Privacy Policy

1. Who we are and what this document is for

This policy describes what data Hlebushek ("Hlebushek", "we") receives from you when you use the website hlebushek.com, the regional domain ru.hlebushek.com, our mobile application, and the Telegram bot @hlebushek_com_bot.

The document is written to cover two jurisdictions at once:

• GDPR (EU Regulation 2016/679) — for users in the European Economic Area;
• Russian Federal Law No. 152-FZ on Personal Data (referred to below as "FZ-152") — for users in Russia.

We're a small team. We've tried to write this honestly, without the usual legal fog. If anything is unclear, drop us a line — contacts are at the very bottom.

2. What data we receive

2.1. When you create an account

Depending on how you sign up, we keep:

• Email and password — if you register the standard way. We never see your password: only a cryptographic hash of it is stored.
• Account key — if you choose anonymous key-based sign-in. We store only a hash of the key; the key itself is not stored in the clear, and we cannot recover it for you if you lose it.
• Telegram ID, first name, and username — if you sign in through Telegram. These come to us automatically from Telegram during authentication.

We also automatically record: registration date, last sign-in time, region (ru or eu, derived from which domain you opened), and a technical session (a random token in a cookie).

2.2. When you pay

We accept payments only in cryptocurrency, through NOWPayments. For each payment, our database keeps: order number, selected plan, amount, currency, status, the NOWPayments transaction ID, and a date.

Card numbers, ID documents, real names, and addresses are never received or stored by us — none of that exists in our system. NOWPayments, as the payment processor, may request identification from you under their own rules — that is their responsibility and their own privacy policy.

2.3. Server connection logs

So that we can answer your "it isn't working" message and fix things quickly, we automatically gather a short technical summary from our servers. This is the most sensitive category of data, so we'll spell out exactly what it contains:

These logs are deleted automatically after 7 days.

2.4. Support conversations

When you write to support through the Telegram bot or your account, we keep the conversation (message text, timestamps, and the link to your account) so that we can continue the dialogue and come back to it if needed. We see only what you have written to us yourself.

2.5. Notifications and feedback

If you rate a notification with the "like / dislike" button, we save that vote to inform what we send out in future. We also store the read status of in-app banners.

2.6. Service complaints

If you tap "not working" inside the mobile application, we receive a short technical report: your visible IP at that moment, the active connection profile, the status, the device platform, and any free-form comment you've added. This lets support figure out what is going on in minutes rather than hours.

2.7. Push notifications (mobile application)

To deliver push notifications to you (for example, "your subscription expires in 3 days"), we store the device token issued by Firebase Cloud Messaging and the platform (Android / iOS). When you sign out or when Google revokes the token on its side, we delete it.

2.8. Referral programme

If you take part in our referral programme, we store: who invited you, who you invited, and which credits have been issued. This data is used solely for accounting within the programme.

2.9. Aggregate traffic volume

For billing, abuse protection, and warning you as you approach the limits of your plan, we plan to keep a per-account daily total of data transferred — aggregate counters from our routing infrastructure, with no link to specific destinations or to the timing of individual connections.

At the time of publishing this version, the feature is in development: the counters are gathered and stored in an anonymised form, but they are not yet shown in your account. Once we ship it, you'll see your daily traffic in the Account section. These counters are kept for no longer than 60 days.

3. What we keep in cookies

We use only functional cookies — none for advertising or analytics. There are just three of them:

Because all of these cookies are strictly necessary for the service to work, we do not show a separate cookie banner (GDPR allows this for functional cookies).

4. Why we collect this (legal bases)

In GDPR terms, we rely on the following legal bases, depending on the type of data:

• Performance of a contract — most of the data (account, payment, 7-day connection logs, push tokens) is needed to deliver the service you came for;
• Consent — for marketing emails and promotional notifications: the notify_promo, notify_email, and notify_tg flags are off by default for marketing. Technical notifications (something is broken, a server has changed) are considered necessary and are on by default — you can switch them off in your account;
• Legitimate interest — diagnostics and infrastructure security: internal server probes, latency monitoring, brute-force protection;
• Legal obligation — responding to lawful requests from public authorities, to the extent that we are legally required to.

