Privacy Policy

1. Controller

The controller under Art. 4 (7) GDPR is the operator of ShadowNode. Contact for privacy questions: [email protected].

2. Visiting this website

To deliver the website, our web server has to process your IP address, the requested page, and your browser's technical headers. This happens only in memory, for the duration of the request. We do not write access logs for this website or for our API.

If an error occurs, the server writes an error log entry. It can contain an IP address and is deleted automatically after 7 days. To protect logins against password guessing, we keep a counter of recent attempts per IP address and per email address in memory for up to one hour; it is never written to disk. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in a secure and working website.

This website loads no content from third parties.

3. Cookie

When you sign in, we set one cookie named __Host-sn_s. It contains a random session key, is only sent to our own server over HTTPS, cannot be read by scripts, and expires after 30 days or when you sign out. On our side we store only a hash of this key. The cookie is strictly necessary to provide the account you asked for, so no consent is required (§ 25 (2) no. 2 TDDDG). Legal basis for the processing: Art. 6 (1) (b) GDPR.

Pages you visit without signing in set no cookies.

4. Customer account

To order hosting you need an account. We store:

• your email address,
• an Argon2 hash of your password (never the password itself),
• the date your account was created and whether your email is confirmed,
• short-lived login and reset codes (as hashes, deleted after use or after 15 minutes),
• if you turn on two-factor authentication: its secret key and hashes of your recovery codes.

Optional: sign in with Google. You don't have to use this; email and password always work. If you click "Continue with Google", your browser is sent to Google, and Google tells us your email address and that it is verified. We don't ask for and don't receive your name, photo, contacts or anything else, and we load no Google scripts on our pages. Google, however, learns that you have an account with us and when you sign in (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google may process data in the USA under the EU-US Data Privacy Framework). During the redirect we set a short-lived cookie __Host-sn_g (10 minutes) that protects the sign-in against forgery. If your account uses two-factor authentication, a second cookie __Host-sn_2fa (5 minutes) carries the pending sign-in to the code step. Legal basis: Art. 6 (1) (b) GDPR, because you choose this way of signing in.

We use your email address to confirm it belongs to you, for login and password reset codes, for order and payment confirmations, and for notices about your hosting (for example expiry reminders or abuse reports concerning your website). We do not send newsletters or advertising. The address does not need to contain your name.

Legal basis: Art. 6 (1) (b) GDPR (contract and pre-contractual steps).

5. Orders and payments

For each order we store the plan, billing period, price in euros, the network and coin you chose, the exact crypto amount, our receiving address, and, once paid, the transaction ID, block number and time of payment.

How we detect payments. We do not use a payment processor. Our server reads public blockchain data to find a transaction to our address with the exact amount of your order. For this it sends requests about our own receiving addresses (never about you) to public blockchain gateways: mempool.space and blockstream.info (Bitcoin), publicnode.com and api.mainnet-beta.solana.com (Solana), publicnode.com and the official public endpoints of Base, BNB Chain, Arc and Robinhood Chain (EVM networks). These services see the IP address of our server, not yours.

Exchange rates. To convert euro prices into crypto amounts, our server fetches current rates from CoinGecko. No data about you is sent.

Blockchains are public. A transaction you send is visible to anyone, permanently, including the sending address and the amount. This is a property of the blockchain and outside our control. If you don't want your payment to be linked to other activity of your wallet, use a fresh wallet address.

Legal basis: Art. 6 (1) (b) GDPR, and Art. 6 (1) (c) GDPR for records we must keep under German tax and commercial law (§ 147 AO, § 257 HGB, up to 10 years).

6. Your hosted websites

Files and databases you upload, in the browser or over SFTP, are stored on our servers so we can serve them. Files you upload in the browser are kept in a temporary folder only until they are copied into your website, usually a few seconds. We don't look at them unless we receive an abuse report or need to fix a technical problem. We don't keep access logs for customer websites. If you process visitors' personal data on your website, you are the controller for that data, and we act as your processor under Art. 28 GDPR. A data processing agreement is available on request.

Versions and backups. Every upload and, once a night, every changed website is saved as a compressed copy, and each database is exported once a night. We keep the last 10 uploads and 7 nightly copies, on the same server in Germany, so you can restore them in your panel. They are deleted together with your website.

Visitor statistics. To show you how many people visit your website, our web server passes each page request to a counter on the same machine. The counter only keeps daily totals: page views, the number of distinct visitors, the most visited pages and the referring websites. To count distinct visitors it hashes the IP address and browser string together with a random value that only exists in memory and is replaced every day; the IP address itself is never written anywhere. Images, scripts, bots and failed requests are not counted. No cookies are set and no script runs in your visitors' browsers. The daily totals are kept for 400 days.

Contact forms. If you add our form to your website, what visitors send through it is stored encrypted for 90 days so you can read it in your panel, and, if you switch it on, forwarded to the email address of your account. The sender's IP address is used only for short-lived rate limits against spam and is not stored with the message. For these messages you are the controller and we are your processor.

7. Service providers

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: server hosting in Germany, as our processor under Art. 28 GDPR.
• Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA: sends our automated emails (login codes, order confirmations, notices). Resend processes your email address and the message content on our behalf under a data processing agreement (Art. 28 GDPR); transfers to the USA are covered by appropriate safeguards (Art. 46 GDPR).
• Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland: our support inbox. If you email us or reply to one of our emails, the message is processed by Google (Gmail). Google may transfer data to the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework.
• Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA: DNS for our domain. Cloudflare is certified under the EU-U.S. Data Privacy Framework.

8. Contacting us

If you email us, we use your message and address only to answer it. Abuse reports and our replies are kept for up to 12 months to handle repeat cases. Legal basis: Art. 6 (1) (b) or (f) GDPR.

9. How long we keep data

• Unconfirmed accounts: deleted after 7 days.
• Orders that were never paid: deleted after 90 days.
• Your account: deleted after 30 days without a login, unless you have hosting that is still running. We email you 7 days before. You can also ask us to delete it earlier.
• Files, databases, versions, backups, form messages and statistics of your websites: deleted 14 days after your hosting ends.
• Form messages: deleted after 90 days. Visitor statistics: deleted after 400 days. Versions and backups: only the most recent ones are kept (see section 6).
• Payment records: kept for the statutory period (up to 10 years), without your email address once your account is deleted.

10. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). Write to [email protected] from the email address of your account, so we can tell the request is really from you.

You can also complain to a data protection supervisory authority, for example the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestr. 2–4, 40213 Düsseldorf, ldi.nrw.de.

Last updated: 25 October 2026