Privacy policy

At a glance

• Who we are: CoderBoost (https://coderboost.xyz) provides a network acceleration service for developers and AI builders, made up of this website, a desktop client and accelerated nodes.
• What we collect: account data (email, nickname, password hash, or your Google account identifier if you sign in with Google), the devices you sign in from, traffic volume and connection times for billing, orders and payments, and messages you send to support.
• Why: to create and secure your account, deliver and bill the acceleration service, process payments and refunds, prevent abuse, and answer your support requests.
• Who we share it with: no one for advertising or sale. Only the payment channel and email provider that process the minimum they need, or authorities when the law requires.
• How long: while your account exists; financial records for as long as the law requires.
• Your choices: view and manage your data in the account center, revoke Google access at any time, and ask us to delete your account.
• Google user data: see section 8 for exactly what we receive from Google, how it is used, and our Limited Use commitment.

1. Account and sign-in

• Email, nickname and a bcrypt hash of your password; the policy version you accepted at sign-up and when.
• Sign-in sessions: only a hash of the refresh token, the device and audience of the session, and issue/expiry times; access tokens are not stored.
• Devices: a device identifier (on the website, a random identifier generated for this browser; in the client, the device identifier), the device name, and the most recent IP address and time, used for the monthly device limit and device management.
• Email verification codes are stored only as an HMAC digest and are invalidated after use.

2. Usage and metering

• Traffic is metered per connection session on the nodes (time, byte counts and the nodes used) to deduct traffic and to assess outage compensation; the content of pages you visit is not recorded.
• When a node rejects or fails a connection, and when a UDP session starts or ends, the node's operational log records the account identifier and the target address, for troubleshooting and abuse prevention; successful forwarding is not logged per target.
• Custom domains you request and their review records are kept.

3. Orders and money

• Orders, quote snapshots (price and terms versions), transaction facts from the payment channel (only a summary and a SHA-256 of each message), refunds and compensation records.
• We never handle your bank card details; payment happens at the payment channel.
• Payee accounts for commission withdrawals are encrypted with AES-256-GCM, shown only to the administrator processing the withdrawal, and every view is audited.

4. Support

Support chat and ticket content is kept to handle your issue; only the staff assigned to that conversation or ticket and operators can see it.

5. Data stored on your device

• The website keeps in your browser's local storage: sign-in tokens, this browser's device identifier, and submission intents (command IDs) to avoid duplicate submissions. Signing out removes the tokens and intents. No third-party tracking cookies are used.
• The client keeps redacted, size-rotated diagnostic logs on your device; they leave the device only if you export them.

6. Sharing and disclosure

We do not sell or trade your personal information. We disclose it only when required by law or when necessary to protect the security of the service. Payment channels and the email provider process only the minimum information they need.

7. Your rights

• View your account, devices, orders and tickets, change your email and password, and remove devices in your account center.
• To correct or delete account data, contact support; financial records that the law requires us to keep are excepted.

8. Signing in with Google

• Scope of access: when you choose “Continue with Google”, we ask Google only for the openid, email and profile scopes. Google tells us your email address, whether it is verified, your name, your profile picture address and a stable Google account identifier. We do not request, and cannot access, your Gmail, Google Drive, Google Photos, contacts, calendar or any other Google service data.
• What we store: your email address, your name (used as your nickname, which you can change) and the Google account identifier, linked to your CoderBoost account. We do not store your profile picture, and we do not store any Google access token or refresh token; they are discarded as soon as sign-in finishes.
• How we use it: only to create your CoderBoost account, to recognise you when you sign in again, and to match the account if you already registered with the same verified email. We do not use it for advertising, profiling, analytics or training any model, and we do not use it to contact you except for service notices about your account.
• Sharing: we do not sell, rent or transfer Google user data to anyone. It is disclosed only to the service providers that run the service on our behalf (as described in section 6), or when the law requires it.
• Protection: the sign-in uses the OAuth 2.0 authorization code flow with PKCE over HTTPS; the client secret stays on our server and never reaches your browser. Account data is stored in our database with restricted access.
• Retention and deletion: Google-linked data is kept while your account exists. When you ask support to delete your account (section 7), the link to your Google account is removed together with the rest of your account data, except financial records that the law requires us to keep.
• Revoking access: you can remove CoderBoost's access at any time at https://myaccount.google.com/permissions. You can also sign in with email and password instead; use “Forgot password” to set one for a Google-created account.
• CoderBoost's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

9. Children

CoderBoost is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

10. Changes to this policy

When we change how we collect or use data, we update this page and its “Last updated” date; for material changes we also notify account holders by email or in the account center before the change takes effect.

11. Contact

For privacy questions, contact support from your account or the client, or email support@coderboost.xyz.