Privacy Policy
Last updated September 28, 2026
PhylaxNet protects home and small-business networks. This policy explains what we collect, why, and the choices you have. In short: we collect what we need to show you your network and alert you — we don't sell data, show ads, or look at the websites you visit.
What we collect
- Your account: email address, optional company name, and a securely hashed password. If you buy a plan, payment is handled by Stripe — we never see or store your card number.
- From the PhylaxNet app (every minute while it runs): the name of the PC it runs on, and for each device on your network its MAC address, local IP address, name, manufacturer, and whether it is online, paused or blocked. Critical security alerts (for example “ARP spoofing detected” or “device contacted a known malware server”), which can include a device name and an internet address involved.
- Website monitoring (if you add sites): the addresses you add and the results of our checks (uptime, certificate, DNS, headers).
- Beta applications: if you apply for the beta, the name, email, business details and answers you give, used only to run the beta and contact you about it.
- Team activity: who in your team changed what and when (the Activity log), and the IP address it came from.
- Error reports (if turned on in the app): the error message and technical details, the app version and Windows version. IP/MAC addresses and your Windows user name are removed before sending. You can turn this off under Settings in the app.
What stays on your PC
Network traffic, the list of websites devices visit, content-filter lookups, speed-test and outage history, WiFi details and port-scan results are processed on your own PC and are not uploaded to us.
How we use it
- To show your dashboard, send the alerts and reports you ask for, and let you control devices remotely.
- To keep the service secure, prevent abuse, and fix bugs.
- To email you about your account (security alerts, receipts, important changes). We don't send marketing without your permission.
Who we share it with
Only service providers that help us run PhylaxNet: our web host, our email provider, and Stripe for payments — and your own integrations (for example a Slack or Teams webhook you add, or report recipients you choose). We don't sell or rent personal information. We may disclose information if the law requires it or to protect people from harm.
Threat-intelligence lists
The app downloads public lists of known-bad servers (abuse.ch, Spamhaus) and blocklists for the content filter. These downloads do not include any information about you or your network.
Checks you start in the app
Some checks have to ask an outside service. They only run when you set them up, they go straight from your PC to that service (not through us), and what you enter for them stays encrypted on your PC:
- Data Leaks: each email address or domain you add is sent to XposedOrNot (xposedornot.com) to look it up in known data breaches, about once a week. When you check a password, only the first 5 characters of its SHA-1 hash are sent to Have I Been Pwned (haveibeenpwned.com); the password itself never leaves your PC. If you add your own Brave Search API key, the names, phone numbers, addresses and usernames you add are sent as search queries to Brave Search under your key.
- Web Activity is off until the account owner turns it on and confirms employees were told in writing. It records the names of websites (for example youtube.com) that devices using the PhylaxNet web filter look up, with the day and roughly how long — never pages, searches, anything typed or passwords. It is stored only on the office PC running PhylaxNet, is never sent to phylaxnet.com, and is deleted automatically after the period the owner chooses (7 to 90 days).
- Email Security: the email-domain check looks up your domain's public DNS records through Cloudflare DNS. The Microsoft 365 and Google Workspace checks happen only after an administrator signs in with Microsoft or Google in their own browser; the app reads the settings it reports on (read-only), and the sign-in is not kept afterwards.
- Attack Watch (DDoS alerts) measures internet response time by connecting to Cloudflare (1.1.1.1) and Google (8.8.8.8). Nothing about your network is sent.
Cookies
The website uses one essential cookie to keep you signed in, and your browser's local storage for preferences such as your sidebar layout. No advertising or tracking cookies.
How long we keep it
Account and device data are kept while your account is open. Alerts and activity logs are kept so you can see history and produce reports; error reports are deleted after 90 days. When you delete your account (Settings → Your data), your data is deleted straight away (copies can remain in our web host's routine backups for a short time until they're overwritten), except where we must keep records (for example payment records) by law.
Your choices and rights
You can view and edit your data in the dashboard, remove devices, turn off email reports and error reporting, and download all your data or delete your account under Settings → Your data. Email support@phylaxnet.com for anything else. Depending on where you live (for example the EU/UK under GDPR or California under the CCPA), you may have further rights, including to access, correct, delete or port your data and to object to processing. We will respond within the time the law requires.
Security
Connections to phylaxnet.com are encrypted, passwords are hashed, repeated failed sign-ins are blocked, two-factor sign-in is available, and the app only accepts commands from your signed-in account. No system is perfectly secure; if we learn of a breach that affects you, we will tell you promptly.
Children
PhylaxNet accounts are for adults. Parents may use it to manage their children's devices; we don't knowingly collect personal information directly from children under 13.
Changes
If we make important changes we'll update the date above and let account holders know by email.
Contact
PhylaxNet — support@phylaxnet.com