Privacy policy

Last updated · October 11, 2026

What stays on your device

• All captured traffic metadata, per-app history, and statistics (local SQLite database).
• Firewall rules, whitelists, detection rules, category lists, and parental-control settings.
• Alerts, incidents, and everything you see in the app's dashboards.

What the licensing service receives

• Your license key, email, and name (to issue and validate keys you request). If you sign in to the app, the email and password are sent to our server over HTTPS; the password is stored only as a salted hash.
• A one-way device hash — a salted fingerprint used to run the 7-day trial and count seats. It cannot be reversed into hardware identifiers.
• App version, Windows version, the PC's name (hostname), and coarse country, for your own account's device list.
• Which paid features are switched on (for example “blocking” or “parental controls”) — the names of the features, never what you did with them. We use this to notice a copy that has been tampered with to unlock features its license does not include.
• Your IP address, in three cases only: when a new install first contacts us (the start of its trial); when the app downloads lists from our server — at most once a day for each network you are on; and on a device we have flagged for key sharing or tampering. The routine daily check keeps only a salted hash of it that changes every day. Why we keep the address at all, and for how long, is explained under Security records.

The app sends this when it starts and once a day after that. It is sent during the trial too: the device hash is what makes the trial work without an account.

Other connections the app makes

• Blocklists and GeoIP tables. The threat lists, content-category lists, and the tables that map an address to a country are downloaded from our own servers (netsecwall.com), identified by the device hash above. They are matched against your traffic on your PC; no address, domain, or program name is sent anywhere to be looked up. If our server does not have a list, the app fetches that list from its public source instead (for example GitHub, abuse.ch, or Spamhaus), which then sees your IP address as any download would.
• The “verify this PC” check. Before it serves lists or accepts a sign-in from the app, our server may ask you to confirm in a browser that a person is using the PC. That page uses Cloudflare Turnstile, which processes your IP address and browser details to tell people from bots.
• Updates. The app asks our server whether a newer version exists and downloads it from us.
• Only if you turn them on: file-hash lookups at VirusTotal with an API key you supply (the hash of a program file is sent, never the file); domain-age lookups at a public RDAP service (the domain name is sent); and alerts to your phone through ntfy.sh or a webhook address you enter (the alert text is sent). Each is off until you enable it in Settings.

Telemetry — off unless you turn it on

• Anonymous usage analytics are strictly opt-in. You are asked once, during the 7-day trial, and you can change your answer at any time under Help ▸ Privacy & telemetry. Left alone, telemetry stays off.
• When enabled: coarse events (app launched, feature used), OS version, app version, locale. Never traffic contents, hostnames you visit, or file paths.
• Events are allow-listed server-side; anything else is dropped. Retained at most 425 days, then purged automatically.

Saying no costs nothing. Declining telemetry, or switching it off later, is unconditional: it does not shorten your trial, lock a feature, change a price, or affect a license you own. The app is identical either way. If you decline during the trial, we do take that moment to show you what a license costs. That is an offer, not a condition, and dismissing it leaves your answer exactly as you set it. We do not operate “consent or pay”: there is no version of NetSecWall you have to buy in order to refuse analytics, and no discount for accepting them.

Enterprise / on-prem deployments

With the self-hosted NetSecWall Management Server, agents report to your organization's own server — events, versions, and compliance state never reach us. The server contacts our licensing API exactly once, at activation, to validate your Enterprise key. After that it runs fully offline.

Payments

Card and wallet purchases are sold and processed by Polar Software, Inc., our Merchant of Record.Polar Software, Inc. collects the payment details, runs fraud checks, charges the applicable tax, and issues your invoice. We never see or store your card number — it does not pass through our servers.

Where we offer cryptocurrency, the payment is handled by that processor and we are the seller of record. We receive the order reference, the plan, the amount, and the email you gave us — the same fields as any other order. We do not receive or store your wallet address unless you send us one yourself to receive a refund, and we keep that only as long as the refund takes. A blockchain payment is public by nature: the transaction itself is visible on-chain to anyone, which is a property of the network and not something either of us controls.

What we receive back from Polar Software, Inc. is limited to what's needed to issue and support your license: an order reference, the plan bought, the amount and currency, your email address, and the country used for tax. Their own handling of your data is described in their privacy notice.

