Privacy Policy

Last updated: July 25, 2026

This Privacy Policy explains how eepy.page collects, uses, stores, and shares information when you use eepy.page, the eepy.page API, canary or development deployments, and other official eepy.page services that link to this Policy.

eepy.page is operated as an independent project by PowerPCFan. For privacy questions, contact support@eepy.page. For abuse or vulnerability reports, contact report@eepy.page.

Information We Collect

We collect information you provide directly, including:

Account username, email address, password, and browser language.
Login, signup, password recovery, email verification, and account deletion codes.
Domain names, DNS record types, DNS record values, registration timestamps, and TLD access.
Tunnel configuration data, including the selected eepy.page hostname, subdomain, local port, SSH public-key fingerprint, Serveo authorization record, generated SSH command, and tunnel timestamps.
API key comments, API key permissions, and domain scopes.
Two-factor authentication setup data, including TOTP secrets and backup recovery codes.
Invite codes, referral codes, referral relationships, and reward code redemptions.
Messages or report details you send to support or abuse reporting addresses.

We also collect information automatically when you use the service, including:

IP address, user-agent, login timestamps, session creation and expiration timestamps.
IP-derived location and network information from ipinfo, such as country, region, city, approximate coordinates, ISP or organization, timezone, postal code, and EU status.
Application logs, security events, error reports, performance traces, and diagnostic data.
Pageview and usage analytics through Google Analytics and Vercel Speed Insights.
Sentry error, replay, logging, and tracing data. Sentry may receive request and browser details, error context, and other diagnostic information needed to debug the service.

How We Use Information

We use information to:

Create, verify, authenticate, secure, and manage accounts.
Provide subdomain registration, DNS record management, API access, invites, referrals, rewards, and optional TLD benefits.
Provision, display, update, and remove tunnel DNS records and generate the SSH command needed to use the optional Serveo-based tunneling feature.
Send account emails, including verification, password recovery, deletion, purchase, abuse, ban, domain removal, and administrative-action notices.
Detect abuse, enforce the Terms of Service, investigate reports, prevent fraud, and protect eepy.page infrastructure.
Debug errors, measure reliability, understand aggregate usage, improve features, and maintain the service.
Comply with legal obligations and respond to valid legal, security, or abuse requests.

Cookies and Local Storage

eepy.page uses cookies and browser storage for login, security, and basic site behavior.

The cookie banner lets you accept all optional categories, decline optional categories, or manage individual settings. eepy.page uses opt-in consent by default and may use opt-out consent in regions where the site can identify that this is appropriate. Declining optional categories keeps only necessary cookies and storage, including browser-only settings used for basic site behavior.

Necessary: login/session cookies, authentication state, security checks, the consent choice itself, browser-only settings such as theme and donation prompt state, and similar required site behavior. These are required for the service and cannot be disabled.
Analytics: Google Analytics and Vercel Speed Insights for pageview, usage, and frontend performance measurement.
Necessary error monitoring: Sentry frontend error monitoring, logs, tracing, and replay sampling used to debug problems and keep the service reliable.

You can reopen the cookie settings from the "Cookie settings" button at the bottom of the page. Some browser storage may also be cleared manually in your browser.

Third-Party Services

eepy.page uses third-party providers to operate the service:

MongoDB for database storage.
Vercel for frontend hosting and speed insights.
Sentry for error monitoring and debug logs.
Google Analytics for website analytics.
Cloudflare Turnstile for bot and abuse prevention during login and signup.
ipinfo for IP-based location and network metadata used during signup and abuse review.
Resend for transactional email delivery.
Ko-fi for optional donations and digital purchases. Ko-fi sends eepy.page purchase webhook data such as purchase type, purchased item data, and email address so we can issue reward codes.
Discord for internal signup notifications containing minimal information for debugging.
DNS infrastructure providers, including PowerDNS-compatible APIs, to publish and manage DNS records.
Serveo as the third-party provider used for optional SSH reverse tunneling. You create and manage the Serveo account, SSH key, and domain directly with Serveo. eepy.page does not receive or store your Serveo password or private SSH key, but Serveo may process information under its own policies when you use its dashboard or tunnel service. Serveo's Terms of Service can be found here.

These providers process information under their own terms and privacy policies. eepy.page is not responsible for websites, services, or payment platforms that are not controlled by eepy.page.

How We Store and Protect Information

Email addresses, display names, API key strings, TOTP secrets, backup codes, and verification or recovery code account links are encrypted before storage where supported by the backend. Passwords are stored as Argon2 hashes. API keys and some lookup values are stored or indexed using hashes. Session tokens are JWTs and active sessions are tracked in the database with expiration timestamps.

No method of transmission or storage is perfectly secure. We use technical and operational safeguards intended to protect the service, but we cannot guarantee absolute security.

Tunnel SSH fingerprints and authorization TXT records are intended to be public verification data. Do not submit private SSH keys, passwords, access tokens, or other confidential credentials to eepy.page. Protect private keys and Serveo account credentials on your own devices and in your Serveo account.

How Long We Keep Information

Account data is kept while your account exists. Session records and login tokens expire automatically. Verification, recovery, and deletion codes are short-lived. If an account is banned or marked for deletion after abuse action, related records may be retained for up to one year before automatic deletion.

Some logs, analytics, backups, provider records, email delivery records, DNS records, and security records may remain for longer where needed for operations, security, abuse prevention, legal compliance, or provider retention schedules.

Tunnel configuration data is retained while the tunnel or account remains active and may be removed when you delete the tunnel or account, subject to backups, logs, legal obligations, abuse investigations, and provider retention schedules. Deleting a tunnel from eepy.page does not delete your separate Serveo account, SSH key, domain, or Serveo-side records; you must remove those from Serveo directly.

Sharing and Disclosure

We do not sell your personal information. We may share information:

With the third-party providers listed above so they can provide hosting, analytics, email, payment, DNS, abuse-prevention, and monitoring services.
With administrators or trusted maintainers who need access to operate, secure, debug, or enforce the service.
When needed to investigate abuse, security incidents, fraud, or Terms of Service violations.
When required by law, legal process, or a valid request from an appropriate authority.
If eepy.page is transferred, reorganized, or replaced by another operator, subject to this Policy or a successor policy.

Public DNS Records and User Subdomains

DNS records you create are public by design. Domain names, DNS record types, and DNS record values may be visible to anyone querying DNS, using public DNS datasets, or visiting services connected to your subdomain. Do not put private or sensitive information in DNS records.

Your Choices and Rights

You can review account details in the account page and request an export of selected account data through the GDPR/account data feature. You can delete your account through the account deletion flow, which sends a confirmation email before deletion.

Depending on where you live, you may have rights to access, correct, export, delete, or object to certain uses of your personal information. To make a privacy request, contact support@eepy.page. We may need to verify your identity before acting on a request.

Children

eepy.page is not intended for children under 13. If you believe a child has provided personal information to eepy.page, contact support@eepy.page.

International Use

eepy.page and its providers may process information in the United States and other countries. By using the service, you understand that information may be transferred to and processed in countries other than where you live.

Do Not Track

Some browsers send Do Not Track signals. eepy.page does not currently respond to those signals because there is no common technical standard for them.

Changes to This Policy

We may update this Policy when the service, providers, legal requirements, or data practices change. The updated version will show a new "Last updated" date. If a change is major, we will try to provide reasonable notice through the website, email, or another appropriate method.

Contact

Privacy and support requests: support@eepy.page

Abuse and vulnerability reports: report@eepy.page