EchidnaPrivacy Notice
Echidna is built so that your work stays on your computer. This notice explains what the licence service and this website do collect, why, and what the app contacts on its own.
Version 1.0 draft. Effective date: [to be set by the operator]. Controller: [operator legal entity and address].
The short version
- Your profiles, cookies, saved logins, proxies, browsing history and page content stay on your computer. They are never uploaded to us.
- The licence service knows who may run Echidna on which device: your account, your licence and your devices, plus a security log with IP addresses.
- Your licence key is stored only as a hash, your password only as a hash, and your device only as a salted hash.
- The app has no analytics, telemetry or crash reporting.
- This website sets no tracking cookies and loads no third-party scripts.
What stays on your computer
Everything Echidna works on is stored in its data folder on your computer (~/.echidna): profiles and their fingerprints, cookies and site storage, saved logins and 2FA secrets, proxies, flows, schedules, mail settings and logs. Backups are written to that folder too, encrypted. We have no access to any of it, and deleting your account with us doesn't touch it.
The licence service
The licence service at keys.renotsnkrs.com lets you sign in, enforces your licence's device limit and authorises downloads and updates.
| Data | Why | Notes |
|---|---|---|
| E-mail address and optional display name | Identify your account | |
| Password hash | Check your sign-in | Argon2id; the password itself is never stored |
| Licence key hash and a 4-character hint | Check sign-ins with a key | The key itself is never stored |
| Device: salted hash of its ID, device name, operating system and version, app version, first and last seen, a public key for the device | Enforce the device limit and let you tell your devices apart | The device name defaults to your computer's name; you can change it when you sign in. The raw device ID never leaves your computer, and the server hashes the value again before storing it. |
| IP address of each device's last connection | Security and abuse investigation | A change of IP address is recorded in the security log |
| Security log: time, action, outcome and IP address | Accountability and abuse investigation | Covers sign-ins (granted or refused), sign-outs, revocations and administrative actions. Append-only; never contains passwords, keys or device hashes. |
| Licence details | Run your licence | Status, device limit, entitlements and expiry |
When you sign in, the app sends your e-mail and password (or your licence key), the device hash, device name, operating system, app version and the device's public key. When it checks in every few hours, it sends its signed licence file, the device hash, the app version and a signature. It never sends profile contents.
Fingerprint issuance
New fingerprints are issued by Echidna's servers, through the licence service. When you create a profile or ask for a new fingerprint, the app sends your operating system type, the browser brand and a timestamp. For a new fingerprint on an existing profile, the request can include the proxy exit IP address Echidna last saw for that profile. The licence service records that a request was made (licence, device, time, outcome and IP address) but not its contents. [Operator: state how the fingerprint service uses and retains these inputs.]
Services the app contacts
Besides the licence service, Echidna connects to these on its own:
| Service | When | What it sees |
|---|---|---|
get.renotsnkrs.com, dl.renotsnkrs.com | Checking for and downloading app and browser-engine updates | Your IP address; downloads are authorised by the licence service |
api.ipify.org, icanhazip.com | When a profile with a proxy opens and its timezone or location follows the proxy, or the launch requires a working proxy | Contacted through the proxy, so they see the proxy's exit IP |
ipwho.is | Right after that, to look up the exit IP's timezone and location | Contacted directly, so it sees your own IP address and the proxy's exit IP |
api.ipify.org, checkip.amazonaws.com, ifconfig.me | When you check a proxy | Contacted through the proxy being checked |
Profiles without a proxy skip the IP and location lookups. Other connections happen only when you set them up: captcha-solving services you add your own key for, mail servers and Microsoft sign-in for mailboxes you connect, webhook addresses you configure, and of course the websites you visit in your profiles. Those services' own privacy terms apply.
This website
- No tracking. No analytics, advertising or third-party scripts, and no cookies set by these pages.
- Request access form. Collects your name, work e-mail, team size, what you plan to use Echidna for and whether you accept the Acceptable Use Policy. It is sent to the licence service so we can review your request and reply. [Operator: state where requests are stored, who reviews them and how long they are kept.]
- Releases page. Your browser loads the public release list from
get.renotsnkrs.comwithout cookies. - Hosting. Like any web server, the hosting may log IP addresses and requests. [Operator: state hosting log retention.]
Sharing
We don't sell your personal data. We share it only with infrastructure providers needed to run the service (such as hosting and content delivery), under confidentiality obligations; when required by law; or to investigate fraud and protect the service, its users and the public, in line with the Acceptable Use Policy.
Retention
- Account, licence and device records are kept while your account is active and for [operator: period] afterwards for security and legal reasons, then deleted or anonymised.
- Server request logs containing IP addresses are kept for [operator: window, e.g. 30–90 days].
- The security log is append-only and kept for accountability.
Your rights and deletion
Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict some processing. To use these rights, or to ask for your account and licensing data to be deleted, contact [operator privacy contact address]. We act on verified requests within the time the law requires.
Deleting your licensing data removes your account and device records from the licence service. It doesn't touch the data Echidna keeps on your own computer; you can delete that yourself at any time by removing Echidna's data folder.
Security
Passwords are hashed with Argon2id; licence keys and device IDs are stored only as hashes; online requests from the app are signed by a key that stays on your device; and the app reaches Echidna's servers only over HTTPS. See Security for more.
Changes and contact
We may update this notice. The current version and effective date appear at the top. Questions: [operator privacy contact address].
See also the Acceptable Use Policy.