Order records are kept for as long as tax and accounting law requires (typically 7 years), then deleted. This retention overrides an erasure request for the invoice itself, because it is a legal obligation we cannot waive. Everything else tied to you is still erased on request.

Security records — protecting the service from abuse

A free trial, a download and a checkout are the three things people try to abuse: endless trial resets, a licence key or device id passed around far beyond what it was bought for, scripted downloads, and stolen cards tested against our checkout. To spot that, we keep a short record of these moments. It exists for that purpose only.

When a record is made

• When you download the installer from this website.
• When a new install of the app first contacts our server — the moment its trial starts.
• When you start a checkout.
• When the app downloads blocklists or GeoIP tables from our server — at most once a day for each network it is on — and whenever such a request is refused (for example, a device id we never issued).

What it contains

• Your IP address and the user-agent string your browser or the app sends (which names the browser or app and its version), plus your browser's language and the page that linked to the download, if it sent them.
• For a checkout, the email address and order reference — the same ones the order already holds.
• For the app, the device hash and licence it belongs to, its version and the PC's name — the same details listed under What the licensing service receives above.

Who sees your address. We send the IP address — the address alone, nothing else about you — toipapi.is, which acts as our processor and tells us about the network it belongs to: the internet provider, whether it is a home line, a mobile network, a datacenter, a VPN, a proxy or Tor, and roughly which city it is in. Only our own administrators read the result.

What it is not used for. Not for marketing, advertising, profiling, or following you around the web, and it is never sold or shared beyond ipapi.is. Using a VPN or a work network is not against our rules: it is one signal among several, nothing is blocked automatically because of it, and a person looks at the whole picture before acting on anything.

How long. Every record is deleted automatically within 90 days, and what ipapi.is told us about an address is deleted with it. Our legal basis is our legitimate interest in preventing fraud and keeping the service secure. You can ask for a copy of what we hold about you, or object to it, with aprivacy request.

Free tools on this website

The tools at netsecwall.com/tools (the netstat explainer, the IP reputation check and the full report on your own address) ask for an email address once. It unlocks all of them in that browser. The Windows port pages and the address shown on What is my IP? need nothing.

What we keep: your email address; whether you asked for news; which tool you used first and how many times you have used each; the page that linked you to the tool and any campaign tags in its address (utm_…); and a one-way, daily-rotating hash of your IP address. Not what you checked.

News only if you ask. The box asking for NetSecWall news and offers is unticked. We email an address only if its owner ticked it, and you can switch it off at any time from the bar at the top of any tool page. Without it, we use your address only to count who uses the tools, and delete it 12 months after you last used one.

What the tools send. The netstat explainer reads what you paste in your browser; nothing is uploaded. If you press Check against threat lists, the public IP addresses from it, and nothing else, are sent to our server and compared with the lists. The IP reputation check and the report on your own address do the same for one address, and also ask ipapi.isabout it, as described under Security records. We keep ipapi.is's answer for up to 90 days so the same address is not looked up twice. The checked addresses are not linked to your email.

Our legal basis is your consent for news, and our legitimate interest in running and measuring the free tools for the rest. To have your address deleted, make a privacy request; deleting it also locks the tools in every browser it unlocked.

Cookies and this website

This section is about netsecwall.com, the website. It is not about the NetSecWall application on your PC, which is covered above and which contains none of this.

• We set no advertising cookies, run no ad network, and sell no data. That has not changed.
• Your light/dark theme choice is kept in localStorage on your own browser. Nothing is sent to us.
• Web fonts are loaded from Google Fonts, which receives your IP address as part of serving the request.
• The checkout page loads the payment provider's secure fields; the provider may set cookies strictly necessary to process your payment and prevent fraud.
• Standard web server logs (IP, user agent, path, timestamp) are kept briefly by our host for security and troubleshooting.

Microsoft Clarity — how we see where this website is broken

We use Microsoft Clarity on this website to understand how it is actually used: which pages confuse people, where a form is failing, and which step of a purchase people give up on. It records how a page is used — mouse movement, scrolling, clicks, and which elements were on screen — and reconstructs it as a replay, plus aggregate heatmaps. Microsoft is our processor for this, and Clarity is governed by theMicrosoft privacy statement.

