Privacy Policy

We store only what's necessary to provide the service:

• Account information — your email address, name, and account creation date
• Service assignments — which services you've registered, your assigned subdomain, and any custom domains
• Order history — payment amounts, status, and timestamps for billing purposes

HomeGate is a proxy — we route traffic, we don't inspect it:

• No traffic content logging — we never log, store, or inspect the content of your proxied traffic
• No browsing data — we don't track which pages your visitors access through your services
• No visitor profiling — we don't build profiles of you or your visitors' behavior

We use cookieless analytics on our marketing site to understand general traffic patterns (see Analytics below), but this is entirely separate from your proxied traffic, which we never monitor or log.

We collect infrastructure metrics for capacity planning and billing purposes:

• Bandwidth counters — aggregate per-customer bandwidth usage for capacity planning
• System metrics — CPU, RAM, and disk usage of our VPS infrastructure

These are operational counters, not content inspection. We measure how much traffic flows through, not what the traffic contains.

• Account data is stored in an encrypted database
• Infrastructure metrics are stored separately for capacity planning
• SSH keys are encrypted at rest using AES-256-GCM with Argon2id key derivation, with per-VPS isolation
• All connections between your browser and HomeGate are encrypted over HTTPS/TLS
• All tunnel traffic between our infrastructure and your home server is encrypted via Tailscale (WireGuard)

HomeGate uses only essential cookies and local storage required for the service to function:

• Authentication cookies — HttpOnly session cookies for secure login. These are strictly necessary and do not track you.
• Local storage flag — a simple flag (homegate_logged_in) to manage client-side authentication state. No personal data is stored.

We do not use any tracking cookies or advertising cookies. Our analytics operate in cookieless mode (see Analytics below), so no cookie consent banner is required for analytics purposes.

We use Google Analytics 4 via Google Tag Manager in cookieless mode. All consent types are set to denied by default, meaning:

• No tracking cookies are set on your browser
• No personal data is collected or stored
• No cookie consent banner is shown

Google provides aggregated, modeled data only. This helps us understand general traffic patterns without identifying individual visitors. Ad data is also redacted and URL passthrough is enabled for privacy-safe conversion measurement.

We use a small number of third-party services to operate HomeGate:

• Revolut Business — payment processing. Your payment details are handled directly by Revolut; we don't store card numbers
• Resend — transactional notifications only (order confirmations, password resets)
• Cloudflare — CDN and DNS services
• Datalix — VPS infrastructure hosting
• Google — analytics and conversion measurement via Google Tag Manager and Google Analytics 4, operating in cookieless mode with no personal data collection

We retain your account data for as long as your account is active. Infrastructure metrics are retained for capacity planning and may be aggregated over time.

If you delete your account, we will remove your personal data (email, name) and service assignments. Order records may be retained as required for accounting and legal obligations.

To request data deletion, contact us through your dashboard.

If you have questions about this privacy policy or how we handle your data, reach out through your dashboard.