7 things a proxy provider can know about you, and what GhostConnect cannot

A proxy hides your address from the sites you visit. It does not hide anything from the company selling it to you. Most providers know far more about their customers than the customers assume, and most of it is collected by habit rather than need. Here are seven things a provider can know, why they usually keep it, and what GhostConnect does with each.

1. Your email address

Almost every provider asks for an email at sign-up. It is the username, the password-reset channel, the receipt address and the marketing list, all in one field. It is also the single most useful thing to hand over when someone asks who holds an account: an email ties a proxy account to a person, and often to every other account that person has.

GhostConnect has no email field. An account is one random 32-character key, shown once at sign-up and stored only as a SHA-256 hash. There is no password reset, because there is nothing to send one to. Lose the key and the account is gone; that is the price of the design, and the sign-up page says so.

2. Your name

Names turn up on invoices, in billing profiles and on anything a card processor returns. Providers keep them because accounting systems expect a name on an invoice and because support staff like to know who they are talking to.

GhostConnect never asks for a name, a phone number, a postal address, a date of birth or an identity document. The database schema has no column for any of them, and no form on the site asks. Invoices name the account by number only, and each PDF says so on its face.

3. Your payment identity

This is where most "anonymous" services leak. A card payment carries the cardholder's name and billing address. PayPal carries an email and the name on the account. Even providers that take crypto often run it through a third-party payment company that performs its own identity checks and keeps its own records.

GhostConnect takes crypto or a card on Stripe's page. Crypto goes through a self-hosted payment processor, not a payment company; what we keep is the processor's invoice id and which coin was used. Monero hides sender, receiver and amount on the chain itself. Cards are paid on Stripe's own page: Stripe sees the card and may ask for an email for its receipt, and we receive a session reference and whether it was paid, never the card number or email. Of the coins offered, Monero leaves the least behind.

4. Your IP address at sign-up

Registration forms record the address they were submitted from. It is used for fraud scoring, for rate limiting, and later, for answering the question "where was this account created from". Many providers also store the address of every sign-in afterwards.

GhostConnect stores no sign-up address and no sign-in address. The only IP addresses of yours that ever reach the database are the ones you choose to add to a proxy's allowlist, and only because you add them. Every product works with a username and password; datacenter, residential and rotating proxies can also allowlist source addresses, and ISP proxies authenticate by password only.

5. Access logs

Web servers log by default: every request, with the client address, the time, the path and the user agent. Providers keep these for debugging and for traffic graphs, and rarely think of them as customer data. They are. A year of access logs is a complete record of when each person used the site and from where.

GhostConnect's web server is configured not to write an access log at all. Abuse protection still needs to count attempts per connection, so the site does that without keeping the address: each counter is named with a keyed hash that changes every day, lives in temporary files rather than the database, and is deleted within hours. The counter can slow a guesser down; it cannot be read back into an address.

For the proxy network itself, the privacy page commits to two records per request: the destination and the response status code, used to measure success rates so bad exits can be replaced. It states that the address you connect from is never logged, in any form, at any point in the chain.

6. Where your API calls come from

API dashboards commonly show a "last used" time and address next to each key. It is a convenience feature, and it is also a log of which machines run your scripts, kept for as long as the key exists.

GhostConnect's API keys have no last-used column. What is stored for each key is a SHA-256 hash, its first eight characters so you can tell keys apart, the label you gave it and the date it was made. Nothing records when a key is used or from where. The only API-specific record in the database is the Idempotency-Key replay: when a purchase carries one, the key and the response are kept for 24 hours so a retry cannot buy twice, then deleted. Details are in the API reference.

7. Support attachments

Support systems invite screenshots. Screenshots carry taskbars, file names, usernames, other tabs and sometimes a face. Providers keep them with the ticket, often indefinitely, and the ticketing software is usually a third party with its own retention policy.

GhostConnect support is text only. Nothing can be attached, so nothing can leak by attachment. Conversations are deleted 72 hours after our last reply if you do not answer, and support runs on this site, not on someone else's helpdesk.

What is stored

None of this means nothing is kept. A proxy shop has to remember what you bought. The privacy page is a literal inventory of the database; this is the short version.

• A hash of your access key, an account number, the date it was created and your balance.
• Invoices: what was bought, the amount, how it was paid, status and time, with a payment reference (the processor's invoice id and the coin used, or the card session id).
• Your proxies: type, country, expiry, bandwidth, the credentials to use them, and any source IP addresses you allowlist yourself.
• One session cookie once you sign in. Reading public pages sets no cookie at all.
• An optional stay-signed-in token. Tick the box at sign-in and a second cookie keeps that device signed in for 30 days. Only a hash of the token is stored. It is deleted when you sign out on that device, when the account is deleted, and on every device at once when you replace your key.
• Support messages you send and our replies, and notifications about orders and expiry.

Deleting the account in Settings removes all of it at once. Whoever asks, the most GhostConnect could ever provide is that list, and it contains no way to tell who holds the account.

If that is the kind of account you want, get a key. It takes one page and asks nothing about you.