Privacy policy

Last updated: June 18, 2026

Privacy policy

The foundational principle of most global privacy legislation is "Privacy by design". We take this further: Privacy by default and by structure. Because our systems are architected to reject Personally Identifiable Information (PII) entirely, the vast majority of global regulatory burdens regarding data collection, retention, and sale simply do not apply to us. Your identity cannot be leaked, sold, or subpoenaed because it's never collected.

Below is a benchmark against the most prominent privacy protection laws worldwide.

Scope of this policy

This policy covers the data handled by evadity's application and database layers. We render global privacy laws obsolete regarding our systems because we refuse to collect or retain PII.

Third-party processors

• Infrastructure (GCP and AWS): We utilize third-party cloud infrastructure to host our application and proxy servers, and to route proxy traffic. To understand what our cloud providers log and how our architecture isolates your identity from them, please see our No-logs policy.
• Website security and edge protection (AWS CloudFront): To protect our application and authentication endpoints from DDoS and brute-force guessing attacks, we route public web traffic through a Web Application Firewall (WAF) managed by AWS CloudFront. This edge network temporarily processes incoming web request IP addresses strictly to enforce algorithmic rate limits and block malicious bot traffic before it reaches our application. This security layer applies exclusively to our public API and web application. It does not touch, monitor, or route your encrypted proxy server connections. Your proxy tunnel traffic remains structurally isolated from our web infrastructure.
• Payment processing (Stripe): We use Stripe to process payments. Because your evadity account is anonymous, we have no PII to share with them, and we never share your 16-digit account number. You provide your card details directly to Stripe, and they send us a blind stripe_id via a secure webhook to activate your plan. During checkout, Stripe's embedded scripts independently collect device telemetry (such as your IP address and browser data) strictly for fraud prevention. We never see or store this metadata or your card details. See Stripe's Privacy policy.

General Data Protection Regulation (GDPR) - European Union

The GDPR is widely considered the global gold standard for data privacy, focusing heavily on consent, data minimization, and user rights.

• Data minimization (Article 5): GDPR requires collecting only the data strictly necessary for a specific purpose.
  • Benchmark: We take this to the absolute technical limit. We do not ask for a name, email address, phone number, or physical address. Your entire identity is a cryptographically generated 16-digit integer (account_number). There is zero qualitative data attached to your profile.
• The right to be forgotten (Article 17): Users can request the deletion of their personal data.
  • Benchmark: We've built the "Right to be Forgotten" into our architecture. Your data usage is wiped automatically by an automated sweeper function. Proxy connection states are ephemeral. Because no traffic, DNS requests, or originating IPs are ever logged, there is no historical footprint to erase.
• Data portability and access (Articles 15 and 20): Users have the right to request a copy of their data.
  • Benchmark: Any user can instantly see 100% of the data we hold on them by viewing the tables documented in our No-logs policy. Because no behavioral metadata is captured, there are no hidden tracking profiles to export.

California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) - United States

The CCPA and its amendment, the CPRA, focus heavily on the commercialization of consumer data, granting users the right to know what is collected and the right to opt-out of its sale or sharing.

• Right to opt-out of data sale/sharing:
  • Benchmark: We do not participate in the data brokerage ecosystem. We deploy zero analytics trackers, zero behavioral cookies, and zero third-party advertising SDKs. There is no personal information to sell, making this requirement structurally moot.
• Right to know and delete:
  • Benchmark: We do not collect cross-context behavioral data. Even your active devices are anonymized using a random word generator (e.g., Apple-Tree) instead of capturing your hardware MAC address or OS version.

Lei Geral de Proteção de Dados (LGPD) - Brazil

The LGPD mirrors the GDPR in many ways but places a heavy emphasis on the security of data processing and the strict requirement for a lawful basis for processing any personal data.

• Security and secrecy of data:
  • Benchmark: Our database design fundamentally protects against data breaches. The proxy_servers table utilizes AES-128-CBC (Fernet symmetric encryption) to encrypt server passwords at rest. Furthermore, our session tokens are 32-byte Base64-encoded strings devoid of creation timestamps, ensuring that even if a database were compromised, it's structurally impossible to reconstruct a user's timeline or decrypt the secure, encrypted connections established between the user's devices and the evadity proxy servers.
• Lawful basis for processing:
  • Benchmark: The only data processed is operational (validating a 16-digit number and tracking a byte counter to enforce fair use). We do not process any personal data, thereby bypassing the complex legal liabilities associated with handling such data.

Personal Information Protection and Electronic Documents Act (PIPEDA) - Canada

PIPEDA is based on ten fair information principles, heavily emphasizing accountability, identifying purposes, and limiting collection.

• Limiting collection and accountability:
  • Benchmark: Accountability in network privacy means proving that tracking is impossible. By refusing to log connection timestamps, IP addresses, or DNS queries, we limit our collection to the raw provisioning of secure, encrypted connections. Because no connection metadata is ever written to disk or database, it leaves no historical trace within our systems.

The contact and bug reporting sandbox

The only time you'll ever be asked for PII is if you explicitly choose to provide it. Our contact form requires a valid email address to allow for follow-up. Our bug reporting form is fully anonymous by default; providing an email address is optional and only required if you choose to receive a response regarding your report.

Regardless of how you contact us, we treat all communication channels as contaminated, isolated sandboxes:

• Absolute decoupling: Your email is routed through an external provider (Google Workspace). Because of this, we treat the inbox as a separate, contaminated zone. It's never injected into our core database, it's never linked to your proxy server connections, and it cannot be used to de-anonymize your traffic.
• Ephemeral retention: We do not archive messages or bug reports. Once marked as resolved, the entire conversation (including your email address, if provided) is purged.

For vulnerability disclosures, we support:

• Anonymous reporting: You're not required to provide a return address on our bug reporting form.
• Encrypted transit: We encourage the use of our public PGP key (available in our security.txt) to ensure your reports are end-to-end encrypted.

Conclusion

Technology companies build massive data-harvesting operations and then draft complex legal policies to comply with regional laws.

We take the opposite approach. By abiding by our no-logs policy, utilizing cryptographically secure random identifiers, enforcing database-level constraints against PII, and automating the deletion of usage metrics, we achieve compliance not through legal loopholes, but through undeniable zero-knowledge architecture. We protect your privacy by refusing to possess it in the first place.