このページはまだお使いの言語では用意されていません。英語の文章をご覧いただいています。
Legal
What the server holds
Edition 4, in force since 18 October 2026
The account itself
An account row holds the email you signed up with, a hash of your password, the language you chose and the codes that confirm an address or reset a password.
It also holds the marks the server sets: a lock after too many wrong passwords, a block, the day the email last changed, your invitation code, whether it is a team login and which workspace opens first. Beside it sit your plan, your devices, your sessions, the two-step secret and the payments behind the plan.
Sign-ins and their IP address
Every sign-in writes a row in the History with its time and the IP address it came from, and with its country when our network provider reports one. The same happens when a new device is added.
Each row lands in the History of one workspace: for a sign-in, the one it opens (your Default workspace, else the first team you joined, else your own); for a new device, the one open at the time. Its owner and admins see the row there, and so do scripts they give a key to read History.
The table below names every place the server keeps a connection's IP address, who sees it and how long. The exit address of a proxy comes last: it is the proxy's address, not yours.
| Where the address is kept | Who sees it | How long |
|---|---|---|
| The address of every sign-in and of every new device, in its History row, with the country when our network provider reports one | The owner and the admins of the one workspace the row lands in, under History, and scripts they give a key to read History | While the account exists. When it is erased, these rows go from every History, other workspaces' too. |
| The first and the latest address of each sign-in session | You, under Where you are signed in on your account page. For a login that belongs to a team, also the owner of the team, and its admins for logins with a lower role, under Team | While the session is open and 90 days after it ends. |
| In the History row about an ended session, the address of that session; in the row about a changed password, the address it was changed from | The owner and the admins of the workspace the row lands in, under History, and scripts they give a key to read History | While the account exists. When it is erased, these rows go from every History, other workspaces' too. |
| The address of a change of email, of turning on two-step sign-in, of a request to delete the account, and of the wrong password after which sign-in was locked, in its History row | The owner and the admins of the workspace the row lands in, under History, and scripts they give a key to read History. A request to delete the account lands in your own History | While the account of the workspace owner exists. If your account is erased, such a row in the History of a workspace you do not own stays there. |
| API keys: the address a key was last used from, renewed by every request made with it, and the addresses a key was created from and revoked from in the workspace list, in History rows | The owner and the admins of the workspace, for every key in it, members' keys too: in Team API keys, in Team and API key changes and under History, and scripts they give a key to read History | The last address lives in the key's record, and a revoked key keeps its record while its owner's account exists. The History rows stay while the account of the workspace owner exists, also after a member who made the key erases their account. |
| In a team: the addresses an invitation was sent from and accepted from, the address a role was raised to Manager or higher from, and the address a team login was created from, in History rows | The owner and the admins of that workspace: under History and in Team and API key changes, which says who added a member and from which address. Also scripts they give a key to read History | While the account of the workspace owner exists, also after the member leaves the team or erases their account. |
| The address an Event call (webhook) was set up from, or had its signing secret replaced from, in its History row | The owner and the admins of the workspace, under History, and scripts they give a key to read History | While the account of the workspace owner exists. |
| Our letters that name an address: to you, about a new sign-in, a changed or reset password, a changed email, two-step sign-in turned on and a new API key; to the owner and the admins of a team, about a new member or a new Admin or Manager, with the address of that step. A letter waits in our queue with its whole text | The person the letter is written to | With the account of the person it is written to. |
| The exit address of a proxy: the address the proxy went out to the internet from when it was checked, by our server or by the app before a profile starts. It is the proxy's address, not yours | Everyone in the workspace who can see that proxy | Until the next check, until the proxy changes its IP from ARMANOS, or until you delete the proxy. |
Profile settings
A profile row holds: its number; who created it; its workspace; name; scenario; group; fingerprint template and its generation; the seed of a New fingerprint and how many times it was renewed; kernel version; proxy; notes; tags; status; location, including your own coordinates if you entered them; traffic saver; ports; launch arguments; what goes through the folder; WebRTC mode, and the address you entered for My address; the profile password as a hash, who set it and when; who has it open, from which device and until when; when it went to the recycle bin; when it was created and last changed.
