Privacy Policy

Last updated: March 29, 2026

This Privacy Policy describes how Ersoydan.net ("we", "us", "our"), operating as LogHQ collects, uses, and protects your information when you use our security monitoring service at loghq.net ("Service").

1. Information We Collect

1.1 Account Information

When you register, we collect:

• Email address
• Display name
• Password (stored as a bcrypt hash — we never store plaintext passwords)

1.2 Threat Data (from your servers)

The LogHQ agent installed on your server collects and sends:

Data	Source	Purpose
IP addresses	Nginx access log	Identify attackers
HTTP request paths	Nginx access log	Classify attack type
HTTP status codes	Nginx access log	Determine if attack was blocked or succeeded
User-agent strings	Nginx access log	Identify scanning tools
Timestamps	Nginx access log	Timeline analysis
Server hostname	System hostname	Server identification
Server IP address	Network connection	Agent authentication

1.3 What We Do NOT Collect

• Your website content, pages, or static files
• Visitor personal data (names, emails, payment info) from your application
• HTTP POST request bodies (login passwords, form data, checkout details)
• Cookies, session tokens, or authentication credentials of your visitors
• Database contents or application configuration files
• Legitimate (non-threat) traffic from your access logs

2. How We Use Your Data

• Threat detection: Classify and display security threats on your dashboard
• Alerts: Evaluate alert rules and send notifications when thresholds are breached
• Reports: Generate downloadable security reports
• Geo-IP enrichment: Resolve attacker IP addresses to country of origin using ip-api.com
• Account management: Authenticate sessions, enforce plan limits, manage billing

3. Data Storage and Security

• All data is stored on servers located in the United States
• Data in transit is encrypted via TLS 1.3 (HTTPS)
• Passwords are hashed with bcrypt
• JWT tokens are signed with a server-side secret key
• Database access is restricted to the application — no shared hosting
• Agent files are served read-only with SHA-256 integrity verification

4. Data Retention

Plan	Threat Data Retained
Free	7 days
Pro	30 days
Team	60 days

Data older than your plan's retention period is automatically and permanently deleted every 15 minutes. There is no backup or recovery of expired data.

5. Third-Party Services

Service	Data Shared	Purpose
ip-api.com	Attacker IP addresses	Geo-IP country resolution
Paddle.com	Email, billing info	Payment processing
SMTP provider (if configured)	Alert message content	Email alert delivery
Telegram API (if configured)	Alert message content	Telegram alert delivery

We do not sell, rent, or share your data with any other third parties.

6. Your Rights

You have the right to:

• Access your data via the dashboard and API
• Export your threat data via HTML reports
• Delete your account and all associated data
• Correct your profile information (display name, email)
• Withdraw consent by uninstalling the agent and deleting your account

To exercise these rights, contact support@loghq.net or use the dashboard settings.

7. Cookies

We use localStorage (not cookies) to store:

• JWT authentication tokens (access and refresh)
• Theme preference (light/dark)

We do not use tracking cookies, analytics cookies, or any third-party cookie-based tracking.

8. Children's Privacy

The Service is not intended for use by individuals under 16 years of age. We do not knowingly collect data from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or dashboard notification. The "Last updated" date at the top reflects the most recent revision.

10. Contact

For privacy-related questions or requests, contact us at support@loghq.net.