Privacy Policy

This policy explains what Crenel collects, why, and how long it is kept. The short version: we collect what the service needs to run, we do not sell data, and there are no card details anywhere because payments are crypto.

1. What we collect

Account data

• Username, used to identify your account.
• Email address, optional, used for receipts only.
• Password, stored as a bcrypt hash. We never store plaintext passwords.
• Referral code and referrer, used to attribute referral credit.

Payment data

• Crypto payment addresses and transaction hashes, used to match payments to orders.
• No card numbers, no bank details, no payment processor accounts. Crypto payments do not involve them.

Traffic data

• IP addresses and request logs from the challenge engine, used to run the blocklist, rate limits and analytics.
• Detection signals (headless, frame timing, audio fingerprint, honeypot, Turnstile result), used to decide whether a request is human and to show you where bots get caught.

2. Cookies

• A token cookie after you pass the challenge. It is HMAC-signed, bound to your IP and tenant, and expires after 4 hours.
• The ar_ref cookie, set when you arrive with a referral link, so the signup form can attribute your account to the right referrer. It lasts 7 days.
• Session cookies for the panel, so you stay signed in.

The challenge page itself does not set tracking cookies and does not follow you around the web.

3. How long we keep data

• Analytics and request logs: 90 days, then deleted.
• Backups: 7 days, then overwritten.
• Account data: until you ask us to delete it or the account is terminated.

4. Third parties

• Cloudflare Turnstile, when a subdomain has it enabled, processes the visitor's challenge in their browser. Turnstile is off by default.
• The IP blocklist provider (a public blocklist feed) supplies the list of known bot and datacenter IPs we check against. We do not send your data to them.
• Backups are encrypted with age and stored on Cloudflare R2. The encryption key is held by the operator only.

We do not sell or rent personal data to anyone. We do not run ad trackers on the panel or the challenge pages.

5. Your rights

You can ask for a copy of the data we hold about you, ask us to correct it, or ask us to delete your account and its data. Send the request through the Telegram channel from the contact page. We act on deletion requests within 30 days. Deleting your account takes your subdomains offline and removes your files.

6. Security

Passwords are bcrypt-hashed. Tokens are HMAC-signed and IP-bound. Backups are age-encrypted before they leave the server. The panel enforces rate limits on login and signup, and admin access is separate from customer access.

7. Changes to this policy

If this policy changes in a material way, we announce it in the Telegram channel before it takes effect.