Privacy

Who runs ingressd#

ingressd (ingressd.com, ingressd.net and the panel at app.ingressd.com) is operated from the United Kingdom. For anything about your data, email privacy@ingressd.com. This notice is written for UK GDPR and the EU GDPR.

What the panel stores#

• Your account: your email address, display name, passkeys you register and your sign-in sessions.
• Your organisation's configuration: nodes, PoPs, homes, apps, access policies and Smart DNS settings. Secrets you enter are encrypted in your browser to the target node's key; the panel stores only the ciphertext and cannot read them.
• What your nodes report: connection state, health, tunnel handshakes, certificate state, and usage counters (requests and bytes per app, home and node, in hourly buckets).
• Certificates your nodes obtain, encrypted at rest so every node of your organisation can serve them.
• Access-policy sign-ins: when a visitor signs in to one of your protected apps, the panel processes the email address they enter, the address they connect from and the app they asked for, so it can send them a one-time code. It stores a hash of the code until it expires (10 minutes) and a count of recent requests for rate limiting.

What the panel does not store#

• The traffic to your apps. It flows from visitors to your nodes and through your tunnels to your home, never through the panel.
• Access logs. The live log preview relays entries from your nodes while you watch; they are not kept.

Why it is processed#

• To provide the service you signed up for: your account, configuration, node reports and sign-in codes (contract).
• To keep the service secure and prevent abuse: rate limits, sign-in records and audit entries (legitimate interests).
• For visitors to your protected apps, you, as the operator of that app, decide who may sign in; ingressd sends the codes on your behalf as your processor.

Who it is shared with#

• Amazon Web Services (Amazon SES) sends sign-in emails. It receives the recipient address and the message.
• Your hosting provider runs your nodes; the panel sends your nodes their configuration.
• Cloudflare serves this website.
• Nobody else. ingressd does not sell data and uses no advertising or tracking.

These providers may process data outside the UK under their standard contractual safeguards.

How long it is kept#

• Account and configuration: while your account exists, then deleted within 30 days of closing it.
• Usage counters: 13 months.
• Sign-in codes: until they expire (10 minutes); rate-limit counters for 24 hours.
• Audit entries: 12 months.

Your rights#

You can ask for a copy of your data, correct it, delete it, restrict or object to its processing, or take it with you (the panel exports your configuration). Email privacy@ingressd.com. You can also complain to the Information Commissioner's Office at ico.org.uk.

This website#

ingressd.com sets no cookies and has no analytics. It stores your light or dark theme choice in your browser's local storage; nothing is sent anywhere when you change it.

Changes#

Material changes are announced in the panel before they take effect.