Privacy policy

• We never log the websites you visit, the addresses you connect to or the content of your traffic.
• We keep your account email so you can sign in and reset your password.
• While you are connected we keep which server you use and when the session expires, then delete it.
• We do not sell, rent or share your data for advertising.

When you create an account we store your email address, a securely hashed password and the date the account was created. Accounts are managed by our authentication provider, Supabase, which processes this data on our behalf.

We use your email only to let you sign in, to send account emails you ask for (such as confirmation and password reset) and to contact you about important changes to the service.

To connect you, our control plane creates a short-lived session. For each active session it stores your account ID and email, the server and exit IP you chose, when the session started and when it expires. Sessions last about 15 minutes at a time and are renewed while you stay connected. Expired sessions are deleted automatically.

To keep you signed in, we store a rotating sign-in token for up to 30 days. Signing out deletes it.

Our servers do not record destination hosts, URLs, DNS lookups or traffic content. Server software logs contain only operational events, such as a server becoming unavailable, without user or destination details.

The Hushgate extension stores your settings (for example kill switch, split tunnelling rules and your chosen server) in Chrome's local storage on your device. Your current sign-in is kept in session storage and cleared when Chrome closes, unless you turn on "Stay signed in", in which case an encrypted, rotating sign-in token is kept on the device. Your password is never stored by the extension.

If "IP address lookup" is on, the extension asks Cloudflare's public trace endpoint for your current IP and country so it can show you your real and VPN addresses. You can turn this off in Settings.

hushgate.uk does not use advertising or third-party tracking cookies. If you sign in to the website, a strictly necessary session cookie keeps you signed in.

• Active sessions: until they expire, usually within 15 minutes of disconnecting.
• Sign-in tokens: up to 30 days, or until you sign out.
• Account email: until you delete your account.

You can ask for a copy of your data, ask us to correct it, or delete your account at any time by emailing support@hushgate.uk from the address on your account. Deleting your account removes your email and ends all sessions.

If we change this policy we will update the date at the top of this page, and tell you by email for significant changes. Questions: support@hushgate.uk.