// legal

Privacy Policy

Last updated: August 2026

1. Information We Collect

Account information: Name, email address, and Firebase UID when you sign in via Google OAuth.

Cloudflare credentials: Your Cloudflare Account ID and API token (or OAuth tokens), encrypted with AES-256-GCM before storage. We never see or store plaintext credentials.

Load balancer configuration: Origin server URLs, routing strategies, weights, and domain settings you configure through the dashboard.

Usage data: Pages visited, features used, and error logs for service improvement. No production traffic data is collected.

2. How We Use Your Information

We use your information solely to:

  • Provide and maintain the EdgeBalancer service
  • Deploy and manage Cloudflare Workers on your behalf
  • Authenticate your account and secure your data
  • Improve the service and fix issues

We do not: sell your data, access your production traffic, or use your credentials for any purpose other than the operations you initiate.

3. Data Storage and Security

All sensitive data (Cloudflare credentials, API tokens) is encrypted with AES-256-GCM before storage in MongoDB Atlas. Encryption keys are stored separately from the database.

Communication is encrypted via TLS. Authentication uses JWT tokens in httpOnly cookies with SameSite=Strict policy.

4. Data Sharing

We share data only with:

  • Cloudflare: API calls on your behalf to deploy Workers and manage DNS
  • MongoDB Atlas: Database hosting (data is encrypted at rest)
  • Firebase: Google OAuth authentication

We do not share data with advertising networks, data brokers, or any third parties not listed above.

5. Your Rights (DPDP Act 2023 & GDPR)

Under the Digital Personal Data Protection Act 2023 (India) and GDPR (EU), you have the right to:

  • Access: Request a copy of your personal data
  • Correction: Request correction of inaccurate data
  • Erasure: Request deletion of your account and all associated data
  • Data portability: Receive your data in a machine-readable format
  • Withdraw consent: Revoke consent for data processing at any time

To exercise these rights, email connect@ankan.in.

6. Data Retention

We retain your data as long as your account is active. When you delete your account, all personal data, credentials, and load balancer configurations are permanently deleted within 30 days.

7. Cookies

We use essential cookies only:

  • Session cookie: httpOnly, SameSite=Strict, 24-hour expiry for authentication
  • OAuth state cookie: httpOnly, SameSite=Lax, 5-minute expiry for CSRF protection during Cloudflare OAuth

No tracking cookies, analytics cookies, or advertising cookies are used.

8. Children's Privacy

EdgeBalancer is not directed at children under 13. We do not knowingly collect data from children.

9. Changes to This Policy

We will notify you of significant changes via email or a notice on the dashboard. Continued use after changes constitutes acceptance.

10. Contact

For privacy-related inquiries, data requests, or complaints:

Email: connect@ankan.in