Privacy Policy

What we never record

The proxy gateway counts bytes for billing. It never records the content of your traffic, and it doesn't record which sites you visit or the addresses you connect to unless you turn on site statistics for your own account (see below).

Site statistics (off unless you turn them on)

In your dashboard's Settings you can turn on site statistics to see which sites use your traffic. While they're on, the gateway keeps the name of each site your proxies connect to (for example google.com, never the full address or the pages) and the bytes per day, for 30 days. Only you see them, on your Usage page. Turning them off deletes what was kept.

What we collect

• Account: your email address and a one-way hash of your password.
• Billing: your balance, purchases, and the crypto deposit addresses and transaction IDs linked to your account. For card payments: the card's brand, last 4 digits and country, the amounts, and Stripe's payment and customer IDs. We never see or store full card numbers or security codes (CVC).
• Usage: how many bytes each proxy login used per day, and the IPs or static IPs assigned to you. With site statistics on, also the site names and bytes per day described above.
• Security: the IP address and browser of dashboard sign-ins, to protect your account. Our restricted admin panel also shows an approximate country inferred locally from signup or successful sign-in IPs, to help with account support and account administration. We do not send those IPs to a geolocation service for this lookup, and it does not identify your precise location.
• Support: the messages and files you send us.

Why

To run your account, bill usage, prevent fraud and abuse, answer support requests, and meet legal obligations. We don't sell personal data.

Cookies and storage

There are two optional choices, and you can change either one any time with “Cookie settings” at the bottom of every page: analytics (Google Analytics) and ad measurement (OpenAI and X). Each is saved in its own cookie, so declining one never turns the other off. Declining either doesn't affect your access to ProxyFall.

Analytics. We use Google Analytics to see how visitors use the site: pages viewed, roughly where from, and what kind of device. Addresses are trimmed to the page path, the admin area isn't counted, and Google's advertising features are off. Visitors in Europe (the EU, EEA, UK and Switzerland, judged by the browser's time zone) are asked first, and nothing loads until they allow it; if their browser sends Global Privacy Control, it stays off and they aren't asked. Elsewhere it runs unless you turn it off.

Ad measurement. Every visitor is asked, wherever they are, and nothing runs until you allow it. A browser that sends Global Privacy Control isn't asked and is never measured, by us or by X's pixel. What OpenAI and X receive is described below.

The cookies and browser storage the site uses:

• pf_session keeps you signed in to the dashboard (30 days). pf_pending holds a sign-in between your password and its 2-step code (10 minutes).
• pf_ft remembers how you first found us (a search engine, a link, a campaign tag) and is saved with your account if you sign up (6 months). When that was an X ad, it's only kept with ad measurement allowed.
• pf_locale remembers a language you picked (1 year).
• pf_consent (analytics) and pf_ads_consent and pf_x_consent_v1 (ad measurement) remember your choices (1 year).
• pf_evt holds a new account's sign-up until Google Analytics may count it (10 minutes). pf_internal marks the browsers of our staff and test accounts, so analytics and ad measurement stay off there (1 year).
• With analytics on: Google's _ga and _ga_… cookies (up to 2 years).
• With ad measurement on: pf_ad_visit and pf_ad_visitor remember a visit from an OpenAI ad (30 days after the last page we measured); pf_x_visit is a signed X visitor ID (90 days from your first measured visit); and X's pixel sets its own cookies, such as _twclid on proxyfall.com when you arrive from an X ad and others on X's own domains, for as long as X decides.
• Only when you start a card payment in the dashboard: Stripe.js, which takes your card details, and Stripe's own cookies, such as __stripe_mid and __stripe_sid, which Stripe uses to prevent fraud. They're needed for the payment, so they aren't one of the optional choices above, and Stripe.js doesn't load on any other page.
• In your browser's storage rather than cookies: your theme, the 3D globe's quality level and, in the dashboard, the proxy finder's strict-mode switch (until you close the tab).

If you allow ad measurement and arrive through an OpenAI ad in ChatGPT, we connect that visit to an account registration and to confirmed purchases within 30 days of the click, to measure ad performance. We then send OpenAI the ad's click reference, the event type (registration or order), an event identifier and time, a fixed page address on our site, and for orders the amount and currency. We do not send your email address, password, payment address, or proxy browsing activity. Turning ad measurement off stops new collection and queued event sharing for this browser. OpenAI visit and event records are deleted 400 days after the visit's last page. Anonymous visitors are shown with random identifiers; signed-in customers can be linked to their account in our restricted admin reports.

If you create an account, we retain its acquisition source and campaign with the account, including the original first-visit source when a later paid click is attributed to signup. Our restricted reports link that source to confirmed wallet deposits and product purchases over the account's lifetime. This does not extend the 30-day ad conversion window or send additional customer identity or wallet-deposit data to OpenAI.

Sharing

With ad measurement allowed, X (formerly Twitter) receives page views, successful signups, saved leads, checkout starts and confirmed purchases on ProxyFall, whether or not you came from an X ad. Its browser pixel can also collect the page address and browser, device and network information. Our server sends X signup and purchase event times, conversion/order identifiers, the page address and the product bought, X click identifiers, purchase totals in USD, and a SHA-256 hash of your verified email address for matching. A hashed email is still personal data; it is not anonymous. We do not send passwords, wallet addresses, proxy credentials or your proxy browsing activity to X.

X attribution uses a signed, first-party visitor cookie for up to 90 days and records first and last paid campaign touches, country inferred locally from the visit IP, and page language. Click identifiers are removed after 90 days, and X visitor and event records are deleted after 400 days; campaign summaries and account/order attribution may remain with the account and accounting records. We may use consented website audiences and verified email hashes for X retargeting and customer exclusions.

Use “Cookie settings” to withdraw permission. This stops new X collection and queued sharing for this browser and, when signed in, revokes linked visitors for your account. It cannot recall events already received by X. Contact support for removal from an already uploaded audience or an access/deletion request. X handles received information under its own privacy policy.

Card payments are processed by Stripe. The card details you enter go straight to Stripe and never reach our servers; of the payment, we keep only what is listed under Billing above. Stripe handles the information it receives under its own privacy policy.

We share data with services that help run ProxyFall (hosting, email delivery and card payments), with the analytics and advertising measurement services described above when you allow it, and when the law requires it.

How long we keep it

Account and billing records are kept while your account is open and as long as accounting law requires afterwards. Daily usage totals are kept for 12 months. Site statistics are kept for 30 days, or until you turn them off. Ad measurement records (OpenAI and X visits and events) are deleted after 400 days, and X click identifiers are removed after 90 days.

Your rights

You can ask for a copy of your data, a correction, or deletion of your account by emailing support@proxyfall.com from your account's email address.