This policy describes what Paragon records about you, how long each record lives, and who else ever sees any of it. It is deliberately short, because the honest version of this document for a host that takes an email address and a coin payment cannot be long.
Nothing here is aspirational. Every row in the table below matches what the database schema actually stores, and the schema is what the retention job runs against.
1. What this covers
The account system, the panel, the billing pipeline, this website, and support tickets. It does not cover what happens inside your instance, because we have no visibility there and no wish to acquire any.
The operating entity named on your invoice is the controller of everything described here. Contact for anything in this document: [email protected].
2. Everything we hold
| Data | Kept for | Why it exists |
|---|---|---|
| Email address | Life of the account | Password resets and invoice delivery. Nothing else. |
| Password hash | Life of the account | scrypt, N=2^16. Never reversible, never exported. |
| Panel access log | 7 days | Detecting account takeover, then discarded. |
| Invoice records | 24 months | So you can prove what you bought. Contains no identity. |
| Crypto payment reference | Until settled | Matching a payment to an invoice. Purged after settlement. |
| Instance traffic | Never recorded | We route packets. We do not read them. |
| IP address at sign-up | Never recorded | It is not written to disk in the first place. |
That is the complete list. There is no eighth row held back for the lawyers.
Support tickets are the one thing customers forget about. A ticket lives as long as the account and contains whatever you typed into it, so if you paste a credential or a customer’s name into a ticket, that is now stored. Ask and we delete the thread.
3. What we do not collect
No name, no postal address, no phone number, no company details, no tax identifier, no document of any kind at any order value. There is no threshold that triggers a request for one, and adding such a threshold would change the warrant canary (/canary) before it changed this page.
Sign-up addresses are not recorded, which is a stronger statement than not retained: the field does not exist in the row being written. Panel access logging keeps a truncated network prefix rather than a full address, and the entry expires after seven days along with everything else in it.
We do not fingerprint browsers, we do not run session replay, and we do not attempt to correlate accounts with each other.
4. Cookies
Two, both first-party, neither shared with anybody.
- Session cookie. An opaque identifier that says you are logged in. It holds nothing else, it is not readable by script, and it expires at logout or after thirty days of inactivity.
- Theme preference. Light or dark. One year, and the only thing in it is that word.
Nothing else is set. No consent banner appears on this site because there is nothing to consent to, which is how the rule was meant to work before it became a decorative interstitial.
5. Analytics and third parties
There are no analytics. No pixel, no tag manager, no heatmap, no third-party script, and no fonts fetched from anyone else’s domain. Page views are counted in aggregate from the web server’s own counters, which record a path and a total and nothing about who asked.
Three parties see a fragment of your data, and only these three:
- OxaPay, which handles crypto settlement, sees the invoice reference and the payment. It does not receive your email address.
- The site your instance runs in. Facility operators handle power and space; they have no access to the contents of any machine and no relationship with your account.
- Nobody else. Mail leaves our own servers, the panel runs on our own hardware, and this page was served by the same kind of node the catalogue (/hardware) describes.
6. Your rights
Access, rectification, erasure, portability and objection, exercised by writing to [email protected] from the address on the account. Most requests are answered the same week, and the outside limit is thirty days.
Two practical notes. Erasure removes the address and the password hash on request and closes the account, but invoice records run to their twenty-four-month mark because a set of books has to balance; those records carry an invoice number and an amount, not an identity. Portability is a JSON export of your account, invoices and tickets, which arrives by mail within a day of asking.
There is no appeal to us that matters more than your right to complain to the supervisory authority where you live. Do both, in whichever order suits you.
7. Legal requests
We answer what the law of the relevant site actually requires, and nothing beyond it. Requests arriving as an email from a personal address are not requests; they are correspondence, and they are declined.
What can be produced is short, because the table in section 2 is short. Where notification is permitted, you are told before anything is handed over. Otherwise the fact of the request appears in the transparency report (/transparency) at the next publication, and the warrant canary (/canary) is signed monthly.
8. Security of what little there is
Passwords are hashed with scrypt at parameters we re-tune each hardware generation. The panel database is encrypted at rest and replicated between two European sites, AMS-01 and FRA-01, over a private path that never touches the public internet. Backups of that database are encrypted client-side before they leave the host.
Staff access requires hardware tokens, and every administrative action against an account is recorded in a log that customers can request. Should a breach affect you, notification goes out within seventy-two hours of confirmation, with what happened and what was exposed, even when the answer is embarrassing.
9. International transfer
Your instance lives in the city you selected and its data does not move. Panel and billing records sit in Europe. Support engineers read tickets from wherever they happen to be on shift, which is not always the same continent, so a ticket can be read outside the region it was filed from.
Where a transfer of that kind occurs, it rests on standard contractual terms of the usual kind between the entities involved. We are not listing countries here for the same reason the terms do not name a jurisdiction in a template: the list would be wrong within a year, and a wrong list is worse than a general one.
10. Changes
Changes to this policy are dated at the top of the page and summarised in the journal (/journal). Anything that lengthens a retention period or adds a row to the table in section 2 is emailed to every account thirty days ahead, and you may close the account inside that window with the unused term refunded pro rata.
Shortening a retention period is not announced in advance. We just do it.