In FZ-152 terms, the basis for processing is the offer agreement for the service (concluded at the moment of registration) and your separate consent for specific types of communication.

5. How long we keep things

6. Who we work with (third parties)

To run the service, we have to use a small set of vendors. We pass them only what is technically necessary for the part of the work they handle. We do not work with any analytics, advertising, or CRM partners.

Those five are the entire list. We have no Google Analytics, Yandex Metrika, Sentry, Segment, Mixpanel, Hotjar, Facebook Pixel, customer.io, or any other analytics or marketing tooling.

Disclosures to law enforcement

Any company operating legally has to respond to lawfully issued requests. We will not write "we will never disclose anything" — that would not be true. So here is the honest version:

• We disclose data to third parties only where required by applicable law;
• Each request is reviewed individually and we verify that it has been issued in due form;
• We respond with the minimum that we are legally required to provide, and nothing beyond that — because nothing beyond what is described in this document exists in our systems;
• In particular, the IP addresses you connect to Hlebushek's servers from are not in our database — we do not record them (see section 2.3).

7. How connection masking works

In Russia, our service uses a traffic masking technique whereby our encrypted connection externally appears as an ordinary connection to a well-known Russian online resource. This is necessary for compatibility with traffic filtering systems that, in some regions, only permit connections to certain destinations.

What this means for you:

• We have no relationship with those resources and do not have access to their traffic;
• We use only their public TLS certificates as a "cover" for masking our own connections — this is a technical technique, not a substitution of the resource;
• This is a non-standard use of third-party certificates. Technically it is a grey area — we do not request formal permission from the owners of these resources. We think it is right to be open about this.

8. Your rights

Under FZ-152 and GDPR you have the right to: access your data, correct it, erase it (right to erasure / Art. 17 GDPR), withdraw consent, request portability (Art. 20 GDPR), and complain to a supervisory authority. Most of these rights are already available to you directly in your account — without written requests:

If you believe we have breached your rights, please write to us — we try to reply quickly. You also have the right to contact your country's competent data protection authority (EU/EEA users — the national supervisory authority for data protection).

9. Age of users

Hlebushek is not intended for people under 16 years of age (in line with Art. 8 GDPR). We do not ask you for documents, but if you become aware that your child under 16 has created an account without your consent, please write to us and we will delete it.

10. How we protect data

We are a small team, so we focus on simple, well-tested measures:

• Passwords are never stored in clear text — only cryptographic hashes;
• Session cookies are flagged with HttpOnly, Secure, and SameSite=Lax;
• Two-factor authentication (TOTP) is supported;
• Connections to the website and API are protected with TLS;
• Server access is by SSH key only, with brute-force protection;
• We apply security updates to our servers regularly;
• Database backups are kept locally and are not shared externally.

No system is ever fully invulnerable. Should an incident occur that may affect your data, we will inform you within a reasonable time, in line with FZ-152 and GDPR (Art. 33–34) requirements.

11. Where the data physically lives

Our core database and infrastructure are hosted on servers in the European Economic Area (EEA), where GDPR provides one of the strictest data protection regimes in the world. The vendors listed in section 6 may process the data we send them on their own servers in the USA (Cloudflare, Firebase Cloud Messaging) and in the EU / Cyprus (NOWPayments, Hostinger).

For users based in Russia: we observe the rights granted to you by FZ-152 — access, correction, erasure, withdrawal of consent — independently of where our servers are physically located. See section 8 for how to exercise these rights.

If you wish to minimise the data you share with us, you can register anonymously with an account key — without an email and without a Telegram link. In that case we hold no identifying information beyond the existence of your account itself.

12. Changes to this policy

If we make material changes to this policy, we will give you notice in advance: a notification in your account and an email (if you've given us a verified one). The current version is shown at the bottom of the page. We keep older versions in a change history and can send them on request.

13. How to reach us

We aim to reply within 1–3 business days. Requests submitted under GDPR or FZ-152 are handled within the statutory time limits (up to 30 days under GDPR, up to 30 days under FZ-152).