ProxyCheck.app

Privacy Policy

Last updated: October 21, 2026

1. Introduction

ProxyCheck.app (“we,” “us,” or “our”) operates the ProxyCheck.app free proxy list and proxy checker. This Privacy Policy explains what we collect when you use our website, API and Telegram bot, how we use it, who receives it and how long we keep it.

2. Information We Collect

Account Information

When you create an account, we keep your email address, your name and profile picture if your sign-in method provides them, how you sign in, your role and your Premium status. Sign-in is handled by Hanko, which we run on our own server. You can sign in with a passkey, a password or Google. If you set a password, Hanko stores only a password hash, never the password itself. If you sign in with Google, Google tells us your email address and basic profile. For each sign-in session, Hanko records the IP address and browser user agent.

Proxies You Check

When you check proxies (on the website or through the API), we store each proxy address, its protocol and any username and password it contains, together with the result: whether it works, its latency, exit IP address, country, city and network. Proxy usernames and passwords are stored as entered, because the service needs them to connect through the proxy. We also record the IP address the check came from and, if you are signed in, your account.

Lists, Alerts and API Keys

If you save proxy lists, we keep the lists, their check history and your alert rules. If you link Telegram for alerts, we keep your Telegram user ID and username. For API keys we keep a hash of the key (not the key itself), when it was last used and hourly usage counts.

Telegram Bot

When you use our Telegram bot, we log your Telegram user ID, username and first name, the command and filters you used, and how the bot answered.

Technical Data

We use your IP address to apply rate limits. Our server logs can include IP addresses, user agents and the paths requested; the logs of our sign-in service can also include your email address. When an administrator changes data, we log the administrator's IP address and user agent. Hanko, our sign-in service, also records sign-in and account events (sign-ups, sign-ins, failed sign-ins, sign-outs, changes to your email addresses, password or passkeys, account deletion and linking a Google account, each with the time, IP address, browser user agent, sign-in method, whether it succeeded and your account ID); in these event records the account email is masked, so only its first letters and the domain are kept. We count page views with Cloudflare Web Analytics: a script Cloudflare adds to our pages sends Cloudflare the page address, the referring page, page-load timings and your browser type. It does not use cookies or local storage and does not fingerprint you. There is no advertising or cross-site tracking, and we do not send marketing email.

Cookies & Browser Storage

Signing in sets three cookies that scripts on the page cannot read: hanko (your sign-in session, 12 hours), access_token (30 minutes) and refresh_token (7 days). Google sign-in also sets a short-lived state cookie (5 minutes) while you are on Google's page. The admin area also stores its sidebar state in a cookie. In your browser's local storage we keep your theme, whether you are signed in, whether you dismissed the install banner, sign-in progress and the quick-check draft (the text you pasted, which can include proxy usernames and passwords; empty the box to clear it). Local storage stays on your device.

3. How We Use Your Information

  • To run proxy checks and show you their results
  • To grow our proxy pools: working proxies from checks may be added to the proxies we serve, including the Premium pool
  • To sign you in and manage your account and Premium access
  • To send the Telegram alerts you set up
  • To apply rate limits and detect, prevent and fix abuse or technical problems
  • To enforce our Terms of Service

4. Who Can See Your Data

We do not sell, trade or rent your personal information.

Other users. Working proxies from checks may be added to the Premium pool, where other users can see and use them together with any username and password they contain. Do not check proxies you need to keep private. Anyone who has the link to a quick-check result made without an account can open it; the link contains a random ID. Saved lists belong to your account and other users cannot see them.

Our administrators. Administrators can see account data, saved lists and checked proxies, including who submitted a proxy (account email and IP address).

Service providers. Cloudflare carries all traffic to our website and API, so it processes your IP address and request data. Google receives your sign-in if you use Google sign-in. Telegram carries bot commands and alerts. Email you send to [email protected] is forwarded by Cloudflare to our Gmail mailbox (Google). Our replies, and the sign-in and password-reset codes we email you, are sent through Resend, which uses Amazon SES and keeps a log of the emails we send for 30 days. Proxy checks connect through the proxies to echo services (such as ip.proxycheck.app, ipinfo.io, httpbin.org, postman-echo.com, icanhazip.com and ip.oxylabs.io); they see the proxy's address, not yours. Our internal operations assistant, used only by administrators, sends operational data about the service to AI model providers.

We may also disclose information when the law requires it or in response to a valid legal request.

5. How Long We Keep It

  • Quick-check jobs, their per-proxy results and the queue messages that carried them: 72 hours.
  • Proxies from checks that work or time out, with their username and password and the account and IP address of the most recent submitter: until we remove them. The Premium pool removes a proxy within 14 days after it stops working.
  • Account data, saved lists, check history, alerts, the Telegram link and API key usage: while your account exists.
  • Sign-in session records (IP address and user agent), Telegram bot logs and the administrator audit log: until we remove them. Sign-in and account events in the sign-in service database: 90 days, to investigate account security. The same events also appear in its server logs (see Server logs below).
  • Rate-limit counters: from one minute to one hour.
  • Server logs: each service keeps its current log until the service is replaced or the log reaches its size limit, which can take from days to several months. Logs of our API, sign-in service and web server are also copied to an archive on our server, with tokens and sign-in codes removed; the archive keeps them for at most 30 days. Before we update a service, we save a copy of its log to check the update; we keep these copies until we no longer need them, and longer while fixing a problem.
  • Backups: encrypted; we keep the last 7 daily backups, so deleted data can remain in a backup for up to 7 days. Before maintenance we sometimes export the affected rows to a file on our server; those copies are kept until we remove them.

6. Deleting Your Account

Deleting your profile on the profile page disables your account but keeps its data. To erase your data, email us from the address on your account. We then delete your account together with its lists, check history, API keys, alerts and Telegram link, and on request the proxy records that name you as the submitter. Data in backups expires as described above.

7. Data Security

Connections to our website and API use HTTPS. Sign-in cookies cannot be read by scripts on the page, passwords are stored only as hashes, API keys are stored as hashes, backups are encrypted, and access to administrator functions is restricted. Proxy usernames and passwords you submit are stored as entered, as described above. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Where We Process Data

Our server is in Vietnam. Cloudflare processes traffic in its worldwide network, and the other service providers above process data in their own locations.

9. Your Rights

  • Ask for a copy of the personal data we hold about you
  • Ask us to correct inaccurate data
  • Ask us to delete your data (see section 6)
  • Export your proxy lists and check results
  • Stop using the service and withdraw your consent at any time

10. Children's Privacy

Our service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date.

12. Contact Us

If you have any questions about this Privacy Policy, please contact us at [email protected].