1. Where does this policy apply?
It applies to the coxvpn.online website and its My info screen, to every VPN and proxy server we run, and, when they launch, to our apps.
2. What do you never log from the VPN?
While you are connected, none of the following is recorded anywhere:
- the sites, apps or services you open
- the content of the data you send and receive
- DNS queries
- your real IP, the one your provider gives you
- when a connection started or ended, or how long it lasted
3. What is stored for logging in?
Email accounts: the address (saved in lowercase) plus a password hash made with scrypt. The password itself is never stored. The address is used only as a login name, and we never write to it.
Token accounts: we store a one-way hash that the token is checked against at login, plus its last 4 characters so we can tell accounts apart. The full token is displayed only once, during sign-up. One more item is an encrypted copy of the token. It goes along with top-up requests to our payment server so that each payment lands in the right account.
All accounts: a one-way hash of the IP address used at sign-up, kept only to enforce the limit of 3 accounts per IP. Names, phone numbers and home addresses are never requested, and no email goes out from us.
4. What payment records are kept?
For each top-up and checkout we keep the amount, coin, date and items, along with the start and end dates of your passes.
The crypto side is handled by PayGate; on its payment page, PayGate's own terms govern. Crypto is the only method, so card numbers and bank details never reach us.
5. Proxy details and support messages
For proxy buyers we also keep the login pair (username and password) that the gateway checks, and any IPv4 addresses on the allowlist.
Messages you write in the Contact us tab, and our replies, are kept so the conversation can pick up where it left off.
6. How do you count my devices?
Each live connection creates a temporary marker on the server, and the limit is checked against those markers. A marker records only that one slot is taken. It holds no IP and no activity, and it is removed when you disconnect.
7. Cookies and browser storage
The site sets five cookies, all of them our own from coxvpn.online. No third party sets cookies here.
- cx_sid keeps you logged in for 30 days, and cx_in only tells the page that you are logged in, with nothing else inside
- cx_lang holds your language choice, while cx_hint keeps the language prompt from appearing again after you close it
- ref_src notes whether your first visit came from a link or a typed address, and it expires after 30 days
- Your cart isn't stored in a cookie at all: it sits in your browser's localStorage under cx_cart, comes to us only when you check out, and can be emptied with a button on the cart page
- Two sessionStorage entries are cleared when you close the tab: cx_src makes sure your first-visit source is sent only once, and cx_draft_* briefly keeps what you typed in a form (never a password) so it isn't lost if the page comes back with an error
8. Is there advertising or outside analytics?
No. You won't find ad cookies, tracking pixels or another company's analytics on the website, and none are planned for the apps. We don't sell data or pass it to advertisers.
9. What if authorities ask for data?
A binding legal demand is the one case in which account data goes out, limited to what sections 3 to 5 describe. Browsing and connection logs don't exist, so there are none to give.
10. How long do you hold my data?
As long as the account exists. To close your account and delete its data, ask in the Contact us tab. Some payment records can outlast the account if a law says we must keep them.
11. Updates to this policy, and contact
Every revision moves the date at the top forward. Anything unclear? Ask us through Contact us in My info.