Privacy Policy

1. General

1.1. The Operator processes personal data on the basis of the User's consent, given at registration, and to the extent necessary to perform the agreement concluded with the User.

1.2. Users who do not agree with this Policy should stop using the Service.

2. Information processed

2.1. Account data: email address, password stored as an irreversible hash, interface language, referral relationships.

2.2. Licence and device data: device identifier, the device name chosen by the User, activation and last-seen timestamps, operating system and architecture.

2.3. Order data: amount, currency, selected plan, payment method, and the cryptocurrency wallet address where the User supplies one for a refund or a payout.

2.4. Support enquiries: subject and body of the enquiry, including anything the User attaches.

2.5. Error reports: description, diagnostic details and excerpts of the program's logs. These are sent only when the User explicitly chooses to send them.

2.6. Technical data about visits to public pages: country, page path, referring host, browser and operating-system family, and an irreversible hash of the IP address. The full User-Agent string and the plain IP address are not stored.

2.7. A plain IP address is stored in three cases: on trial activation (abuse prevention), when recording acceptance of this Policy and the Terms of Service (proof of acceptance), and in the server's technical logs.

3. What the Operator does not collect

3.1. The BlankTrail Proxy software runs on the User's own device. User network traffic does not pass through the Operator's infrastructure, is not intercepted and is not stored.

3.2. The Operator does not receive or retain the addresses of resources the User visits, the contents of connections, or the data carried within them.

3.3. The software sends the Operator only what is needed to validate a licence: licence key, device identifier and name, build version, operating system, architecture, and the number of open ports.

4. Purposes of processing

Information is processed in order to:

• register the User and provide access to the cabinet;
• issue, renew and validate licences;
• process orders, payments and refunds;
• provide technical support and handle enquiries;
• keep the Service secure and prevent abuse;
• comply with applicable legal requirements.

5. Cookies

5.1. The website uses three cookies:

• session — session identifier and cross-site request forgery protection, retained for 12 hours;
• lang — the selected interface language, retained for 365 days;
• sf_promo — a promotional code entered before registration, retained for 30 minutes.

5.2. No advertising or tracking cookies are used. Public-page visit statistics are collected server-side and set no cookie.

5.3. Users may block cookies in their browser; signing in to the cabinet will then not be possible.

6. Sharing with third parties

6.1. The Operator does not sell personal data and does not share it other than as set out below and as required by law.

6.2. Information is shared with the following service providers, limited to what each needs:

• Cloudflare — the User's IP address, when the human-verification check runs on the sign-in, registration and password-recovery pages;
• Telegram — the text of a support enquiry together with the User's email address, forwarded to the staff chat; where the User links the bot, their Telegram account identifier and username;
• email service provider — the User's email address, to deliver registration confirmation, password-recovery and Telegram-linking messages;
• payment service — the amount, currency and order reference. The User's email address, name and IP address are not shared with the payment service.

6.3. Country lookup from an IP address is performed locally on the Operator's servers, with no external service involved.

7. Retention

7.1. Account data is retained for as long as the account exists.

7.2. Order and payment records are retained for at least 3 (three) years from the transaction, in line with financial record-keeping requirements.

7.3. Anonymised public-page visit statistics, which cannot identify an individual, are retained indefinitely.

8. User rights

8.1. Users may request access to their personal data, ask for it to be corrected or erased, obtain a copy of it, and withdraw their consent to its processing.

8.2. To exercise these rights, write to legal@blanktrail.com from the email address used at registration. Requests are answered within 30 (thirty) calendar days.

8.3. Accounts are deleted on request. Order and payment records are retained for the period stated in clause 7.2.

8.4. Withdrawing consent makes further use of the Service impossible.

9. Security

9.1. Passwords are stored only as irreversible argon2id hashes and cannot be recovered in their original form.

9.2. Access to the cabinet requires a username and password; the connection to the website is encrypted.

9.3. Staff access to user information is limited to what their duties require, and privileged actions are recorded in an audit log.

9.4. Users are responsible for keeping their own credentials secure.

10. Changes to this Policy

10.1. The Operator may amend this Policy. Each redaction carries the number and effective date shown at the top of the document.

10.2. The current redaction is published at /privacy.

11. Contact information

For questions about the processing of personal data:

• email: legal@blanktrail.com
• Telegram support: https://t.me/spoofforge_bot