Privacy

What we keep.
And what we don't.

If it isn't on this page, we don't collect it.

Updated November 9, 2026

Never collected

IP addresses

Not logged on the site, the panel or the API. Rate limits use a keyed hash of the address, deleted after two minutes.

What your server does

No traffic capture, NetFlow or DNS query logs. We count bytes per server per day for your graphs, nothing else.

Who you are

No name, ID, phone number or address. Your login is a random account number.

Trackers

No analytics or third-party scripts, and no cookies apart from the one that keeps you signed in.

Kept while you have an account

Account number: Your login, randomly generated.
Password and recovery phrase: The password as a bcrypt hash, the recovery phrase as a SHA-256 hash. Your 2FA secret is encrypted.
Email and Telegram: Only if you add them, for the notifications you pick. Add a PGP key and emails are encrypted to it.
Services: Your servers, domains and hosting.
Payments: Amount, coin and date. Payment records stay for our accounts even after you delete the account.
Support messages: Tickets and chats. Images are stripped of location and camera data on upload.
Known browsers: A short hash of a random id for each browser you signed in with, up to 30, so we can tell you about a sign-in from a new one. You can turn these alerts off.

Deleting your account (Security in the panel) deletes your services and erases your login details, email and Telegram.

Deleted on a timer

Signed-in browsers

Browser name and when it was last used

30 days unused

Invoices

What you ordered and paid (unpaid ones stay until paid)

12 months

Activity log

Orders, logins and changes, shown in your panel

30 days

One-time codes

Email and Telegram verification codes

1 day

Back in stock alerts

The email address a visitor leaves to hear when a sold-out plan is back

Until the notice is sent, at most 60 days

DMCA & foreign notices

Not forwarded, not acted on. We only look at valid court orders from the country the server is in.

What is still not allowed

CSAM, malware distribution, ransomware and DDoS. These are removed without warning.

Warrant canary

November 2026

Signed 12 November 2026. A new one is published every month, by day 5. If it is late or a statement disappears, assume we can no longer make it.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Bulletproof.to warrant canary for November 2026

Date 2026-11-12 (UTC)

As of this date
 1. We have received no national security letters, gag orders or secret court orders.
 2. We have received no warrants, subpoenas or court orders for customer data.
 3. We have not been compelled to modify our systems to allow access or monitoring.
 4. We have not handed over any encryption keys, passwords or customer credentials.
 5. None of our servers has been searched, seized or tampered with.

Proof of date, latest Bitcoin block
 Height 975497
 Hash 000000000000000000018fb7014a3b98e1691b35564cb5546e496643d74975c1

The next canary is due by 2026-12-05. If it is late, or a statement above is
missing, assume we can no longer make it.

Signing key 6705 F697 0DEE 15F6 5EC1 3976 F872 CAFF 325B 7D12
Public key https://dev.coverandseek.com/pgp.asc
-----BEGIN PGP SIGNATURE-----

wnUEARYKAB0FAmr1CxAWIQRnBfaXDe4V9l7BOXb4csr/Mlt9EgAKCRD4csr/Mlt9
EhBIAP46CREvdNDENpdohnZYbLV4U2oCsuw9nBalUz2KFc9IKwEAupCCPtPxisbM
6wAU2dn6eNL+2rJyH78l2kvG14IqzwU=
=hKmw
-----END PGP SIGNATURE-----

canary.txt Public key

PGP key

Every canary is signed with this Ed25519 key. Check the fingerprint through a second channel before you trust it.

6705 F697 0DEE 15F6 5EC1 3976 F872 CAFF 325B 7D12

curl -s https://dev.coverandseek.com/pgp.asc | gpg --import
curl -s https://dev.coverandseek.com/canary.txt | gpg --verify

Download pgp.asc

What we keep.And what we don't.