply to you under the CCPA the same way they do under UK/EU law, and you can exercise them the same way.
Your rights
If you are in the UK, EU, or another jurisdiction with comparable law, you can ask us for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Email [email protected] and we will action it within 30 days. Account and billing how-tos are in the help centre.
Deleting your account deletes your connection logs immediately rather than at the 30-day mark.
Where data lives
Account data and logs are stored in the EU. Traffic itself is proxied through exit nodes in whichever country you request, which is the point of the product.
Residential network participants
People whose connections form part of our residential pool opt in through a paid SDK partner, are told in plain language what their bandwidth is used for, are paid for it, and can withdraw at any time. We describe this further on the honesty page.
Changes and contact
Material changes are announced in Discord and by email before taking effect. Questions go to [email protected].