← Back to home

Privacy Policy

Last updated: March 28, 2026

Introduction

CanaryGuard ("we," "us," or "our") operates the canaryguard.app website and the CanaryGuard canary-token platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

CanaryGuard is a cybersecurity tool that deploys canary tokens -- digital tripwires that alert you when sensitive resources are accessed. Because of this, our service necessarily collects certain network data (such as IP addresses) about individuals who trigger your tokens. This policy covers both your account data and the alert data generated by triggered tokens.

1. Information We Collect

1.1 Account Information

When you create a CanaryGuard account, we collect:

  • Email address
  • Password (securely hashed by our authentication provider -- we never store plaintext passwords)
  • Organization name
  • Team invitation data: invitee email addresses, assigned roles, and invitation status. Pending invitations expire and are purged after 7 days

1.2 Token Metadata

When you create canary tokens, we store:

  • Token type (HTTP, DNS, image pixel, email, DOCX, PDF, or QR code)
  • Token label and description you assign
  • Creation timestamp and associated organization
  • Configuration details (callback URLs, DNS records)

1.3 Alert Data (Triggered Token Events)

When a canary token is triggered, we automatically collect information about the triggering request. This is the core functionality of our product:

  • IP address of the triggering party
  • Approximate geolocation derived from the IP address (city, region, country, coordinates)
  • Internet Service Provider (ISP) and autonomous system number (ASN)
  • User agent string and browser headers
  • Timestamp of the trigger event
  • Referer header (if present)
  • DNS query details (for DNS-type tokens)
Important: Collecting IP addresses and related network data from individuals who trigger canary tokens is the fundamental purpose of this service. This data helps our users detect and respond to unauthorized access to their systems and resources. We process this data on behalf of our users who deploy the tokens.

1.4 Payment Information

CanaryGuard accepts payments exclusively via Bitcoin and Lightning Network through BTCPay Server. We store:

  • Payment transaction IDs and invoice references
  • Credit balance and plan information
  • Payment timestamps

We do not collect or store credit card numbers, bank account details, or other traditional payment information. BTCPay Server is self-hosted and does not share transaction data with third parties.

1.5 Technical Data

We use Plausible Analytics (cookieless, GDPR-compliant, EU-hosted) for privacy-friendly aggregate web analytics — pageviews and aggregate product-usage events (e.g. which token type is most often selected, upgrade-click counts, error rates). Plausible does not use cookies, does not track users across sites, and discards IP addresses after generating a short-lived session hash. No personal identifiers (email, user ID, token name) are ever sent to Plausible.

We capture unhandled frontend errors (error message, stack trace, affected route, user agent) via our own server-log relay at /api/telemetry/error so we can fix bugs. These reports do not include email addresses, user IDs, form contents, or any personal data.

Our infrastructure providers (Railway, Supabase) collect standard server logs (IP addresses, request timestamps) as part of normal platform operation. We do not actively collect or analyze this data for profiling purposes.

2. How We Use Your Information

  • Provide and operate the CanaryGuard service, including deploying tokens and delivering alerts
  • Send alert notifications when your canary tokens are triggered (via email, webhook, or in-app)
  • Process payments and maintain your account credit balance
  • Send transactional emails (account verification, password resets, alert digests) via Resend from noreply@canaryguard.app
  • Improve, maintain, and troubleshoot the platform
  • Detect and prevent abuse of the service
  • Comply with legal obligations

We do not sell your personal data. We do not use your data for advertising. We do not build profiles for marketing purposes.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process your data under the following legal bases:

  • Contract Performance -- Processing your account data and providing the canary token service as described in our Terms of Service
  • Legitimate Interest -- Collecting alert data (IP addresses, geolocation) when tokens are triggered, as this is the core security functionality our users have engaged us to provide. We also rely on legitimate interest for fraud prevention and service improvement
  • Consent -- Sending optional product updates or newsletters (you may withdraw consent at any time)
  • Legal Obligation -- Retaining certain data as required by applicable law

