Privacy Policy

Template, not legal advice. This page was written from a template and hasn't been reviewed by a lawyer yet.

Last updated: October 23, 2026. Operator: @oliverexists on Discord. Contact: @oliverexists on Discord, or the report form on the abuse page.

Sinister Proxy is a web proxy: when you open a website through it, our server fetches the site and passes it back to your browser. This page explains what we record, who can see it, and how long we keep it. In short: we can see who you are (your key and Discord account), your IP address, and which websites and pages you load. Sinister Proxy is not a VPN and does not make you anonymous.

What we store

When you ask for a key. If you run /request in our Discord server, we store your Discord user ID, username, display name, the region group you pick, your optional note, and when you asked. The request is shown on our admin page and posted in a private Discord channel that the operator and moderators can see. If the operator makes a key for you directly, we store only the name they give it.

Your key. We never store your key itself, only a one-way hash of it. The key is sent to you by Discord DM (removed from the message after 30 minutes) or, if your DMs are closed, in a reply only you can see.

While you use the proxy, for each key:

Usage totals: number of requests, data transferred, when you were last active, and your most recent IP address.
An access log: for each request, the time, your key's ID and name, your IP address, the website and page path (for example https://example.com/some/page), the request method, the response status, and the request type (page, image, script, WebSocket, and so on).

The access log covers everything your browser loads through the proxy, including images, scripts, ads and trackers a page pulls in, not just pages you open yourself. Page paths can reveal what you were reading.

The access log never contains the part of a web address after ? (which often holds search terms), the part after #, usernames or passwords in addresses, your key, the content of pages or forms, or cookies.

Network information. To enforce rate limits, sign-in lockouts and bans, the server counts requests and failed sign-ins per IP address (per /64 network for IPv6) in memory. Every 10 minutes the server log records the 10 networks that used the most data, with request counts and bandwidth, plus any addresses that were rate-limited, locked out or banned. The server log also records events such as keys being created or turned off (by record ID) and errors, which can include a Discord user ID when a Discord action fails. It does not record the websites you visit.

Abuse reports. If you send a report with the form on the abuse page, what you type (what happened, the website, when, and how to reach you, if you give it) and your IP address are posted to a private Discord channel that only the operator can see. The server doesn't keep a copy; it only counts reports per network for an hour, in memory, to stop spam.

What passes through but isn't stored

To make websites work, the proxy forwards everything you send and receive, including page content, forms, passwords you type into websites, and uploads. We don't store or log this, but it passes through our server in readable form. Don't use Sinister Proxy for accounts or information you care about.

Cookies that websites set are kept on our server, in memory only, linked to your browser by a random session ID, so sites keep working as you browse. They are deleted after 30 minutes of inactivity or when the server restarts.

Cookies and browser storage

The dashboard has no analytics, ads or third-party trackers. Its fonts and files come from our own server.

Name	Where	Purpose	How long
`__Host-sinister_key`	Dashboard cookie	Your key, signed by the server, to keep you signed in	1 year, or until you sign out
`__Host-sinister_pass`	Proxied sites cookie	Signed pass showing your key is active	30 days, or until you sign out
`__Host-sinister_session`	Proxied sites cookie	Random ID linking to website cookies on our server	Until you close your browser
`sinister-bookmarks`, `sinister-settings`	Dashboard local storage	Your bookmarks, shortcuts, theme and settings	Until you clear them; never sent to us
`__sinister_toolbar`	Proxied sites session storage	Whether you hid the toolbar	Until you close the tab

Your browser may also cache images, scripts and stylesheets from proxied sites for up to a day.

How we use it

To approve and manage access, keep the service running and fix problems, and prevent and investigate abuse (rate limits, bans, turning off keys, and handling reports under our abuse policy). We don't sell it or use it for advertising.

Who can see it

The operator, through a password-protected admin page that shows each key's details, usage totals and recent access log entries.
Moderators who can see the private Discord approvals channel see requests (name, Discord account, region and note) and their outcomes.
Service providers that store or process data for us: BuyVM (FranTech Solutions), which hosts our server, and Discord. Each handles data under its own privacy policy. An uptime monitor, if we use one, only sees our health check page.
Websites you visit see our server's IP address, not yours. They still receive what you send them and normal browser details such as your user agent and language, and their own scripts and trackers still run in your browser.
Authorities, only when the law requires it, and only what we actually hold.

How long we keep it

Access log: at most 7 days, and only the 2,000 most recent entries across everyone, so entries can disappear sooner. Expired entries are deleted automatically, normally within an hour.
Key records and usage totals: until the operator deletes them. Records of declined or turned-off people, including their Discord ID, are kept so that bans and the 24-hour wait before asking again work. Unanswered requests may be removed after 14 days.
Deleting a key removes its record and usage totals right away. Access log entries already written expire on the normal 7-day schedule.
Website cookies on our server: 30 minutes after you stop using the proxy, or sooner if the server restarts.
Rate-limit and lockout counters: in memory only, for up to about half an hour.
Server logs: rotated automatically; at most about 30 MB per service is kept, so older lines are deleted as new ones arrive. Our web server does not keep a log of the pages people request.
Backups: encrypted copies of the key records (including the access log at the time) are kept on our server for 14 days.
Discord messages: request posts in the approvals channel and abuse reports stay until someone deletes them; key DMs stay in your DMs, with the key removed after 30 minutes, until you delete them.

Security

Keys are stored only as hashes, the admin page is password-protected, and the dashboard runs on a separate address from proxied sites, so websites can't read your key, bookmarks or settings. All proxied websites share one address, though, so a malicious site you open could read data from other sites you opened through the proxy. No online service is perfectly secure.

Your choices

Sign out on the dashboard to remove your key and pass from that browser.
Replace a lost or leaked key with /key in Discord. The old key, and every browser signed in with it, stops working.
Clear bookmarks and settings by clearing this site's data in your browser (export them first under Settings › Data if you want to keep them).
Ask for a copy or deletion of your data by messaging @oliverexists on Discord. Deleting your record also ends your access.

Age

You must be at least 13 to use Sinister Proxy, or older if your country's law or Discord requires it.

Changes

If our practices change, we'll update this page and the date at the top.

Terms · Privacy · Abuse