This policy explains what our service stores, what it never stores and which third parties are involved. We do not ask for your name, email address or any other personal details.
Summary
- You do not give us a name, email address, phone number, postal address or ID documents.
- Your account is a random account key. We store only a keyed one-way hash of it, never the key itself.
- We set one cookie, only to keep you logged in. There are no analytics, trackers or adverts.
- We do not store your IP address, the wallet address you pay from or your browsing history.
- Cloudflare hosts the website and its database. NOWPayments processes payments.
- We never send email, newsletters or marketing messages. All communication happens through tickets in your dashboard.
Your account
An account does not use an email address, name, username, password or phone number, and we never ask for ID documents. When you create an account, a random 64-character account key is generated and shown to you once, together with a recovery key in the same format. Either key logs you in.
We store only a keyed one-way hash of each key, made with HMAC-SHA256 and a secret pepper. We never store the keys themselves, so our staff cannot see, reset or recover them. If you lose both keys, the account cannot be accessed by anyone, including us.
In account settings you can regenerate either key, log out everywhere or delete your account. When you regenerate a key, the old one stops working and your other sessions are logged out.
What we store
This is the complete list of what our database holds.
Account and sessions
- A random account ID and the date the account was created.
- Keyed one-way hashes of your account key and recovery key.
- Hashes of your session tokens, with the date each session was created and the date it expires.
Orders and invoices
- Orders: the plan, operating system, add-ons, billing cycle and price.
- Invoices: the invoice number, amount, currency, status and dates, and the invoice and payment reference numbers from NOWPayments.
Services
- The plan, status and renewal date of each service.
- The server’s own IP addresses. These are the addresses of your server, not the IP address you browse from.
- The server’s initial login details, encrypted with AES-GCM using a key that is not stored in the database.
Support
- Your support tickets and their messages. They contain whatever you write, so please do not post personal data in tickets.
- Your service requests, such as reboot or reinstall requests.
Rate limiting
- Short-lived rate-limit counters. They use a keyed one-way hash of the visitor’s IP address, never the IP address itself, and are deleted within one hour.
What we do not store
We do not store:
- visitor IP addresses
- names, email addresses, postal addresses or phone numbers
- payment card details
- wallet addresses
- browser fingerprints
- browsing history
If you ask for a refund, you give us a refund address in a ticket. That address is kept as part of the ticket, like any other message.
We do not use analytics, trackers or advertising. The only third-party script on the site is Cloudflare Turnstile, which runs on forms. Fonts and icons are self-hosted.
Our application error logs never contain account keys, recovery keys, session tokens, server login details or IP addresses. Cloudflare keeps these error logs for a few days.
Cookies and local storage
Logging in uses one cookie: __Host-session. It is set with the HttpOnly, Secure and SameSite=Lax attributes. It holds a random session token, and our server stores only a hash of that token.
The cookie lasts 30 days and is extended while you keep using the site. It is strictly necessary for logging in, so there is no cookie banner. We set no other cookies, and we do not use local storage for tracking.
Third parties
Two service providers are involved in running the site and taking payments.
Cloudflare
Cloudflare hosts the whole site and its database, using Cloudflare Workers, D1, Turnstile and DNS. Like any hosting and network provider, Cloudflare processes your IP address and request details, such as your browser type and the pages you request, to deliver and protect the site. This happens under Cloudflare’s own privacy policy.
Cloudflare Turnstile runs a privacy-preserving browser check when you create an account, log in, create an invoice or open a ticket. In most cases there is no puzzle to solve.
NOWPayments
NOWPayments processes all payments through its hosted payment page, where you choose a coin and see a QR code to pay. NOWPayments sees:
- the invoice amount and currency
- our random invoice reference
- a short order description, which is the plan name
- when you open its payment page, your IP address and browser details, the coin you choose and the transaction itself
From NOWPayments we receive only the payment status, the amount and the coin, together with its reference numbers for the invoice and the payment. NOWPayments operates under its own terms and privacy policy.
Public blockchains
Transactions in Bitcoin, Ethereum, USDT and Litecoin are recorded on public blockchains and are visible to anyone by design. Monero transactions are private by design. We do not store the wallet address you pay from.
How long we keep data
- Sessions last 30 days and are extended while you keep using the site.
- Rate-limit counters are deleted within one hour.
- Error logs are kept by Cloudflare for a few days.
- Invoices are kept for accounting for 3650 days and then deleted automatically.
- Your account, orders, services, tickets and service requests are kept while your account exists.
Deleting your account
You can delete your account in account settings. To confirm, you type your key again. When you delete your account:
- your key hashes and all your sessions are deleted immediately
- any running services are cancelled at once, their stored login details are wiped and staff wipe the servers
- your tickets are kept for support history, but they are no longer linked to any account
- your invoices are kept for accounting for 3650 days and then deleted automatically
Legal requests
We disclose data only when we are legally required to. Because we store very little, there is very little we could disclose. Anything we could disclose is limited to the data listed above under What we store.
About this policy
This policy applies to CazanHosting, the website at cazanhosting.store and the services you order through it. If it changes, we publish the updated version on this page. If you have a question about it, open a ticket from your dashboard.