Privacy Policy

We limit operational data to what is necessary for service delivery, security, troubleshooting, abuse prevention, billing, and compliance.

Our servers record standard web-server log entries for every request, including your IP address, the browser or client identifier your device sends, the time, and the requested path. Subscription tokens and query strings are removed from these entries before they are written.

Most account, billing, and service records are kept for as long as the account exists and are not deleted automatically. Server logs containing IP addresses are kept in operational storage without a fixed expiry period.

Our systems include an abuse-investigation capability that can record the destination address, port, and protocol of a connection together with the account it belongs to. This capability is currently switched off and holds no records.

Until 22 August 2026, servers in our network recorded connection destinations together with an account identifier in system logs. That logging has been switched off across all servers. Entries recorded before that date remain in those system logs and are removed as storage is reclaimed.

We share information with service providers who operate parts of the service: payment processors, a bot-protection provider that receives your IP address when a verification challenge is shown, an email delivery provider, and a hosted database provider that receives contact-form submissions. We do not sell personal information.

When you download a client, we store a one-way, salted hash of your IP address rather than the address itself. That hash is not linked to your account, but it is stable, so downloads from the same address can be recognised as related. These records are not deleted automatically.

• ✓Account information: email address, authentication records including third-party sign-in identifiers where used, subscription status, support messages, and billing references.
• ✓Payment information: amounts, currency, status, provider transaction identifiers, and — for cryptocurrency payments — the paying wallet address and transaction hash. We do not store complete payment card numbers.
• ✓Device and service information: a device identifier supplied by the app, device platform, app version, last-seen time, connection timestamps, service region identifiers, and data usage totals.

Payment details are handled by payment processors or checkout providers. We do not store complete payment card numbers.

Service operations, support, and infrastructure may involve processing information in different countries or regions. We use this only for the purposes described in this policy.

For privacy requests, contact privacy@xxlink.net. We may need to verify your account before processing certain requests.

You can delete your account from your dashboard. Deleting your account removes your profile and sign-in credentials. Records from abuse investigations, including the connection destinations they contain, are deleted along with the account. After deletion, we retain the following records: payment records, de-identified, for provider reconciliation; scrubbed webhook and provider-event receipts, with customer identifiers removed and provider handles retained; an internal audit record of the deletion, with its identity fields cleared; and the mail-delivery records described below.

When you make a payment, we provide your email address to our payment provider as part of the transaction, and the provider retains it in its payment record. Deleting your account does not delete the provider-held record of the completed payment. We cannot remove or change that email address for you because the provider does not offer a way to change that field after the transaction is complete.

We retain technical records of the emails we send, including when a message was sent and whether it was delivered. Each record contains a partly masked address (for example, al…@example.com), the address domain, and a fingerprint of the subject line. It does not contain your full email address or the message body, and it is not deleted when your account is deleted.