Privacy Policy · Proxify

Information we collect

Account information

Your email address, which identifies your account.
Your password, stored only as a bcrypt hash. We cannot read it.
If you buy a paid plan, payment is handled by our payment processor. We do not receive or store card numbers.

Usage information

Request counts per API key, per month, which drive your quota and the usage charts in the dashboard.
The configuration you give your keys, such as allowed origins, and the projects you create.

Security and audit records

Account actions such as signing in, signing up and changing a key are recorded with the IP address and browser user agent that made them.
Our servers log technical events, which can include an IP address and the request path when a request is rejected, rate limited or flagged by our security filters.
Counters of failed sign-in attempts per email address and IP address, kept for a short window to stop password guessing.

Requests you send through the proxy

We forward each request to the address you name and return the response. We do not keep a copy of request or response bodies, unless you turn on recording for a key: recorded responses are stored so they can be replayed, until you delete them.
Response bodies may be scanned in transit to mask personal data such as email addresses, phone numbers and card numbers.
Upstream credentials you store in the secrets vault are encrypted at rest with AES-256-GCM and substituted into requests only for the hosts you allow.

How we use information

To provide the service: authenticate you, enforce your key settings and quotas, and show your usage.
To protect the service and its users from abuse, fraud and attacks.
To answer your questions and tell you about changes that affect your account.
To meet legal obligations.

We do not sell personal information, and we do not use it for advertising.

How long we keep it

Account information and key configuration: for as long as your account exists.
Audit records of account actions: 90 days.
Records of payment-provider events: 30 days.
Monthly usage counts: for as long as your account exists, so the dashboard can show your history.

Cookies and local storage

We use only what the service needs to work:

Two session cookies hold your sign-in. They are HttpOnly, Secure and SameSite=Lax, so scripts on the page cannot read them.
A short-lived cookie carries a one-time message, such as “Saved”, from one page to the next.
Your colour theme choice, if you make one, is kept in your browser’s local storage.

We do not use advertising or third-party tracking cookies.

Service providers

Cloudflare serves this website and sits in front of our API, so it processes the requests you send us.
Our payment processor, if you buy a paid plan, processes your payment details.

Each receives only the information it needs to do its part.

Security

All traffic to the website and the API is encrypted with TLS.
Passwords are hashed with bcrypt, and stored upstream credentials are encrypted at rest.
Session cookies are inaccessible to page scripts, and the site sends a strict content security policy.

Your rights

You can ask us to give you a copy of your personal information, correct it, delete your account and its data, or stop processing it. Depending on where you live, laws such as the GDPR or the CCPA may give you further rights. Email support@proxifyedge.com from the address on your account and we will respond within 30 days.

Children

The service is not intended for children under 13, and we do not knowingly collect their information.

Changes to this policy

We will update the date at the top when this policy changes, and email account holders about material changes before they take effect.

Contact

Questions about this policy: support@proxifyedge.com.