Privacy policy

In force from 11 November 2026. Last updated 11 November 2026.

Version 2026-11-11.4.

Who we are

Oxytronix BV, Mosstraat 38/a, 3545 Halen, Belgium. Company number (KBO) 0505.724.445, VAT BE0505.724.445. For privacy questions mail privacy@rescueshell.com.

What we store

• Account: your email address, a hash of your password, your teams and roles, your last login, failed login count, and which terms version you accepted and when. Which site link you signed up from, if any, also kept on the team you created. Each sign-in session, the team it is for, and when it started and ended. The export and deletion requests you make, with their dates and status.
• Your team sees you: members of a team see each other's email address and role. Admins and owners also see who opened which shell.
• Two-factor login: if you turn it on, an encrypted secret and hashes of your recovery codes. For each passkey you add: its public key, id and connection types, its label, a use counter, and when it was added and last used.
• Invitations: the email address you invite and the role you offer.
• Devices: the name you give each device, its serial number and MAC addresses if you provision by API, its agent version, connection status, last seen time and SSH host key fingerprint.
• Sessions: who opened a shell on which device, when it opened and closed, and how many bytes moved. Not what was typed or shown.
• Keys: public SSH keys you register, their labels and fingerprints. For SSH keys you save in the browser: the label, public key, fingerprint, and the private key sealed with a passkey in your browser, so we cannot open it.
• Audit events: key and session actions in your team, with who did them.
• Billing: a Stripe customer id, subscription status and invoice summaries. Card, billing address and tax details stay with Stripe and Link. When a trial starts, a hash of the owner's email address and of the card's Stripe fingerprint, so each inbox and card gets one trial.
• Mail: copies of the mails we send you, and mail you send to our support and privacy addresses. Addresses that bounce or mark us as spam go on a block list.
• Feedback: what you send from the account page, with an optional screenshot, your account and team. We mail you when it ships, if your address is verified. To work on it we may copy its words, without the screenshot, your account or team, into our own notes. Those copies stay as the record of the work, also after you delete your account.
• Logs: server logs, including IP addresses, to run and secure the service. Rate limits store hashed IPs and addresses, for up to a day. Your account keeps a keyed hash of each IP you signed in from, at most 20, each for 30 days, so password guesses from elsewhere cannot lock you out.
• Signup checks: a hash of your IP address and its network, expiring after 15 minutes, to limit signups. The signup page also solves a short puzzle in your browser. No cookie, no third party.

Why

• To give you the service you signed up for (GDPR article 6(1)(b), contract).
• To keep it secure and stop abuse (article 6(1)(f), legitimate interest).
• To bill you and keep the records tax law asks for (article 6(1)(c), legal obligation).
• To answer mail you send to our support and privacy addresses (article 6(1)(f), legitimate interest).
• To fix bugs and improve the service from error reports and the feedback you send (article 6(1)(f), legitimate interest).

We are the controller for your account and billing data. Link, which sells you the subscription, is the controller for the payment and tax details it collects. For data about your team's devices and sessions we act for your team, as its processor. See the terms.

What we do not do

• No tracking cookies and no analytics scripts on this site.
• One small script copies a valid ?ref= label from the address you arrived on onto this site's links and the signup link. It stores nothing in your browser and sends nothing itself.
• The web app sets three cookies, all for login, on app.rescueshell.com only.
• It also sets one strictly functional cookie, rs_signed_in=1, on .rescueshell.com. It holds no identifier, token or email, only the digit 1. It is set when you sign in and cleared when you sign out or delete your account, and this site reads it only to show a Dashboard button instead of Log in and Start trial. It is not used to track you, so there is no cookie banner.
• We do not record shell sessions.
• We do not sell data.

Where it lives

Your account, device and session data: in the EU. See EU residency. Mail you send to our support and privacy addresses is also read by Anthropic, which stores it in the US, as below.

How long

• Session records and audit events: 90 days.
• Server logs, sent mail and payment events: 30 days.
• Mail you send to our support and privacy addresses: 12 months after it arrives.
• Feedback: screenshots 90 days, the rest 12 months.
• Sign-in sessions: 30 days after you sign out or they are revoked.
• Export and deletion requests: 3 years after they are answered, cancelled or expire, also after you delete your account, as the record of what you asked and how we answered.
• Traffic usage counts: 13 months. Invoice summaries: until the team is deleted.
• Accounts never verified: 7 days. Used or expired invitations: 30 days.
• Trial email and card hashes: kept, also after deletion.
• A deleted account is removed at once, except as below. Backups age out within 30 days.

Details: data retention.

Deleting your account

Your account goes at once, with every team where you are the only member and their devices. Teams with other members stay, so if you own one, hand it over first. A bare internal id, not your name or email, stays behind: in usage counts for up to 13 months, in your teams' audit events for 90 days, in the record of your export and deletion requests for up to 3 years, and as a marker that the account was deleted. If you had a trial, its email and card hashes stay, so it is not given again. The mail confirming the deletion is kept 30 days. Mail you sent to our support and privacy addresses stays until its 12 months are up.

Who else handles it

• Microsoft (Azure and Microsoft 365), EU: hosting, database, logs, account emails, and our Exchange Online mailbox, which receives mail you send to our support and privacy addresses.
• Microsoft Azure Static Web Apps: delivers this site, docs and status page from servers worldwide. It sees visitors' IP addresses.
• Stripe and Link, Stripe's reseller service: payments. Link sells you the subscription as merchant of record. It collects your card, billing address and tax details, adds the tax, and sends receipts, invoices and trial emails, as its own controller. Also outside the EU under the EU Standard Contractual Clauses. Stripe and Link keep payment records under their own terms, also after you delete your account.
• Sentry, EU (Frankfurt): error reports, to fix bugs.
• Anthropic: its AI reads mail you send to our support and privacy addresses, to help us sort and answer it. Anthropic stores it in the US and may process it in other countries, under its data processing terms with the EU Standard Contractual Clauses. It keeps what it processed under its own terms.

Your rights

You can see, fix, export or delete your data. Delete your account at once from the account page, or from the privacy page 7 days after you confirm by mail. Download your data as a file from the privacy page. For anything else, mail privacy@rescueshell.com. We answer within one month. You can also complain to your data protection authority.