That list is checked against the database schema, so a new field cannot appear on the server without appearing here. The values a site actually reads are not among them: the server keeps the template and the seed a profile's fingerprint is worked out from, and the values themselves are worked out on your computer each time the profile opens and are not sent.
The template, not the fingerprint
A template is a name like the macOS Chrome family. The screen, the cores, the card and the fonts are worked out from it and from the profile's seed at launch.
The generation travels with the profile
A profile keeps the generation it was created under, so the same profile describes the same machine on a second computer.
What stays on your computer
Cookies stay in the profile directory on your disk. The login and password a profile uses to sign in to a site stay there too. Your operating system seals the password on Windows only: on macOS it is sealed with a key that ships inside the program, and on Linux it is written as typed.
What you browse does not reach us: no history, no page content. Addresses you type in on purpose do: team bookmarks, the steps of a flow and the address of a webhook.
Proven by running, not by saying
Secrets we do hold
A proxy is different: the server has to hand it back to the app to route through it. The proxy password and the IP change link are stored, sealed with a server key. So are the two-step secret, the secret of a webhook and the keys of a profile transfer.
A proxy's secrets are returned only when a caller asks for them, which the app does and an ordinary listing does not. If the server has no key configured, the value is stored as it came and the server log says so rather than pretending. A value written without the key is sealed when the server next starts with it.
What else the server keeps
A message to support keeps the email you gave, the subject, the text and your plan at the time. From the app it also carries the app's report without site, proxy or IP addresses, and the app log only if you attached it yourself.
Every letter the server writes to you waits in its queue with the address, the subject and the whole text. When our mail route is not set up, it stays there marked as not sent.
A transfer of profiles to another account keeps the emails of both sides, the profiles, their exit country and the sealed key of the session file. The file itself goes to the recipient by a road you choose, not through our server.
The workspace history
A row of History holds who did it, whose workspace it was in, what the action was, when it happened and a small block of details.
It outlives the row it names: a team sees who deleted what after the thing is gone.
Who at ARMANOS sees it
People who run ARMANOS can see your account, plan, payments, devices, profile names, invitations and proxy requests, your History with its IP addresses, your messages to support and the address and subject of our letters. We look to answer you, check a sign-in that may be stolen or make a refund.
How long each thing is kept
What the server keeps, where it lives and for how long. Where the server does not delete something, the row says so.
| What | Where | How long |
|---|---|---|
| Your account: email, password hash, language, plan, the devices you signed in from, the two-step secret, who invited you | Our server | While the account exists; erased 3 days after you ask to delete it on your account page. |
| Sign-ins: time, IP address, and the country when our network provider reports one | Our server, under History | While the account exists, and until then the server deletes no History row. When the account is erased, its sign-ins go with it, from other workspaces' History as well. |
| Sign-in keys and API keys, kept as a hash (an API key also by its short prefix and the IP address it was last used from) | Our server | A sign-in key works for 30 days, an API key until you revoke it or its end date passes. The records stay while the account exists. |
| Sign-in sessions: app or browser, computer name, system, app version, IP address and the country when our network provider reports one | Our server, on your Account page | While the session is open and 90 days after it ends |
| Links in our letters | Our server | Confirming an address: 24 hours. Resetting a password: 1 hour. Joining a team: 7 days. |
| Profiles and their settings, groups, statuses, who a profile is shared with, sync reports, wrong profile password counters | Our server | Until you delete them. A profile leaves the server when you delete it permanently; the recycle bin does not empty itself. |
| Flows and their steps, schedules, webhook addresses and secrets, creatives (a text, or the path to a file on your disk: the file itself is not uploaded) | Our server | Until you delete them. |
| Your team: members and their roles, invitations, team bookmarks, workspace settings | Our server | A member's record stays while they are in the team; the rest until you change or delete it. |
| Saved proxies, with the password and the IP change link | Our server | Until you delete the proxy. |
