Vulpira

Privacy Policy

What we store, why, who else sees it, and how to have it deleted.

Last updated: 26 September 2026

The short version

We never ask for your name, email, phone or documents. We know you by your Telegram account, what you bought and what you paid. Proxy traffic does not pass through us, and we keep no logs of what you do through a proxy.

1. What we store

From Telegram, when you sign in

  • your Telegram user ID, username, first and last name and language code;
  • your profile photo, copied to our server so that pages do not load it from Telegram.

We never see your phone number, your contacts, or any messages other than those you send our bot.

Sessions

  • a hash of your session token — the token itself lives only in your cookie;
  • how the session was started, your IP address and browser user-agent, and when it started and expires.

What you do on Vulpira

  • Proxies: address, port, the login and password issued to you, country, city, ISP, type, price, and when it was bought, expires or was refunded.
  • Balance: every top-up, purchase, refund and adjustment, with the balance after each.
  • Top-up invoices: amount, status, whether you paid through CryptoBot or Heleket, and what the provider reports back — the coin, network, transaction ID and sending address — kept to resolve payment disputes.
  • IP checks: the address you checked, the result, the price and the time.
  • Settings: your language, notification switches and the ad-free subscription.
  • Rules: which version of the rules you accepted, and when.
  • Bot conversations: only what is needed to finish a step you started, such as the top-up amount you are typing.

What we do not collect

  • no passwords — sign-in is done by Telegram;
  • no card details, wallet keys or seed phrases — payment happens on the provider’s side;
  • no logs of your proxy traffic: destinations, content and volume never reach us;
  • no analytics, advertising or tracking scripts on the site.

2. Why we store it

  • To run your account — sign you in, keep you signed in, show your balance.
  • To deliver what you paid for — proxies, IP checks and the ad-free subscription.
  • To handle money correctly — credit top-ups, debit purchases, process refunds, and resolve disputes.
  • To keep the service safe — spot fraud and breaches of the Acceptable Use Policy; your IP address and user-agent are kept for this.
  • To answer support — an order or invoice number has to lead somewhere.

3. Who else sees it

  • Telegram — sign-in and the bot run there, under Telegram’s own privacy policy.
  • CryptoBot and Heleket — the payment provider you choose gets the invoice amount and our invoice number. It does not get your Telegram profile.
  • Our proxy supplier — gets the purchase request needed to issue a proxy. Purchases are made under our account, so it is not told who you are.
  • Our IP risk-scoring provider (currently Scamalytics) — gets only the IP address you asked to check, nothing about you.
  • Our hosting provider — stores the server and database on our behalf.

We do not sell data or share it for advertising, and disclose it to authorities only when a legally binding request leaves us no choice.

4. How long we keep it

  • sessions expire after 30 days, or at once when you log out;
  • sign-in codes live for 10 minutes and work once;
  • proxies stay in My proxies after they expire, as your purchase record;
  • IP checks are kept as your check history for as long as the account exists;
  • orders, transactions and invoices are kept while the account exists, and afterwards only as the anonymised financial record we need for accounting and disputes;
  • database backups are deleted automatically after 14 days.

5. Cookies

Only the cookies the site cannot work without — all HTTP-only and HTTPS-only. There are no analytics or advertising cookies, so there is no cookie banner.

  • gs_session — keeps you signed in. Deleting it logs you out.
  • gs_locale — the interface language you chose.
  • gs_login_… — a one-time secret while you sign in through the bot, so that only the browser that started the sign-in can finish it. It lives up to 10 minutes.

6. Security

The site runs over HTTPS. Session tokens are stored hashed, so a copy of our database does not let anyone into accounts. Proxy credentials are visible only to the account that bought them, and our payment and IP-check keys never leave the server.

7. Your choices

Through support you can ask to see the data on your account, correct it, or delete the account. Deletion removes your profile, sessions, proxy credentials and IP check history from the service at once and from backups within 14 days. The record of top-ups and purchases is kept in anonymised form, because accounting history cannot be rewritten. Your Telegram name and photo refresh from Telegram when you sign in — change them there.

8. Children

Vulpira is for adults. We do not knowingly keep data about anyone under 18.

9. Changes

Updates are published on this page with a new date at the top, and significant ones are announced in the bot.

10. Contact

Questions about your data: @VulpiraSupport on Telegram, or the Support button in the bot.