Get started
Theme and language
Legal documents

Privacy

Last updated: 2026-09-30

This Policy describes what data the Panda Defender Service collects, how it is used, who it may be shared with, and what rights users have. By using the Service, you confirm that you have read and understood this Policy.

1. Who is the operator

The Service is a personal project. The operator is a private individual (the «operator»). Contacts for personal-data inquiries are listed on the contact page.

2. What data we collect

2.1. Registration data

  • Email and password — the password is stored only as a cryptographic hash; even the operator cannot recover the original.
  • Telegram ID and username — when you start the Telegram bot @PandaDefenderBot or link Telegram in the user cabinet («Settings» → «Link Telegram»). Your phone number is neither requested nor passed to the Service.
  • Preferred interface language.

2.2. Technical data

  • IP address and user-agent — recorded in web server and application logs, as well as in records of sign-in sessions and visits to certain pages of the site (for a failed sign-in attempt — together with the login or email entered). Used for security (preventing password brute-force, spam, attacks), for sign-in sessions and for aggregated visit statistics. Retention periods are given in section 7.
  • The external IP address from which a VPN configuration connects, and the time of the first and last observed connection — recorded when connection status is checked and used to diagnose the service.
  • Cookies — to maintain the login session and remember the language and theme (see the «Cookies» section below).
  • List of sign-in sessions in the user cabinet — for each sign-in: device type, operating system and browser (derived from the user-agent), approximate country and city (determined from the IP address by Cloudflare), sign-in method, time of sign-in and of last activity. The IP address itself is not stored in the list — only an irreversible fingerprint of its subnet. You can see the list in the user cabinet («Settings» → «Security» → «Sessions») and end any session there — this makes a sign-in that was not yours easy to notice.
  • Aggregated site visit statistics — via Cloudflare Web Analytics: no cookies and no user identifiers; used to see which pages are opened and how fast they load.
  • The «My IP» and «Speed test» pages — they run in your browser and contact Cloudflare services directly (speed.cloudflare.com, ipv4/ipv6.icanhazip.com and a STUN server for the WebRTC check), which see your IP address like any website; our server answers whether your address belongs to our servers and checks it as described in the next item. Speed test results are kept only in your browser.
  • On the «My IP» page our server also looks up your address in public network registration databases (RDAP, via rdap.org), in reverse DNS and in two public spam blacklists (SpamCop, Barracuda) — these services receive your IP address (see section 5). For the DNS check your browser requests a one-time random name under dnscheck.pandadefender.com, so we see which DNS server asked for it (and whether it passed on part of your address); the network of that DNS server is looked up in the same registration databases. The results are kept only in the server's memory — the DNS check for 2 minutes, the other checks for up to an hour, network registration data for up to a day — and are not linked to an account.

2.3. Service data

  • Purchase and payment history: amounts, dates, payment method, transaction ID (txid/invoice id) — to resolve possible financial disputes, confirm that services were rendered, and for support.
  • Time of last activity and actions in the user cabinet.
  • Configuration metadata: server country, validity period, peer ID — for proper operation of the service.
  • Support requests — the text of your messages and the files you attach (e.g., screenshots), to answer the request.

2.4. What we do NOT collect

  • The contents of traffic passing through the VPN/proxy.
  • Browsing history or users' DNS queries.
  • Phone numbers, identity document details, or biometrics — the Service does not request them.
  • Payment details (card number, CVV) — these are handled exclusively by payment providers on their side.

3. Why we collect data

  • Authentication — so you can sign in to your account.
  • Payments and balance accounting — to deliver paid services correctly.
  • Security — detection and prevention of abuse (fraud, password brute-force, breach of the Terms of Service).
  • Service notifications — e.g., about expiring configurations or payment confirmations. Some of these Telegram messages (e.g., expiry warnings for configurations) can be turned off in the user cabinet: «Settings» → «Notifications».
  • Support — processing of support requests.
  • Analytics — aggregated, without identifying individual users (active users count, popular plans, etc.).

4. Legal bases for processing

We process your data on the following bases:

  • Performance of contract — data without which the service cannot be delivered (account, balance, operation history);
  • User consent — voluntarily provided data (email for notifications, etc.);
  • Legitimate interests — for security and abuse prevention;
  • Legal obligations — where data processing is required by applicable law.

5. Third-party subprocessors

For the Service to operate we use the following external services, which may receive a limited set of data as needed for their functions:

  • Payment providers (bank card and SBP payments, cryptocurrency payments) — process payments. They receive the data needed to process and confirm a payment and handle it under their own rules. To the card and SBP payment service we pass the amount, the payment number and a technical account identifier in the Service (derived from your Telegram ID or internal user number); we do not pass your name, phone number, email or password. Data you enter on the payment page (e.g., card number or phone number for SBP) is received and processed by the payment service itself and does not pass through our infrastructure. Cryptocurrency payments to a wallet address are recorded on a public blockchain.
  • Proxy supplier — an external service we buy proxy servers from. When an order is placed, it receives the country, type and term; your account data is not passed to it. When you use a proxy, the connection goes through the supplier's servers, so the supplier can technically see the connecting IP address and the proxy traffic and processes them under its own rules.
  • CDN provider — DDoS protection and static caching. Sees site visitors' IP addresses and HTTP request headers and processes them under its own privacy policy.
  • Hosting providers — server hosting. Data is stored on servers we rent from them; we do not share it with hosting providers for their own purposes.
  • Email service — sends service emails (e.g., a confirmation code when you change your email). Receives: the recipient's address and the text of the email.
  • IP geolocation service — determines the approximate country and city of a connection to help diagnose the service. Receives: the connecting IP address.
  • Address lookup services of the «My IP» page — public network registration databases (RDAP: rdap.org and the regional internet registries it passes the request on to), the spam lists SpamCop and Barracuda, and the owner of the reverse DNS zone of your address (usually your provider): our server asks them about your address when you open the «My IP» page (see section 2.2). Receive: your IP address; the registration databases also receive the address of the DNS server your device uses.

