Privacy

What the cloud stores.

Written from the database schema, not from a template — every item below names a column that actually exists. The short version: your receipts, your scans and your customers never reach us, because the print path has no cloud in it.

The part that matters

The print path never touches us.

This is the claim worth reading twice, because it is structural rather than a promise about our intentions.

Printing, drawer kicks and barcode scans stay on your LAN. Your POS talks to the node; the node talks to the printer. Nothing in that path depends on us being reachable, or even in business. Pull the internet out and it keeps working.
Telemetry is opt-out, per device. Turn it off and the data is dropped on arrival — it is not stored and then hidden.
Telemetry is repointable, which is the real test. PUT /cloud on the node sets which host its telemetry goes to. Point it at your own collector and we receive nothing from it at all, with no firmware change and no permission from us. A vendor who means "local-first" can hand you that switch; most cannot.
We never sell data, and there is no ad tech on this site.

The list

Every category we hold, and why.

If something you expected to see is missing from this table, it is missing from the database too.

Account

Your email address, and a session.

You sign in with an emailed code — there is no password to store. The browser session is a pn_refresh cookie: HttpOnly, SameSite=Lax, Secure over https. It identifies your session and nothing else; it is not an advertising identifier and it is not shared.

Orders

Email, amount, currency, and the shipping block Stripe returns.

Name and delivery address come back from Stripe's checkout and are stored against the order so the parcel can be sent and the receipt reproduced. Card numbers never reach us — Stripe holds those, and we keep only its session and payment-intent identifiers, any tracking number, and a record of any refund or cancellation we process. A presale order also keeps the ship window and any latest ship date it was sold with, and a record of each delay notice we send about it: the revised window and date we gave you, when, and who sent it. No card is saved for later: every order is a one-off payment.

Waitlist and notify-me sign-ups

Email, the product you asked about, the source (the page you signed up on), and the consent wording you were shown.

Kept so we can tell you about the thing you asked about, and so we can show what you agreed to. If we contact you, we note when and who did. Nothing else is attached, and it is not an account.

Nodes you have claimed

Serial, hardware revision, claim code, nickname, firmware version and slot.

This is what a fleet page is. It exists because you claimed the device; releasing it detaches it from your account.

Node heartbeats

Uptime in seconds, Wi-Fi signal strength (RSSI), free memory, USB health, update state.

Operational telemetry about a device, not about a person. No receipt content, no scanned barcode values, no customer data from your restaurant — the print path is not in this stream at all.

A hash of the node's public IP

A salted hash. Never the address.

One question is asked of it, and only ever as an equality test: are you on this node's network right now — which is what decides whether the LAN address your fleet page offers you will actually resolve. A public IP is a location, so storing the plaintext would hold something worth stealing and buy nothing.

Support chat

The transcript of the conversation, and whatever you paste into it.

If you paste a node's /status output, that output is in the transcript. Do not paste anything you would not want stored — the page cannot read your node itself, so everything it sees is something you chose to send.

Support tickets

Your email, the subject, category and messages, and any order or node you named.

A ticket is how a person here answers you, by email or on the site. We record whether the address was verified, and link an order or node only once we have checked it is yours. A guest ticket's email link is stored as a hash, never the link itself.

Staff notes

Short internal notes our staff write against a customer's email address.

Context for the next person who answers you — for example, that a replacement is already on its way. Never shown publicly, and deleted with everything else on a deletion request.

Onboarding transcripts

What an unknown USB device answered when a node interrogated it.

Descriptors and probe replies from a peripheral — a device, not a person. It is how a node can learn to drive hardware nobody wrote code for.

Processors

Who else sees it.

Five companies, each with one job. We add none silently: this list changes in the same commit as the integration.

Stripe: Payments and checkout. Holds the card details we never see; returns the shipping block we store.
Supabase: Authentication, the Postgres database, and object storage for firmware images and telemetry spool files.
Resend: Transactional email — order confirmations (including presale confirmations), shipping notices, delay notices, refund notices, support-ticket mail, and sign-in codes.
Anthropic: The model behind the support chat. It receives the conversation, including anything you paste into it.
Vercel: Hosting for this site and the API in front of it.

Your data

Retention, and getting it back or gone.

Orders are kept as long as the law requires us to keep sales records, because a tax authority and a warranty claim both need them.

Node telemetry and support transcripts are kept until you ask us to delete them. Releasing a node from your account detaches its telemetry from you. A deletion request deletes your waitlist sign-ups and any staff notes about you, and erases your support tickets — the subject and every message are wiped, and the ticket no longer carries your address.

Deletion and export. Contact us through hello@proxynodes.com from the address on the account and say what you want: a copy of what we hold, or its deletion. Deleting an account releases every node on it — the hardware keeps working, because it never needed us. Sales records we are obliged to retain are the one thing we cannot delete on request, and we will say so rather than quietly keeping them.

Questions about anything here: hello@proxynodes.com.

Who is responsible for your data. Jyvin Company, 1170 Palmetto Street, Clearwater, FL 33755, United States.