Who is responsible
SpiritFox (“we”, “us”) is responsible for your personal data. Privacy requests go to our Privacy Officer: [email protected].
At a glance
| Never collected | Kept to run your account |
|---|
| The sites you visit, what you browse, the content of your traffic | Email, hashed password |
| Card numbers and payment-account details | Traffic used, orders |
| We don’t ask for your name, phone number or address | Devices online, subscription updates |
What we collect, why, and for how long
| Data | Why we use it | Legal basis | How long |
|---|
| Email | Sign-in and account messages | Contract | While your account exists |
| Hashed password | Sign-in. We can’t read it | Contract | While your account exists |
| Traffic used | Counting your plan | Contract | 90 days |
| Orders (number, amount, time, plan) | Billing, accounting | Contract; legal obligation | 3 years |
| Devices online (network address) | Keeping your plan working; spotting an account shared with other people | Legitimate interest | 7 days |
| Subscription updates (address range, app type, time) | Detecting a stolen subscription link | Legitimate interest | 30 days |
| Support messages | Helping you | Contract | 1 year |
| Website visits (network address, browser type) | Keeping this website secure and available | Legitimate interest | 7 days |
Most of this you give us when you sign up and pay. Network addresses and app type are recorded automatically when your devices connect or update. An email address is required to create an account. Without one, we can’t provide the service.
Where we rely on legitimate interest, our interest is a secure service that isn’t abused. We keep it to the minimum above, and you can object (see Your rights).
What we never collect
We don’t record the sites you visit, what you browse, or the content of your traffic. Card numbers and payment-account details go to the payment provider and are not sent to us. We don’t ask for your name, phone number or address.
Who else sees data
- Payment providers handle your payment and tell us whether an order was paid, with its reference number, amount and time.
- Our email delivery provider sends account emails, such as sign-up codes and password resets.
- Website hosting and protection providers deliver this website and filter attacks. They see visitors’ network addresses for that purpose only.
- The companies that run our hardware host our systems under contract. They don’t get access to your account data for their own use.
- Authorities, only when the law requires it. We can only provide data we hold, and this policy describes what that is.
We don’t sell your personal data, and we don’t share it for advertising.
International transfers
Account data is stored in our cloud providers’ data centers in several regions. Your data may be processed outside your country, where local law may require disclosure to authorities. Where the country has no adequacy decision, we use encryption in transit and at rest, together with the data-protection terms in our providers’ contracts.
How we protect data
Data is encrypted in transit. Passwords are stored only as salted, slow hashes. Backups are encrypted. Admin accounts are protected with multi-factor authentication. More on our Security page.
Your rights
Depending on where you live, you have the right to:
- see the personal data we hold about you, and get a copy in a portable format;
- correct it;
- have it deleted;
- restrict how we use it;
- complain to your local data protection authority.
In your dashboard, yourself: see your account details, usage and orders, change your password, and reset your subscription link. Through Tickets: ask for anything else above. We’ll answer within 30 days. When we delete an account, we do it within 30 days, except order records we must keep by law, and copies in encrypted backups expire within 30 days.
Your right to object
You can object at any time to our use of your data based on legitimate interest (devices online, subscription updates, website visits). Ask through Tickets. We will stop unless we have compelling reasons, such as protecting your account from a stolen link, and we’ll tell you what they are.
Cookies and storage
- This website sets no cookies and loads no trackers.
- The sign-up, log-in and password-reset pages load a human check from Cloudflare Turnstile (challenges.cloudflare.com) to stop automated sign-ups and password guessing. Cloudflare receives technical data such as your IP address and browser details, and may store its own data on its domain while the check runs. We receive only a pass or fail result. Cloudflare’s privacy policy applies to the data it receives.
- When you sign in to your dashboard, your browser keeps a sign-in token in its local storage so you stay signed in. It is not shared with anyone and is used for nothing else. Signing out clears your session on this device. To sign out everywhere, change your password.
Automated decisions
We don’t make decisions about you by automated means alone. If unusual use is detected, such as an account online from far more places than one person normally uses, we send you a notice, and a person reviews before any action.
Emails we send
Only account emails: sign-up codes, password resets, security and service notices. No newsletters or marketing.
Children
SpiritFox is not for anyone under 18, and we don’t knowingly collect their data.
Changes
We’ll post changes here with a new effective date, and tell you in your dashboard at least 30 days before important changes take effect. If what we keep ever changes, we’ll update this page first.
Tickets in your dashboard or email [email protected]. For privacy requests, [email protected].