Each subprocessor has its own privacy policy. We do not share data with third parties for marketing purposes.

Upon receiving substantiated complaints or lawful requests from competent authorities, the available technical data listed in section 2 that is needed to establish whether abuse took place may be analysed, to the extent permitted by applicable law. Only this data may be disclosed at the lawful request of competent authorities; traffic contents and browsing history are not stored and therefore cannot be disclosed.

6. Cookies

The site and the user cabinet use the following cookies:

  • pd-theme — selected theme (light/dark); set when you switch the theme and kept for up to 1 year;
  • pd-lang — selected interface language; set when you choose a language or sign in to the user cabinet and kept for up to 1 year;
  • pd-cookie — remembers that you have closed the cookie notice; set when you click «Got it» and kept for up to 1 year.

The user cabinet (panel.pandadefender.com) also sets technical cookies of its own, only for its own address (HttpOnly, Secure):

  • __Host-pd_panel — keeps you signed in to the user cabinet; up to 30 days;
  • __Host-pd_ld — marks that you have already signed in to your account from this browser, so that wrong passwords typed by someone else for your email do not lock you out of your own account; contains no account data, remains after you sign out and is kept for up to 180 days;
  • __Host-pd_tglb — links the browser to a sign-in via Telegram in progress; up to 1 hour.

Some service pages of the site that are generated by the server (e.g., the payment page and news) set a technical session cookie until you close the browser, and the lang and theme cookies when you change the language or theme there (up to 1 year). The support chat that opens from the bot @PandaDefenderBot keeps you signed in with the tgs_sess cookie (HttpOnly, Secure; up to 30 days).

The pd-theme, pd-lang and pd-cookie values are also saved in your browser's local storage (localStorage); the user cabinet stores a few more interface settings there. The site and the cabinet also use session storage (sessionStorage), which the browser clears when you close the tab: the referral code from a referral link (pd-ref), the link for signing in with Telegram or linking it while that link is valid (pd-tglogin) and similar temporary interface data. If no language has been chosen, the site determines it from your connection country using the CDN provider; the result is not saved. The CDN provider that protects the site may set its own technical cookies to filter out automated requests.

Advertising and tracking cookies are not used at this time. If contextual advertising (e.g., Google AdSense) is added in the future, this Policy will be updated with an explicit notice.

7. Retention period

  • Account data — for as long as your account exists.
  • Payment history — up to 3 years for resolving possible financial disputes and confirming that services were rendered.
  • Correspondence with support — for as long as your account exists; files attached to requests are deleted once 180 days have passed since the request was closed (the cleanup runs automatically in small batches, so a file may be kept a little longer).
  • IP addresses and user-agents in web server logs — up to 15 days; IP addresses in the firewall log — up to 5 weeks.
  • IP addresses and user-agents in application logs and in records of sign-in sessions and page visits, as well as IP addresses of configuration connections — no fixed retention period has been set.
  • Service metadata of configurations — while the configuration is active, plus a grace period of up to 30 days.
  • Database backups — deleted data may remain in them until those backups are deleted.
  • The list of sign-in sessions — while a session is active; ended and expired sessions are deleted after 30 days.

8. Cross-border data transfers

Data may technically be transferred through third-party infrastructure (CDN/DDoS protection, hosting, email service) located outside the operator's country of residence. Transfer happens only to the extent necessary for the Service to operate and is governed by the respective providers' privacy policies.

9. Your rights

Regarding your personal data, you have the right to:

  • Access — find out what data is stored about you;
  • Correct — fix outdated data in the user cabinet («Settings») or via support;
  • Delete — request deletion of your account and associated data via the «Support» section in the user cabinet or in the Telegram bot @PandaDefenderBot, except payment history, which is kept for up to 3 years to resolve possible financial disputes and confirm that services were rendered (see section 7);
  • Withdraw consent — for specific types of processing (e.g., email notifications);
  • Get a copy — on request via support, we will provide a copy of your data.

Submit such requests via the «Support» section in the user cabinet or in the Telegram bot @PandaDefenderBot; see also the contact page. Response time — up to 30 days from receipt of the request.

10. Security

We apply reasonable technical and organisational measures to protect your data:

  • HTTPS/TLS for all traffic between the browser and the server;
  • password hashing using modern algorithms;
  • restricted administrative access to the database;
  • regular updates of system components.

No system is fully secure. In the event of an incident affecting your data, we will notify you within a reasonable period via email or Telegram.

11. Minors

The Service may be used from the age of 18 or, if the age of majority in the user's country is reached later, from that age. We do not specifically ask users for their age, but if we learn that an account belongs to a minor, that account will be deleted.

12. Changes to the Policy

The Policy may be updated. The current version is always published on this page with the update date. We will try to notify you of material changes in advance via email or the Telegram bot.

13. Contact

For any matters concerning personal-data processing and your rights, contact us via the «Support» section in the user cabinet or in the Telegram bot @PandaDefenderBot; see also the contact page.