The short version

• ZoneBlade doesn't keep a record of the sites you visit.
• We count how much data each device uses, by country, to run allowances. Counts only.
• You don't need an account. No ads, and we don't sell data. Our website counts visits only if you allow it.

What we keep

• Your email address (only if you sign in, or give it when you buy Premium). Where: Our database. How long: Until you ask us to delete your account. Why: To sign you in and keep your plan on all your devices.
• Your Google account number (only if you sign in with Google). Where: Our database. How long: Until you ask us to delete your account. Why: To recognise you next time.
• If you buy Premium: your subscription (monthly or yearly, its status and renewal date) and our payment provider's customer number for you. Where: Our database. How long: Until you delete your account. Why: To give you Premium and show it on your account page.
• Each device: a name like "Firefox on macOS", when it was added and last used. Where: Our database. How long: Until you delete your account. A signed-out device: 30 days. A device never signed in: until it's gone unused for about 13 months. Why: So you can see your devices and sign them out.
• Sign-in links, website sessions and device tokens. Where: Our database, scrambled (one-way hashes), never in readable form. How long: Sign-in links work for 15 minutes and are deleted after an hour; website sessions last 30 days and are deleted when they end; device tokens 90 days. Why: To keep you signed in.
• How much data each device used: bytes per country, per hour, day and month. Where: Our servers. How long: Hourly counts 40 days; daily and monthly counts about 13 months. Why: To run Premium's monthly allowance and show you your use.
• Which server each tab's country goes through: a random tab number and the country, no sites. Where: Our servers' memory. How long: Under an hour. Why: To keep each tab on a server that sites place in the country you chose.
• Your IP address. Where: Rate-limit counters. How long: Up to a day. Why: To stop floods of sign-ups and sign-in emails.
• How much data Free uses from each internet address (IPv6: its first half) and each network: bytes by day and by month. Where: Our servers. How long: Daily counts 2 days; monthly counts 35 days. Why: To keep Free fair: very heavy use from one connection is slowed, then paused.
• Which of our servers each Free browser used in the last minute or two (its ID and the country). Where: Our servers. How long: Two minutes. Why: So one browser can't use every server at once.
• Only if you allow analytics: visits to our website (the pages you open there, roughly where you are, your browser and device). Where: Our analytics provider. How long: 14 months at most. Why: To see which pages of our website help people. Never what you browse with ZoneBlade.
• The networks an account's browsers connect from. Where: Our servers. How long: Two hours. Why: To notice an account shared or resold across many places.
• Signs of abuse: the browser's ID, its account, its address, what we noticed (for example very many different sites in an hour, or many refused connections) and a number. Never which sites. Where: Our database. How long: 90 days. Why: To stop abuse, and to check each case by hand.
• Suspensions: what was suspended (a browser, an account, an address or a network), why, by whom, and when. Where: Our database. How long: While in force, and two years after. Why: To keep abuse off ZoneBlade, and to answer anyone who asks why.
• Totals across everyone, a day at a time: active browsers, traffic, revenue and costs. Where: Our database. How long: As long as we run ZoneBlade. Why: To run ZoneBlade without losing money (no one person is in them).
• Each request to our website and API: your IP address, the address requested, and your browser's name. Where: Our hosting's web server log. How long: A log of fixed size that keeps only the latest requests: older ones are overwritten as new ones arrive. Why: Security, and finding faults.
• Each request's page or API path, result and timing, without your IP address. Where: Our monitoring. How long: 14 days. Why: To spot errors and slowness.

Your settings (countries, mode, site rules, and that you agreed to these terms) stay in your browser. They never reach us.

What we don't keep

• The sites you visit, the addresses of pages, or your browsing history.
• The content of pages. Secure (https) pages are encrypted between your browser and the site; we can't read them.
• Anything that ties a site to you in our logs. Our error logs record error codes, never addresses.
• What your browser's connection looks like (its secure-connection handshake) and how many different sites it reaches. They're looked at as you browse, to tell browsers from scripts and spot abuse, and never stored: only a sign of abuse, as above, is kept.
• Your card number. Our payment provider takes it when you pay; we never see it.

Like any VPN, ZoneBlade has to know which site to connect you to (its name and port) while the connection is open. It isn't written down.

Who else sees your traffic

• The network you're on (the Wi-Fi, your internet provider) sees that you use ZoneBlade and which country, not which sites: your connection to us is encrypted.
• Sites you visit see an address in the country you chose, not yours.
• The servers you browse through, ours and our network provider's, carry that traffic. They see which sites are connected to, and the encrypted traffic, on ZoneBlade's account. They don't know who you are.
• Our email provider delivers sign-in links.
• Our security provider protects our website and API from attacks, so it sees each request to them: your IP address and the address requested. It also runs the quick check that you're a person when you set ZoneBlade up, which sees your browser and IP address. It doesn't carry your browsing.
• Our analytics provider, only if you allow analytics, counts visits to our website. It never sees what you browse with ZoneBlade.
• Our payment provider takes your card and billing address when you buy Premium, and keeps payment records as the law requires. It sees your email address and what you bought, never which sites you visit.

Who we use

• Our hosting provider, in the EU, hosts our website, API and database.
• Our cloud provider runs servers that carry browsing, and sends our emails.
• Our network provider runs servers that carry browsing too.
• Our security provider protects our website and API, and runs the human check.
• Our payment provider takes payments for Premium.
• Our analytics provider, in the US, counts visits to our website if you allow it.

Some of them handle data outside the UK. Where they do, they protect it with the safeguards UK law requires.

The add-on

To send your browsing through the country you choose, the add-on handles every request Firefox makes. It uses them only for that: it doesn't read pages or collect your history, and apart from carrying your traffic as described above, it sends nothing about the sites you visit. Each country's tabs are in their own container, so their cookies stay apart, in your browser; they never reach us. We use what the add-on handles only to provide ZoneBlade: we never sell it, never use it for advertising, and no one reads it.

Your choices

• Use ZoneBlade without an account.
• Cancel Premium any time on your account page (zoneblade.com/account).
• Sign a device out from the add-on or your account page. It stops working at once.
• Delete your account and everything above from your account page, or email privacy@zoneblade.com. Only suspension records stay, for as long as listed above, so abuse can't come back as a new account.

Who we are

ZoneBlade is run by Scoritz Limited, registered in England, company number 03426573, VAT number 699 3624 73. We are the data controller for everything in this policy. Scoritz Limited, The Loft, Unit 11 Hunthay Business Park, Axminster, Devon EX13 5RJ.

Privacy questions: privacy@zoneblade.com

The full policy, including our website's cookies: https://zoneblade.com/privacy