← Back to sign in

Privacy Policy

Effective Date: 27 September 2026 Data Controller: o2co Data Protection Contact: [email protected]

If you are an EU/EEA, UK, or Swiss resident, you have specific rights

under the GDPR / UK GDPR / nFADP. Those rights are summarised in

Section 6.

1. What We Collect

1.1 Account data

  • Username (your choice)
  • Password hashes — argon2id; we never store or see your plaintext password
  • Email (optional)
  • Display name (optional, internal-only)
  • Plan and billing state (tier, current period, monthly cap, credit balance)
  • Consent timestamps — when you accepted the Terms and (separately) when you toggled GDPR data-processing consent

1.2 Connection metadata

Every SOCKS5 session writes one row to our connection_log table containing:

  • Closed-at timestamp
  • Source IP (the IP that connected to our gateway)
  • Egress IP / ASN / country (the IP your traffic exited through)
  • Target host (the destination hostname or IP you connected to)
  • Byte counts (in / out)
  • Session duration
  • Outcome (ok, error, denied, ...)

We do not log payloads. We only log the metadata listed above.

1.3 Usage events

Aggregate per-minute byte counters per customer, partitioned monthly.

1.4 Audit log

Every action on your account — by you, by an operator, by our automated systems — writes an audit_log row containing the actor, the action, the affected entity, and a payload.

1.5 Diagnostics / IPv6 site test

If you run a site test from the portal, we record the URL you tested and the test result. This is opt-in (you click "test").

2. Why We Collect It

Purpose Legal basis (GDPR Art. 6)
Operate the Service you signed up for Contract (Art. 6(1)(b))
Bill you Contract (Art. 6(1)(b))
Detect abuse and prevent fraud Legitimate interest (Art. 6(1)(f)) — we have an obvious interest in not being used to launch DDoS / serve malware C2
Comply with legal requests and tax law Legal obligation (Art. 6(1)(c))
Improve the Service (anonymised analytics) Legitimate interest

We do not sell your data. We do not share it for advertising. We do not use it to train AI/ML models.

3. Retention

Data Retention
Account row Until deletion request + 30 days grace
connection_log 14 days (configurable, capped at 90 days)
usage_events 13 months (one full billing-year)
audit_log 7 years (compliance / forensics)
customer_refresh_tokens 30 days (revoked rows purged after 7)
abuse_signals Indefinite (immutable record of resolved abuse)
Billing records As required by tax law in our jurisdiction (typically 7 years)

When you delete your account (Section 6), we soft-delete immediately and physically purge after 30 days via the gdpr_hard_delete worker. The grace period lets you (or our operator) reverse an accidental delete.

4. Who Sees Your Data

4.1 Operator staff

A small number of named operators have read access to the customer panel for support and abuse review. Their actions are logged in audit_log.

4.2 Upstream proxy providers

When you route traffic through the Service, your target hostname and byte counts are visible to the upstream provider whose IP your traffic exits through. We do not share your username, email, or other PII with upstream providers.

4.3 Cloud and infrastructure providers

We host the Service on dedicated servers operated by NoCix (United States), with Cloudflare (network edge and DNS) and Hurricane Electric (IPv6 connectivity). We also use Resend to send account email, Stripe to process card payments, and — where enabled — Google Analytics to measure sign-ups and purchases. These providers process your data only as needed to operate the underlying infrastructure (Sub-processors).

4.4 Law enforcement

We may disclose data in response to a valid legal request (subpoena, court order, MLAT, EU Production Order). We require a binding instrument; we do not respond to informal requests.

5. International Transfers

Our Service operates from the United States (servers) and the United Arab Emirates (operator). If you connect from the EU/EEA, your data may be transferred to that location. Where transfers leave the EU/EEA, we rely on the European Commission's Standard Contractual Clauses.

6. Your Rights

If GDPR / UK GDPR / nFADP applies to you, you have the right to:

  • Access — Get a copy of the data we hold on you. Use the Export button on /privacy-controls in the customer portal — it produces a JSON dump within seconds.
  • Rectify — Correct inaccurate information via the portal Account page.
  • Delete ("right to be forgotten") — Use the Delete button on /privacy-controls. Requires re-entering your portal password. We soft-delete immediately and hard-delete after 30 days.
  • Object to processing — Toggle the GDPR consent flag on /privacy-controls. Note that some processing (operating the Service, billing) is contract-necessary and cannot be opted out of while you remain a customer.
  • Data portability — The export endpoint returns machine-readable JSON.
  • Withdraw consent — Toggle off on /privacy-controls.
  • Lodge a complaint with your national supervisory authority (in the EU: your country's data-protection authority; in the UK: the ICO).

All requests via the portal complete automatically. For anything that needs operator intervention, contact [email protected]; we will respond within 30 days (GDPR deadline).

7. Cookies

The customer portal uses three cookies, all functional:

  • ps_cust_refresh — httpOnly refresh token (90-day expiry)
  • ps_cust_csrf — CSRF token (mirrored into the X-CSRF-Token header by the portal SPA)
  • consent_accepted — local-storage flag set when you click "Accept" on the cookie banner

We do not use advertising or analytics cookies.

8. Children

The Service is not directed at children under 18. If we learn we have collected data from a child under 18 we will delete it.

9. Security

  • All credentials are stored as argon2id hashes.
  • Provider API tokens are encrypted at rest with AES-256-GCM keyed off our master key (kept off-server in our deployment runbook).
  • TLS 1.2+ is required for every panel / portal connection (enforced at Cloudflare).
  • Audit-log entries are append-only.
  • Customer-portal cookies are HttpOnly, Secure, SameSite=Lax; CSRF protection is double-submit on every mutating cookie-auth endpoint.

We have a security audit document at docs/architecture/customer-portal-security-audit.md.

10. Changes to This Policy

We may update this Policy. Material changes are announced via the customer portal at least 14 days in advance. The Effective Date at the top reflects the current version.

11. Contact

[email protected]