Privacy
What the cloud stores.
Written from the database schema, not from a template — every item below names a column that actually exists. The short version: your receipts, your scans and your customers never reach us, because the print path has no cloud in it.
The part that matters
The print path never touches us.
This is the claim worth reading twice, because it is structural rather than a promise about our intentions.
- Printing, drawer kicks and barcode scans stay on your LAN. Your POS talks to the node; the node talks to the printer. Nothing in that path depends on us being reachable, or even in business. Pull the internet out and it keeps working.
- Telemetry is opt-out, per device. Turn it off and the data is dropped on arrival — it is not stored and then hidden.
- Telemetry is repointable, which is the real test.
PUT /cloudon the node sets which host its telemetry goes to. Point it at your own collector and we receive nothing from it at all, with no firmware change and no permission from us. A vendor who means "local-first" can hand you that switch; most cannot. - We never sell data, and there is no ad tech on this site.
The list
Every category we hold, and why.
If something you expected to see is missing from this table, it is missing from the database too.
Account
Your email address, and a session.
You sign in with an emailed code — there is no password to store. The browser session is a pn_refresh cookie: HttpOnly, SameSite=Lax, Secure over https. It identifies your session and nothing else; it is not an advertising identifier and it is not shared.
Orders
Email, amount, currency, and the shipping block Stripe returns.
Name and delivery address come back from Stripe's checkout and are stored against the order so the parcel can be sent and the receipt reproduced. Card numbers never reach us — Stripe holds those, and we keep only its session and payment-intent identifiers plus any tracking number.
Nodes you have claimed
Serial, hardware revision, claim code, nickname, firmware version and slot.
This is what a fleet page is. It exists because you claimed the device; releasing it detaches it from your account.
Node heartbeats
Uptime in seconds, Wi-Fi signal strength (RSSI), free memory, USB health, update state.
Operational telemetry about a device, not about a person. No receipt content, no scanned barcode values, no customer data from your restaurant — the print path is not in this stream at all.
A hash of the node's public IP
A salted hash. Never the address.
One question is asked of it, and only ever as an equality test: are you on this node's network right now — which is what decides whether the LAN address your fleet page offers you will actually resolve. A public IP is a location, so storing the plaintext would hold something worth stealing and buy nothing.
Support chat
The transcript of the conversation, and whatever you paste into it.
If you paste a node's /status output, that output is in the transcript. Do not paste anything you would not want stored — the page cannot read your node itself, so everything it sees is something you chose to send.
Onboarding transcripts
What an unknown USB device answered when a node interrogated it.
Descriptors and probe replies from a peripheral — a device, not a person. It is how a node can learn to drive hardware nobody wrote code for.
Processors
Who else sees it.
Five companies, each with one job. We add none silently: this list changes in the same commit as the integration.
- Stripe
- Payments and checkout. Holds the card details we never see; returns the shipping block we store.
- Supabase
- Authentication, the Postgres database, and object storage for firmware images and telemetry spool files.
- Resend
- Transactional email — order confirmations, shipping notices, and sign-in codes.
- Anthropic
- The model behind the support chat. It receives the conversation, including anything you paste into it.
- Vercel
- Hosting for this site and the API in front of it.
Your data
Retention, and getting it back or gone.
Orders are kept as long as the law requires us to keep sales records, because a tax authority and a warranty claim both need them.
Node telemetry and support transcripts are kept for TBD — a retention window still to be set. It is written as TBD rather than filled in with a plausible-looking number, because a retention promise you cannot verify is worse than an admission that it has not been decided.
Deletion and export. Email privacy@proxynodes.com from the address on the account and say what you want: a copy of what we hold, or its deletion. Deleting an account releases every node on it — the hardware keeps working, because it never needed us. Sales records we are obliged to retain are the one thing we cannot delete on request, and we will say so rather than quietly keeping them.
Both addresses on this page are placeholders (TBD) until a monitored mailbox is confirmed. Until then, reach us through support.
Questions about anything here: support@proxynodes.com.