Privacy Policy

Privacy is the foundation of Erised. We built the service to collect as little data about you as possible.

0. Closed testing (before release): diagnostic logs

While the service is in closed testing, the app sends diagnostic logs to the server: which channels and exits worked, connection errors, and the host names and addresses that connections were made to (without content). They are used only to fix censorship-circumvention issues, are kept for 7 days and then deleted. They are not shared with anyone; the app developer sees only summaries without addresses or site names (which channel worked, how much data passed, which errors occurred). If you send a diagnostics file yourself (with the button in the app or to the bot), the owner and the app developer receive it in Telegram, and it stays in that chat until deleted manually; the copy on the server is deleted after 7 days. After the Android release, diagnostics are switched off, and sections 1–2 below apply without this exception.

1. What we do NOT store

• Traffic logs and connection contents; outside the test period, also the history of visited sites and DNS queries.
• A link between “user ↔ activity ↔ IP address” over time.
• The contents of your connections.

Our exit servers are configured not to log users’ real IP addresses or SNI.

2. What we store (the minimum needed to run the service)

• Account identifier and, if you sign in on the website, a hash of your login/password (the password is never stored in plain text).
• Subscription status and expiry, amount of traffic used and the dates it is reset under your plan (to apply the plan). Dates of free-trial extensions (“+7 days”) — to apply their limit; deleted together with the account.
• Technical operational data needed to deliver connection settings.
• If you ask us to email you the settings file: we do not store the address. To prevent unlimited sending to one address, only its irreversible fingerprint (HMAC) is kept for one day; the address cannot be recovered from it.
• If you use the bot: your Telegram ID and username (@username) — so the bot recognises your account. If Telegram reports that the bot cannot message you (you stopped the bot or deleted your Telegram account), a note of that with the date, so that messages are not sent in vain; it is removed as soon as you write to the bot again, and erased after 90 days or together with the account.
• When you start a free trial — a browser or device fingerprint (browser type, screen, time zone and similar signals) and the registration IP address, so that one person cannot take the free period many times. The IP is erased after 7 days, the fingerprint after 30 days.
• For the per-subscription device limit — an irreversible device hash: the device itself cannot be identified from it. It is erased 30 days after the last sign-in from that device; the account keeps only the date the app first received its settings (no device data).
• App service signals (both in testing and after release): app installation ID, the device connection keys (the private one only in encrypted form), mobile carrier, country, network type and channel quality (latency, loss, errors) — without IP address. They let the connection recognise your device and pick a working channel. Signals and telemetry are kept for up to 35 days, keys — while the account exists.
• If you write to support through the bot (/support) or ask to be added as an app tester — the text of your message and any screenshots or recordings you attach (only the owner and the developer receive them, in Telegram); for a tester request it is the Google account address you send yourself. It is kept for 30 days after we reply (60 days if unanswered) and is deleted together with the account. The copy forwarded to the owner and the developer in Telegram stays in that chat until deleted manually.
• Traffic history per server (how much and through which server, hourly) — 14 days, to apply the plan.
• An administrator action log for the account (extension, block, message): the account number and the action, without message text. Kept for 12 months — to resolve disputes.

3. Payments

Payments go through external providers (Telegram, a crypto payment service). We do not store bank card data. The fact and amount of a payment, and the payment provider’s transaction number, may be kept for tax accounting.

4. Sharing with third parties

We do not sell or share your data with third parties. Data may be disclosed only upon a lawful and binding demand — and only to the extent we hold it (which is minimal by design).

For the service to work, some data inevitably passes through external services — only as much as they need to function:

• Cloudflare — serves the website; it sees the IP address of website visitors.
• Resend — sends the email with the settings file if you request it; it receives the address and the encrypted file. Like any email, it is also visible to your email provider.
• Telegram and @CryptoBot — the bot and payment processing; support requests and diagnostics files you send are also kept in Telegram (in the owner’s and developer’s chats).
• Google Play — app installation during closed testing: to add you as a tester we need the Google account address you send us yourself.

5. Warrant canary

We publish a “canary” about requests from authorities. If its date stops updating, that is a signal. The status is available in the app/bot.

6. Account deletion

You can delete your account at any time: the /delete command in the Telegram bot, the “Delete account” button in your account page on the website, or a request to support. We delete within 7 days. To see what is stored about you — the /mydata command in the bot (without Telegram — a request to support). The fact and amount of payments and the provider’s transaction number remain without any link to the account — for tax accounting; a “deleted” record (account number and date) is kept for 90 days as proof, server service logs for up to 8 days, the administrator action log for 12 months (account number only); encrypted database backups are deleted automatically within 8 weeks. Details: Account deletion.

7. Contact

Privacy questions — to support.