4. Data Retention

  • Active accounts: Account data is retained for as long as your account remains active
  • Deleted accounts: Upon account deletion, we aim to remove your personal data within 30 days. Accounts pending deletion are flagged in our admin system for manual review and removal
  • Alert data: Token trigger alerts and associated IP/geolocation data are retained for the lifetime of your account. We plan to implement automated purging of alert data older than 1 year in a future update
  • Payment records: Transaction records are retained for the duration required by applicable tax and accounting regulations
  • Server logs: Infrastructure logs are managed by our hosting providers (Railway, Supabase, Hetzner) per their respective retention policies

5. Third-Party Services

We use the following third-party services to operate CanaryGuard. Each service processes data only as necessary for its specific function:

5.1 Infrastructure and Hosting

  • Supabase -- Database hosting, authentication, and row-level security. Stores account data, token metadata, and alert records
  • Railway -- Hosts the CanaryGuard web application and API
  • Hetzner -- Virtual private server hosting for the callback infrastructure (svccdns.com) and self-hosted BTCPay Server

5.2 Communications

  • Resend -- Transactional email delivery (alert notifications, account emails) sent from noreply@canaryguard.app

5.3 Payments

  • BTCPay Server (self-hosted) -- Processes Bitcoin and Lightning Network payments. As a self-hosted solution, payment data remains on our own infrastructure

5.4 IP Geolocation

  • ip-api.com -- Used to resolve IP addresses from triggered tokens into geolocation data (city, region, country, ISP). Only the triggering IP address is sent to this service; no account or user data is shared

6. IP Address Processing

IP address collection is central to how CanaryGuard works. When a canary token is triggered, the triggering party's IP address is captured and enriched with geolocation data. This allows our users to:

  • Identify the geographic origin of unauthorized access attempts
  • Correlate trigger events across multiple tokens
  • Provide actionable intelligence for incident response
  • Document evidence of unauthorized access for legal or compliance purposes

Our users (the token deployers) are the data controllers for alert data generated by their tokens. CanaryGuard acts as a data processor, collecting and storing this data on their behalf. If you have concerns about your IP address being collected by a canary token, please contact the organization that deployed the token.

7. Security Measures

We implement the following security measures to protect your data:

  • All data in transit is encrypted via HTTPS/TLS
  • Passwords are securely hashed by our authentication provider (Supabase Auth) before storage
  • API keys are hashed and cannot be retrieved after initial creation
  • Row-level security (RLS) policies in Supabase ensure users can only access their own data
  • Database backups are encrypted
  • Access to production infrastructure is restricted and audited
  • The callback domain (svccdns.com) uses HTTPS for all token trigger communications

8. Your Rights Under GDPR

If you are located in the EEA, you have the following rights regarding your personal data:

  • Right of Access -- Request a copy of the personal data we hold about you
  • Right to Rectification -- Request correction of inaccurate personal data
  • Right to Erasure -- Request deletion of your personal data (subject to legal retention requirements)
  • Right to Data Portability -- Receive your data in a structured, machine-readable format
  • Right to Object -- Object to processing based on legitimate interest
  • Right to Restrict Processing -- Request that we limit how we use your data
  • Right to Withdraw Consent -- Where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at support@canaryguard.app. We will respond within 30 days.

9. CCPA Compliance

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the following rights:

  • Right to Know -- Request disclosure of the categories and specific pieces of personal information we have collected about you
  • Right to Delete -- Request deletion of personal information we have collected from you
  • Right to Opt-Out -- We do not sell personal information, so this right does not apply. However, if our practices change, we will provide a clear opt-out mechanism
  • Right to Non-Discrimination -- We will not discriminate against you for exercising your CCPA rights

To submit a CCPA request, email support@canaryguard.app with the subject line "CCPA Request."

10. Children's Privacy

CanaryGuard is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete that information promptly. If you believe a child under 16 has provided us with personal data, please contact us at support@canaryguard.app.

11. International Data Transfers

Your data may be processed in countries other than your country of residence. Our infrastructure providers operate data centers in various locations. When we transfer data outside the EEA, we ensure appropriate safeguards are in place, including:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • Adequacy decisions where applicable
  • Data processing agreements with all third-party providers

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. For significant changes, we will send a notification to the email address associated with your account at least 30 days before the changes take effect.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

Email: support@canaryguard.app

Website: canaryguard.app