vpsFocus
Privacy Policy
Draft. The list of data is accurate — it is derived from what the server actually stores. The text has not been reviewed by a lawyer, and the operator's details are placeholders.
Version 2026. Operator: [OPERATOR NAME], [REGISTRATION DETAILS]. Contact: support@vpsfocus.xyz.
1. The short version
We keep exactly what is needed to check your plan and to reach you: your email address, a password hash, your account id, the server ids the app generates, and the domains of the sites you have connected.
We keep nothing that could be used to log into your client's server: no server addresses, no usernames, no SSH keys, no passwords, no passphrases, no host key fingerprints, and none of the credentials generated during provisioning. All of that lives in your operating system's credential store. What we do not have cannot leak from us.
2. What we collect and why
| Data | Why | How long |
|---|---|---|
| Email address | Signing in, password recovery, messages about the account | While the account exists |
| Password hash (argon2id) | Checking the password at sign-in | While the account exists |
| Interface language | The language of our letters | While the account exists |
| Account id, plan, plan expiry, plan history | Access to paid features | While the account exists |
| Server ids generated by the app | Tying sites to the servers they run on | Until the server is removed |
| Domains of sites connected to paid features | External availability, certificate and DNS checks | Until the site is removed |
| Domain confirmations for the status page: the domain, the TXT record code, when it was checked | Making sure the domain is yours before its sites are shown on a public page | Until you remove the confirmation |
| Status pages: address, title, language, which checks are shown and their names | The public page you set up yourself | Until you delete the page; the address — for 90 more days |
| Sessions: token hashes, creation and last-use time, the browser or app string | Signing in and the device list | Up to 90 days, or until the session ends |
| Failed sign-in counter | Protection against password guessing | Until the next successful sign-in |
| Technical logs: IP address, request method and path, browser or app string, response code and duration | Diagnostics and abuse protection | Web server log — 14 days; service logs are overwritten in rotation, usually within two months |
| App error reports — only with your explicit consent | Fixing bugs | Written to the service log and not stored separately — same period as the logs |
Your email address reaches us only from you: the app sends it when you sign in or register. Everything else the app sends about servers and sites is exactly what is listed above.
3. What we do not collect
- Addresses, ports and usernames of your servers.
- SSH keys, passwords and passphrases.
- Server host key fingerprints.
- Credentials generated during provisioning: the Postgres password, the session signing key, the analytics admin password, the agent token.
- Notification settings: mail server parameters and the Telegram bot token.
- Your clients' visitor analytics — all of it stays on the client's server.
- Server metrics and the contents of the agent's checks.
- Database connections, queries and results from the site data cards — the query runs from the app to the client's server directly, and the answer is shown only on your own screen.
- Your Cloudflare API key, and the mail addresses, destinations and rules from the Mail tab — the app calls Cloudflare's API directly with a key that stays in your operating system's credential store, and mail is forwarded by Cloudflare straight to the inbox you chose.
An app error report contains no server addresses, no client domains and no secrets: the set of fields is pinned by an automated test, so adding anything new there can only be done deliberately, by breaking it.
4. Server logs
Logs record the request method, path and duration. Request bodies and headers are not recorded: they contain passwords and tokens.
The status page is also opened by people without an account — your clients and visitors. Their requests go to the same technical logs as any request to the website: IP address, path, browser string.
5. Cookies
The site sets two cookies — one for the short-lived and one for the long-lived session token. Both are strictly necessary: without them you cannot stay signed in. Both are marked HttpOnly, so no script on the page can read them, and SameSite=Lax, so they are not sent from other sites. There are no analytics or advertising cookies.
Visits to the public pages of the site (home, pricing, download, documentation) are counted by our own Umami analytics, which runs on our own server; the data goes nowhere else. It sets no cookies and does not recognise a person from one visit to the next: it records the page without URL parameters, the referrer, country, device type, browser and operating system. Sign-in, the account area, pages opened from emails and status pages are not counted.
The status page sets no cookies at all.
6. Who else sees the data
We do not sell data and do not share it with third parties for advertising. Data may be processed by the infrastructure providers the service runs on: HOSTKEY B.V. (the Netherlands) for servers, Resend, Inc. (USA) for sending email.
On the paid plan, the domains of connected sites are used for external availability checks from our infrastructure.
The status page is open to everyone: it shows what you chose yourself — the page title, the names of the sites and their availability. The addresses of checks, ports and maintenance notes are not shown.
7. Where the data is stored
Servers are located in the Netherlands (Amsterdam). Connections to the service are protected by TLS.
8. Your rights
- Find out what data we hold about you.
- Correct it: the address and password can be changed in your account page and in the app.
- Delete the account with all related records — write to support@vpsfocus.xyz.
- Withdraw consent for error reports: the toggle on the account screen in the app. A refusal is remembered; we do not ask again.
- End sessions on every device — the button in your account page and in the app.
Deleting the account does not touch a stack already deployed on your servers: it keeps running. You can remove it from the app.
9. Children
The service is intended for professional use and is not directed at people under 16.
10. Changes
We may change this policy. Material changes are announced to the account's email address.