Privacy Policy
Last Updated: February 12, 2026
1. Introduction
Private Hub ("we," "our," or "us") provides a Chrome extension that routes your browser traffic through the Tor network for private browsing. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.
Our commitment: We build privacy tools. We collect only what's necessary to provide our service and never track your browsing activity. You can verify this by visiting your transparency dashboard, where every piece of data we store about you is visible.
2. Information we collect
2.1 Recovery hash account (no personal information)
You can create an account using only a recovery key -- a randomly generated 16-character code. We store a one-way cryptographic hash (HMAC-SHA256) of this key. We cannot reverse this hash to recover your key.
What we store:
- The HMAC-SHA256 hash of your recovery key (irreversible)
- Your account settings and usage data (see below)
What we don't store: Your recovery key itself. If you lose it, we cannot recover it. This is by design.
2.2 Email account (email + optional password)
You can optionally create an account with your email address.
What we store:
- Your email address (for login and account recovery)
- An optional password hash (bcrypt, irreversible)
- Your account settings and usage data (see below)
What we don't store: Your password in readable form. We never access your email inbox.
2.3 Authentication
We use OTP (one-time password) codes sent to your email for verification and login. OTP codes are short-lived and automatically deleted after use or expiration. Authentication sessions use JWT (JSON Web Tokens) stored in memory only -- not in cookies or persistent storage on our servers.
2.4 Usage data
| Data | What we collect | Why | Retention |
|---|---|---|---|
| Session records | Start time, end time, seconds consumed, status | Quota tracking, service reliability | Indefinite (part of account) |
| Quota state | Daily allowance, used today, bank balance, reset time | Enforce usage limits | Indefinite (account-level) |
| Payment records | Amount, tier, date | Financial records, support | Indefinite |
2.5 Payment information
Processor: Stripe (third-party payment processor)
What Stripe collects: Credit card information, billing address, transaction history.
What we receive from Stripe:
- Customer ID (reference number)
- Payment status (successful, failed, refunded)
- Subscription status (for annual plans)
- Transaction amount and currency
Your protection: We never see or store your credit card details. Stripe is PCI DSS Level 1 certified. Your bank statement shows "MUSUBI DIGITAL".
3. Information we don't collect
This is critical. We do not collect, store, or have access to:
- Your browsing history
- URLs you visit
- Your real IP address (after session setup)
- DNS queries
- Traffic content
- Device hardware information or fingerprints
- Search queries
- File downloads
- Tracking cookies
You can verify this. Log in to your transparency dashboard and see every piece of data we store. If it's not listed there, we don't have it.
4. How we use your information
Core service
- Authenticate your account (hash lookup or email verification)
- Track and enforce quota limits
- Start and end Tor proxy sessions
Account management
- Send OTP codes for login and verification (email accounts only)
- Process account recovery
- Manage tier upgrades
Payment processing
- Process purchases through Stripe
- Apply quota to your account
- Handle refunds and cancellations
5. Data storage and retention
Account data is stored indefinitely until you delete your account. Session records and payment records are retained as part of your account for service continuity and financial record-keeping.
Anonymous session data (for users without an account) is stored only in your browser's local storage and expires automatically. No server-side record is created for anonymous sessions.
6. Your transparency dashboard
We provide a transparency dashboard at privatehub.app/myaccount where you can see every piece of data stored about you in our database. This includes:
- Your account identity (type, UUID, email if set, creation date)
- Your quota state (tier, daily allowance, used today, bank balance)
- Your billing information (Stripe customer ID, subscription status)
- Your complete session history (start, end, duration)
- Your complete payment history (amount, tier, date)
- Your account settings (timezone, performance mode)
The dashboard also shows a "What we don't have" section -- an explicit list of data categories we do not collect.
You can export all data as JSON and delete your account entirely from the dashboard.
7. Your rights
Access your data
View all data we store via your transparency dashboard, or request a copy by emailing privacy@privatehub.app.
Delete your data
Delete your account and all associated data from your dashboard, or request deletion by emailing privacy@privatehub.app.
Export your data
Download your account data in JSON format from your dashboard.
European Union (GDPR)
If you're in the EU, you have additional rights:
- Right to be forgotten: Request complete data deletion
- Data portability: Export your data in machine-readable format
- Restrict processing: Limit how we use your data
- Object to processing: Stop specific data processing activities
California (CCPA)
If you're in California:
- Know: What personal information we collect and how it's used
- Delete: Request deletion of your personal information
- Opt-out: Opt out of data "sales" (we don't sell data)
8. Cookies and tracking
The Private Hub website uses no cookies on authentication or account pages.
Marketing pages (landing, pricing) may use a simple, first-party page view counter for traffic estimation. No third-party analytics, no tracking pixels, no advertising cookies.
The extension stores minimal operational data in Chrome's local storage:
- Connection state
- Account session token (JWT, cleared on logout)
- Anonymous session quota (if no account)
No cross-site tracking: We don't track you across websites.
9. Third-party services
| Service | What for | Data shared |
|---|---|---|
| Stripe | Payment processing | Card details (we never see them), customer ID |
| Cloudflare | Website hosting + CDN | IP address (standard web request) |
| Resend | Transactional email (OTP codes, verification) | Email address (only for email accounts) |
| Tor network | Traffic routing | Encrypted traffic (no one node sees full path) |
No PostHog, no Google Analytics, no Facebook Pixel, no Intercom, no Sentry on this website. Zero third-party scripts on authentication and account pages.
10. Children's privacy
Private Hub is not intended for users under 13 years of age. We do not knowingly collect data from children.
11. Changes to this policy
We may update this Privacy Policy to reflect changes in our service or legal requirements.
- Major changes: Email notice to accounts with email + 30-day notice
- Minor changes: Updated "Last Updated" date
12. Contact
Privacy questions: privacy@privatehub.app
Security issues: security@privatehub.app
General support: support@privatehub.app
Your business is your business. We're just here to keep it private.