Privacy Policy

In short

We collect what we need to run the service and keep it safe. We do not sell your data. We do not use it for advertising.

1. What we collect

Account details

Your email address and a one-way hash of your password. We never store your password itself.

Terms acceptance

When you sign up, we record which versions of the Terms of Service and this Privacy Policy you accepted, when, and a salted hash of the IP address you used. Not the IP address itself.

IP addresses

Kept in rate limits (to stop abuse such as password guessing), in Verdict bot-decision logs, in our DNS servers' lookup logs, and in shortened form (last part removed) in web server access logs where we turn them on.

Hostnames

The hostnames you attach, their DNS check results, and the origin address your agent forwards to.

Request metadata

For bot scoring, Verdict looks at its IP address, network (ASN), path and headers such as the user agent. It stores a decision log: time, IP address, path without the query string, and the decision. To tune its bot scoring on our own sites, Verdict also keeps a scoring log with the time, hostname, a shortened IP address (last part removed), network (ASN), method, path (without the query string), user agent and the score it would have given, which is deleted automatically after about 30 days. For sites whose owners opt in to Verdict, Verdict also keeps a per-request scoring log with the time, hostname, method, path (without the query string), status code, a shortened IP address, the score, the decision and its reasons, whether the check failed open, and the user agent (cut to 256 characters), which is deleted automatically after about 10 days; no cookies, passwords, tokens or other login data are logged. Web server access logs, where turned on, keep the method, path without the query string, status code, response time and a shortened IP address; on our own website and on sites whose owners opt in to Verdict, the log also keeps the browser's user agent (cut to 256 characters); other headers and cookies are removed. Portal logs keep only the method, route pattern, status and response time. System service logs record service events and errors. Our DNS servers also log each lookup they answer: the requesting IP address, the name and record type asked for, and the result. For API keys we keep an audit list of key ID, route pattern, method, status and time. We do not store request or response bodies, and we keep your email address out of logs.

Outgoing emails

Sign-in emails (address verification and password reset) are sent through our email provider. We also keep a short record of each in a private outbox on our server: your email address, the message type and whether it was sent. We also email FastDog's own team a short notice when an account is created, confirms its email address or has its free trial paused, and a daily summary of totals. These notices include the account's email address and go only to us; the outbox record keeps only the message type and whether it was sent.

Messages

Emails you send us and our replies.

2. Why we use it

• To run the service: sign-in, routing your hostnames, issuing certificates, connecting your agent.
• To count visits to our own website: daily totals are worked out from its access logs, and only the totals are kept.
• To keep it safe: rate limits, abuse prevention, and investigating phishing, malware or attacks.
• To show you your status, traffic and bot scores.
• To bill paid plans and answer support requests.
• To meet legal obligations.

3. How long we keep it

• Account details and terms acceptance: while your account exists, then deleted, except where we must keep billing records by law.
• Operational logs (rate limits, Verdict decision logs, web server access logs, portal and system logs, DNS lookup logs, and API key audit entries): deleted automatically. Many are gone within 30 days, and some much sooner: rate-limit windows last from one minute up to 24 hours, Verdict's decisions file keeps about 7 days, rolled access-log files for most hostnames are deleted about 7 days after they roll over, and the API key audit list is also capped at the latest 1,000 entries per account. Web server access logs, portal logs, system logs and DNS lookup logs can take longer, as explained below.
• Verdict scoring log (our own sites): deleted automatically after about 30 days.
• Verdict per-request scoring log (sites that opt in to Verdict): deleted automatically after about 10 days.
• Records of emails the portal sends (the outbox): deleted automatically after about 7 days.
• Email messages: as long as we need them to handle your request and any follow-up.

Deletion runs automatically through scheduled cleanup and log rotation. Web server access logs, portal logs, system logs and DNS lookup logs are stored in files that are deleted a set time after each file rolls over: about 7 days for most hostnames' access logs, and about 30 days for a few of our own sites' access logs and for portal, system and DNS lookup logs. Because access-log files roll over only when they fill up, and portal, system and DNS lookup log files only when they fill up or reach their time limit, entries in these logs can be kept for more than 30 days, especially on a quiet site. Backups are deleted by a weekly cleanup once they are more than 30 days old, except that we keep the most recent backup of each kind and any backup needed to roll back a change, so data in those copies can last longer.

4. Who processes it for us

We use cloud hosting providers and our email provider to run FastDog. When paid plans launch, a payment processor will handle card details; we will not see or store full card numbers. Each provider only gets the data it needs to do its job.

• Hosting: cloud hosting providers for our servers.
• Email delivery: our email provider sends sign-in emails and our own account notices.
• Payments: a payment processor will be added when paid plans launch.

5. No selling

We do not sell or rent your personal data, and we do not share it for advertising. We disclose it only to the providers above, when the law requires it, or to protect people and the service from serious harm.

6. Your rights

You can ask us to show you the personal data we hold about you, correct it, export it, or delete it along with your account. Depending on where you live you may have further rights, including the right to complain to a data protection authority. We will verify the request comes from the account’s email address and reply within 30 days.

7. Security

Traffic between visitors and the FastDog edge uses HTTPS. Some hops behind the edge, such as from the agent to your app on your own server, may be plain HTTP. We store a one-way hash of your password, never the password itself, and API keys only as a hash. Portal logs keep only the method, route pattern, status and response time. No system is perfectly secure; if a breach affects your data, we will tell you.

8. Changes

We may update this policy. Each version has a version string at the top of this page. For material changes we will email account holders before they take effect.

9. Contact

Privacy questions and requests: email support@fastdognetworks.com. See also our Terms of Service and FAQ.