| Workspace History: who did what, in which workspace, when, and a few details | Our server, under History | While the account of the workspace owner exists, and until then the server deletes no History row. |
| Messages to support: the email you gave, the subject, the text, your plan at the time and, when sent from the app, its report (version, system, engine, number of profiles, sync and local API settings) without site, proxy or IP addresses, and the app log only if you attached it yourself, with site, proxy and IP addresses taken out | Our server | 2 years after our last answer, with the email you gave, also after the account is deleted. |
| Our letters to you: the address, the subject and the whole text | Our server | With the account; a letter to someone without an account is erased 2 years after it was written. |
| Payments and subscriptions, with refunds and disputes, and proxy orders | Our server | No time limit: the server does not delete them, and after the account is deleted they stay without your email. The period the law requires will be named together with the operator. |
| Profile transfers: the emails of both sides, the profiles, the exit country, and the sealed key of the session file | Our server | 48 hours to answer. The key of an accepted file waits 7 days and is then erased. The record stays until the account of either side is erased. |
| Cookies, sign-ins to sites, browsing data | Only your disk | Not on our server. On your disk until you delete the profile permanently. |
How to check this page
Every claim above has a file behind it, listed below. The database schema shows the whole picture: a field that is not there cannot hold anything.
What this page does not cover
- It does not cover the copies of the database at our hosting provider. How long those are kept is not stated here yet.
- It does not describe what a site you visited keeps about that visit.
- It does not cover the folder you choose for session sync. That folder is yours, on a service you picked, and we never see it.
- It is not legal advice and does not claim compliance with any regime by name.
Where this is decided
Each line is a file you can open.
- Every field the server can hold, in one place
- apps/server/prisma/schema.prisma
- The sign-in pair never leaves the machine, checked by running the app
- apps/desktop/test/login-stays-local.js
- A fingerprint is derived rather than stored
- packages/shared/src/index.js
- Proxy secrets are sealed at rest and returned only on request
- apps/server/src/proxies/proxies.service.ts · apps/server/src/common/crypto/secret-box.ts
- What a row of the workspace history holds
- apps/server/src/common/audit/audit.service.ts
- Sign-ins and the IP address they came from, and who may read them
- apps/server/src/auth/auth.service.ts · apps/server/src/logs/logs.controller.ts
- Profile fields and how long things are kept, checked against the schema; where IP addresses are kept, found by running the server
- apps/web/content/право/хранение.json · apps/server/test/право-схема-и-страница.js · apps/server/test/право-ip-названы.js
Questions
- Do you store the fingerprint of each profile?
- No. The template, its generation and the seed are stored; the values are worked out from them each time the profile opens.
- Who sees the IP address of my sign-ins?
- The owner and the admins of the one workspace the row lands in, and scripts they give a key to read History. Other members do not.
- Do my cookies go to your server?
- No. They stay in the profile directory on your disk. They travel only inside a transfer archive you make yourself, or through the sync folder you chose.
- What does a teammate see?
- The profile settings shared with them. Not your cookies, not your sign-ins, and not the secrets of a proxy unless they are asked for by the app.
- Can I get a copy of what you hold?
- Sign in, open the support form and pick Your data. The list above is what there is to copy.
Editions of this document
- Edition 4, 18 October 2026: A message to support sent from the app now keeps the app's report without site, proxy or IP addresses, and the app log only if you attached it yourself, with those addresses taken out. Added who at ARMANOS can see your data and why.
- Edition 3, 16 October 2026: Added a table of every place the server keeps a connection's IP address: sign-in sessions, API keys (the address a key was last used from, and where it was created and revoked from), changes to your account and your team, Event calls and our letters, with who sees each and how long it stays. The exit address of a proxy is named apart: it is the proxy's address, not yours.
- Edition 2, 5 October 2026: Added: the IP address and time of every sign-in, who can read them, the sign-in sessions with their computer or browser and address, the full list of profile fields, the addresses you type in yourself, support messages, our letters and profile transfers, and how long each thing is kept, including account deletion.
- Edition 1, 13 September 2026: First edition.