This Privacy Policy explains how InReach Proxies (“InReach,” “we,” “us,” or “our”) handles personal data when you use our website, account dashboard, proxy relays, support channels, and related services. It should be read with our Terms and Refund Policy.
1. Data we collect
Account and identity data
When you sign in with Google, we receive a stable Google account identifier, verified email address, display name, and profile image if available. We store random browser sessions as cryptographic hashes rather than storing the session token itself. If you link Discord, we receive identifiers and profile information needed to maintain that connection.
Purchase and transaction data
We store orders, purchased capacity, price, currency, payment status, processor identifiers, and invoice or reconciliation metadata. Stripe processes payment-card details; InReach does not store full card numbers or card security codes.
Proxy usage and operational telemetry
We process upload and download byte counts, request and connection counts, timestamps, protocol, outcomes, status classes, latency, provider, relay, lease and account identifiers, and sanitized destination hostnames. We aggregate this information for balance accounting, dashboards, abuse prevention, capacity planning, and reliability.
Our relay telemetry is designed not to retain request or response bodies, TLS plaintext, authorization or cookie headers, proxy passwords, URL user information, or common secret query values. We do not use proxy traffic content to build advertising profiles. Upstream providers and destination services independently process traffic sent to them and have their own privacy practices.
Security, support, and legal-acceptance data
We collect IP address, user agent, audit events, security signals, support communications, and the date and version of legal documents accepted. Operational logs may include bounded diagnostic information, but credentials and sensitive payloads are excluded by design.
Optional session replay
In environments where session replay is expressly enabled, capture begins only after authentication and is sampled and retained for a bounded period. Inputs are masked and credential regions are blocked. We reject sensitive replay payloads and do not intentionally capture headers, cookies, payment details, proxy credentials, request bodies, or URL query strings and fragments.
2. Why we use data
We use data to authenticate users; provide, meter, secure, troubleshoot, and improve the Service; fulfill purchases; enforce balances; generate and map proxy credentials; send transactional and low-balance notices; provide support; detect abuse and fraud; maintain audit records; comply with law; and establish, exercise, or defend legal claims.
Depending on your location, our legal bases may include performing a contract, complying with legal obligations, protecting legitimate interests such as security and reliability, and consent where required.
3. When we disclose data
We disclose the minimum data reasonably needed to service providers that operate parts of InReach, including Google for identity and email, Stripe for payments, Discord for linked-community features, Cloudflare for network security and ingress, cloud and database hosting providers such as OVHcloud, and residential proxy providers used to route customer traffic. We may also disclose data to professional advisers, a successor in a corporate transaction, or authorities and other parties when required by law or reasonably necessary to protect rights, safety, and the Service.
We do not sell personal data for money. We do not share personal data for cross-context behavioral advertising.
4. Retention
We retain data only as long as reasonably needed for the purposes described above. Account, transaction, legal-acceptance, security, and audit records may be kept longer where needed for tax, accounting, fraud prevention, disputes, or legal obligations. Request-level telemetry is compacted into bounded aggregates; individual completion logs are not intended as long-term history. Session replay, where enabled, has separate bounded sampling and retention controls.
Retention periods may vary by record type and legal obligation. Deletion requests do not require us to erase data that we must retain or that is needed to protect the Service or legal rights.
5. Security
We use safeguards designed for the sensitivity of the data, including encrypted proxy credentials at rest, hashed browser-session tokens, separated cryptographic keys, access controls, private service endpoints, audit logging, and least-privilege relay configuration. No network or storage system is perfectly secure, and we cannot guarantee absolute security.
6. International processing
InReach and its providers may process data in countries other than where you live. Where required, we use recognized transfer mechanisms or other safeguards. Residential traffic may exit through locations selected by you or made available by an upstream provider.
7. Your choices and rights
You may review account and usage information in the dashboard, disconnect linked services, stop using generated credentials, or sign out. Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of personal data, and to appeal or complain to a regulator. We may need to verify your identity before acting on a request.
To make a privacy request, email [email protected]. You may also control cookies through your browser, although the HttpOnly session cookie is required to keep you signed in.
8. Children
The Service is for adults and is not directed to anyone under 18. We do not knowingly collect personal data from children. Contact us if you believe a child has provided data.
9. Changes
We may update this Policy to reflect changes in the Service, providers, law, or our practices. We will update the effective date and bundle version. Material changes require acceptance of a new legal bundle before a new authenticated session is issued.
10. Contact
Questions and privacy requests may be sent to [email protected].