Privacy Policy
What data we collect, why, how long we keep it, and what your rights are.
Last updated: 20 September 2026
Short version
We do not store the request content of your protected sites' visitors. Page bodies, form data, cookie contents and personal data are not kept here. What we store is the minimum telemetry the protection needs to work.
1. Account data
At registration we store your email address, a hash of your password (PBKDF2-HMAC-SHA256, 120,000 rounds, per-user salt) and the IP address you registered from. The password itself is never stored anywhere and cannot be recovered.
2. Site configuration
The domain you protect, its origin IP address, the rules you pick and your panel settings. This data is required for protection to work.
3. Visitor telemetry
When your protected site takes traffic, the edge layer collects:
- Counters: allowed / blocked request counts, bytes transferred, cache hits
- Breakdowns: country code, HTTP method and version, browser family, device type, OS family, cache status
- For blocked requests: IP address, the rule that fired, path and timestamp
What we do not collect: request bodies, form fields, visitor cookies, session identifiers, page contents. Those are processed at the edge and none of them are written to disk.
Blocked-request records are capped at 300 rows per domain and older ones fall off as new ones arrive. Breakdown data is kept for 7 days. The counter time series is kept at minute resolution for 24 hours and hourly resolution for 30 days.
Internal network addresses (127.x, 10.x, 192.168.x and so on) never enter telemetry at all.
4. Payment data
Payments are taken in crypto through NOWPayments. No card details are held by us or by them. What we store is the invoice id, amount, currency and payment status.
5. Cookies
The panel uses exactly two cookies: a session cookie (HttpOnly, Secure, SameSite=Lax) and your theme/language preference (in your browser's local storage, never sent to the server). We use no tracking cookies, no advertising cookies and no third-party analytics scripts.
Visitors to your protected sites receive a clearance cookie only when they pass verification. That cookie does not identify the visitor; it only carries "this browser passed verification" and is bound to a subnet.
6. Data sharing
We do not sell your data and do not share it with anyone for marketing. Sharing happens in exactly two cases: invoice information sent to the payment provider, and a legally binding request.
7. Your rights
You may request a copy of the data held about your account, ask for it to be corrected, or ask for it to be deleted. Open a support ticket; it is answered within 30 days. When you delete your account, configuration and telemetry data are deleted; invoice records are kept for the statutory retention period.
8. Data location
Data is held on the servers HexShield operates for the panel and the protection layer. If you need to know where they are located, open a support ticket.
9. Contact
For any privacy question, open a support ticket from the panel or use the contact page.