Privacy Policy

Effective date: 2026-10-12 · Operated by FoxTether LLC

This policy explains what personal data FoxTether ("we", "us") collects when you use the service, why we collect it, and the choices you have. We keep data collection to what the service needs to function. This policy covers the hosted FoxTether service. A self-hosted Site Server deployment runs entirely on its operator's own infrastructure, outside our reach. The operator's own policies govern it.

What we collect

Account data: the email address and credentials you provide when you register. If you sign in with Google instead, Google sends us your email address. We never see your Google password. Session and authentication cookies keep you signed in. Our servers also log technical request data, such as your IP address, to secure and operate the service. Those logs expire on a rolling basis. The product generates operational data in normal use, such as the health and telemetry of the sources, gateways, and egresses you connect. We do not sell personal data.

Billing data, on a paid plan: Stripe, our payment processor, holds your card and billing address and we never see the card. We keep your Stripe customer id, the state of your subscription (plan, renewal date, standing), a record of the consent you gave at checkout with the text you were shown, and a log of the billing notices we sent you. The details of Stripe's events about your subscription are kept for thirteen months to resolve disputes, and a record that each event happened stays in the workspace's billing history, even after the workspace is deleted.

Content you route

Data flowing from your sources to your configured destinations passes through the service live. We route it and do not store it. That content is yours, and it may itself contain personal data captured by your devices (camera footage of a doorway, for example). For that data you are the controller and we act as your processor: we handle it only to deliver it where you pointed it, and we do not view, interpret, or sell it.

Why we collect it

To provide and secure the service: to create and authenticate your account, to operate the data pipeline you configure, and to keep the platform reliable. The legal bases are performance of our contract with you and our legitimate interest in running a secure service.

Retention

We keep account data for as long as your account is active. Operational telemetry expires on a rolling basis. We keep it only as long as the dashboards and alerts it powers need it. You can request deletion of your account and associated personal data through our contact page. We will delete it, except what the law requires us to keep, the security log described below, and a minimal record of the deletion itself: the workspace name, when it was deleted, and the email address of the account that deleted it.

Each workspace keeps a security log of sign-ins and sign-outs, workspace creation and deletion, membership changes and credential changes. Each entry names who did it by email address, and records the IP address and browser where we have them. Entries are kept for 365 days. After 90 days the IP address is shortened to its network. The log is kept after a workspace is deleted, and after an account deletion request, until its entries age out. Workspace admins can read their workspace's log, and FoxTether staff can read it to investigate security issues.

Consent records and the billing notice log are kept for at least three years after your subscription ends, and for as long as we may need them as evidence, even if the workspace is deleted.

Third parties and subprocessors

We rely on a small set of infrastructure providers: Hetzner (cloud hosting), Cloudflare (our domain, DNS, and the email we send, such as alert notifications and account emails), Stripe (payments, on a paid plan), and Google (sign-in, only if you choose to sign in with Google, and Google Workspace, the mailbox that receives the mail you send us). Cloudflare also runs Turnstile, the bot check on our sign-up form, which processes your IP address and browser signals to tell people from bots and sets no advertising or tracking cookies. Each processes data on our behalf and only as needed for its role. The current list, with each provider's role, location, and safeguard, is on our subprocessors page. Beyond these providers, we share personal data only where required by law.

Where your data is processed

We operate from the United States. Our infrastructure providers run in the EU and the US. Where personal data crosses borders, our providers rely on recognized safeguards: Cloudflare, Google, and Stripe are certified under the EU-US Data Privacy Framework, and standard contractual clauses back transfers where certification does not apply.

How we protect your data

Traffic between gateways, our servers, and your browser is encrypted in transit with TLS 1.3 (QUIC). Passwords are stored only as salted hashes, never in plain text, and access to production systems is tightly limited. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. We compensate by keeping the attack surface small and the data we hold minimal.

Cookies

We use session and authentication cookies that are strictly necessary to sign you in and keep you signed in. Under ePrivacy/GDPR, strictly-necessary cookies do not require consent. We do not use analytics or advertising cookies today. If we add analytics in the future, we will update this policy and present a consent banner where required.

Your rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, reach us through our contact page. If you are in the EU or UK, you also have the right to lodge a complaint with your local supervisory authority. We do not use automated decision-making or profiling.

Children's privacy

The Service is a business tool and is not directed to individuals under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

Contact

Questions about this policy or your data: see our contact page.

Changes to this policy

We may update this policy as the product evolves. We will change the effective date above and, for material changes, surface a notice in the product.