Data and privacy.

Nightsec stores your email address, verification status, last login, API-key hashes, subscription identifiers and lookup usage to provide your account and enforce your plan. Stripe hosts payment collection; Nightsec does not store card numbers.

Launch updates

If you join the launch list, we store your email, signup time and the signup page, and notify our team at info@nightsec.io. This does not create a customer account. We use the list for launch updates; contact the same address to be removed. Delivery may be retried if email is temporarily unavailable.

Service analytics

We keep request timestamps, client IPs, route names, HTTP status, latency, account/key identifiers, approximate visitor country, a derived bot-agent indicator and optional Referer and Origin headers for 30 days. Referrer credentials, query strings and fragments are removed. These headers are supplied by clients, may be absent or inaccurate, and cannot establish which website a person visited. Account and authentication pages are excluded from this analytics log. We do not record request bodies, verification codes, cookies or API-key secrets in it.

Security and account records

Verification codes expire after ten minutes. Expired challenges are removed after a one-day grace period; expired browser sessions are removed by scheduled maintenance. Account, billing and administrative audit records remain until the operator removes them or applicable retention obligations are met. Backups may retain older data until they rotate. Only administrators can view service analytics and account management information. Admin audience summaries group site requests by country, IP and reported referral domain; they exclude API traffic and recognizable bot/CLI user agents. They do not reliably identify individual people.

Network observations

Our dataset contains observed public proxy exits, their configured provider, timestamps and approximate IP geolocation. It does not identify the people using a proxy. Geo data comes from IP2Location LITE with its database date and attribution. Missing data is unknown; a proxy observation is not a finding of malicious activity.

Delivery providers

Verification and operational emails use the configured email provider (Zoho Mail or SMTP). Payment and subscription processing uses Stripe. The production operator must publish its legal identity, contact address, applicable terms, subprocessor details and data-rights contact before accepting public customers.

This page describes the application's data handling. It is not a substitute for the operator's completed privacy notice and service terms.