Privacy Policy

01

Who is responsible

Support Rapid SRL, IDNO 1013600009516, Vadul lui Vodă, 60, MD-2023, Chișinău, Republic of Moldova, is responsible for your account data. Processing is covered by Moldovan Law 195/2024 on personal data and by the GDPR for customers in the EU.

If you use EdgeOwl for your company or for clients, see also the Data Processing Agreement.

[TODO legal: privacy contact, EU representative, and the data protection authority you can complain to]

02

What we hold

• Your account: email address, a hash of your password, your second factors (an encrypted TOTP secret, hashed backup codes, passkey public keys) and the time you accepted the terms.
• Sign-in with Google: if you continue with Google, the link between your account and that Google account.
• Sessions: the devices you are signed in on, as a label made from the browser, with the IP address and the time of last activity. You see this list in your account.
• Billing: your plan and billing details. Payments go through Paddle, so card numbers never reach us.
• Your routers: name, address, ports, model, RouterOS version, channel, schedule, status and job logs. The router password that the setup script creates for us is encrypted at rest in our database; the key lives only in the app's environment, not in the database.
• Your encryption key: the public half only.
• Your backups: encrypted files, with their dates and sizes. The contents are opaque to us.
• Alerts and messages: the Telegram chat you connect, and what you send us when you write to us.

03

What we cannot see

We cannot see anything inside a backup: interface names, addresses, firewall rules, VPN secrets, user accounts. We also cannot see your encryption key. The Security page explains how this works.

04

Why we use it

We use this data to run the service: to sign you in, to make backups and run updates and checks, to send account mail and alerts, to handle billing with Paddle and to answer you when you write.

[TODO legal: the legal basis for each purpose]

05

Where it lives and who helps us

Backups and the database stay in the EU: Amsterdam (Railway) and Frankfurt (Amazon S3). Payments go through Paddle (UK), DNS and proxy through Cloudflare's global network. Relay servers, which only pass traffic through, run at Hetzner in Germany.

[TODO legal: the legal basis and transfer safeguards for each row; /security says that list is here]

[TODO legal: whether Google, as a sign-in provider, belongs in this list]

06

How long we keep it

Backups are kept for 90 days, and each router always keeps at least its last 10 runs. If you delete your account, encrypted backups are deleted after 30 days.

[TODO legal: how long we keep account data, job logs, session records and messages]

07

Your rights

You can download your backups from the dashboard at any time, and change or delete your account there. You can also write to us to ask for a copy of your data, or to have it corrected or deleted.

[TODO legal: the full list of rights under Law 195/2024 and the GDPR]

08

Cookies and browser storage

The site remembers your theme in your browser's local storage. The app uses a session cookie to keep you signed in. The checkout window is served by Paddle. The site runs no analytics at the moment.

[TODO legal: update this chapter and add consent before Google Tag Manager is connected]

09

Changes and contact

Questions about your data: [email protected] or the Contact page.

[TODO legal: how we announce changes to this policy]