What is masked and never leaves your browser:

• Everything you type. Every input, textarea and password field is masked before anything is sent — including your email address, your password, your support message and anything you paste.
• Your licence key, everywhere it appears: on your account page, in the licence picker, and on the screen shown after a purchase.
• Cryptocurrency payment addresses on the checkout page.
• Your support tickets — subjects, message bodies and replies, on the ticket pages.
• The names of your devices, on your account page.

What it does receive: the pages you visit on this site and how you moved around them, your browser, operating system, screen size, coarse location derived from your IP address, the site that referred you, and labels we attach ourselves — such as which plan you were looking at, whether you are signed in, and whether a step of the checkout failed. If you are signed in, we send your email address to Clarity's Identify API, which hashes it in your browser before it is transmitted; Microsoft stores the hash, not the address. It lets our support team find your session when you write to us about something that went wrong.

Cookies, and your choice. Until you accept, Clarity runs on this site without setting any cookie — it cannot recognise you between pages, and each page view is a separate anonymous record. If you accept, it sets _clck and _clsk (first-party, to join the pages of one visit) and Microsoft may set CLID, MUID, MR, SM and ANONCHK on its own domains. We tell Microsoft that advertising storage is denied for every visitor without exception, whatever you answer, because this site does not advertise and we have no use for it.

Change your mind at any time with Cookie settings at the foot of any page. Withdrawing deletes the Clarity cookies from your browser and puts it back into the cookieless mode above. Blockingclarity.ms in your own browser, extension or DNS filter also works, and nothing on this site breaks if you do — a fair test of a company that sells a tool for blocking things.

Session recordings are available to us for 30 days; heatmaps for up to 9 months. Clarity has no facility to delete one individual's data on request, so if you ask us to erase your data we cannot pick your sessions out of it — what we can do instead is confirm nothing identifying you was ever collected, and, if you ask, stop collecting it for you going forward. Everything else in therights section below applies as normal.

Legal bases and sharing

• Contract — issuing, validating, and supporting a license you bought or requested.
• Consent — optional in-app telemetry, freely given, never a condition of using or buying the software, and withdrawable at any time with one toggle. Separately, website analytics cookies: declined by default, and withdrawable from any page. And news emails to an address given for the free tools, only when its owner ticked the box.
• Legitimate interests — preventing license abuse and fraud, keeping the service secure (including the security records, deleted within 90 days), and running and measuring the free tools.
• Legal obligation — keeping invoices and tax records.

We share data only with the processors that make the service work: our payment provider, our email delivery provider, our hosting provider, ipapi.is for the network lookups described underSecurity records, and — for the website only — Microsoft, as described underCookies and this website. We do not sell or share personal information for advertising, under any definition, including the CCPA/CPRA meaning of “sell” and “share.”

Your rights (GDPR · CCPA/CPRA · APPI · PDPA)

• Access & export — request a machine-readable copy of everything tied to your install or email.
• Correct — fix the name or email on your license.
• Delete — request erasure of your telemetry, devices, and account data.
• Opt out — stop all telemetry with one toggle; licensing checks carry only the minimum above.
• Complain — you may lodge a complaint with your local data-protection authority. We'd rather you told us first.

The first four are available in-app under Help ▸ Privacy & telemetry, or by email — make a privacy request. We answer within 30 days and never charge for one.

Children

NetSecWall is sold to adults. The parental-control features are configured by a parent or guardian on a family device; we do not knowingly collect personal information from children. If you believe a child's data reached us, make a privacy request and we will delete it.

What we never do

• Sell, rent, or share your data with advertisers or data brokers.
• Upload your browsing or traffic history — the product's entire design keeps it local.
• Ask for an account, an email, or a card to run the 7-day trial.
• Send a domain, address, or program name off your PC to check it against a list. (The website's free tools check an address on our server only when you press the button that does it.)
• Make analytics the price of anything — see the telemetry note above. Declining website cookies changes nothing about what you can read, buy or download here.
• Record what you type. Website session replay masks every input before it is sent, and the 7-day trial, your licence key and your traffic are never part of it.

Questions? make a privacy request

Questions about this page? contact us