WHX

Privacy Policy

Last updated: May 14, 2026

1. Introduction

WHOX Limited ("WHOX", "we", "us", or "our") operates the WHOX privacy analysis platform (whox.com) and the WHOX Vigil browser extension. This Privacy Policy explains how we collect, use, and protect information when you use our services. We are committed to privacy by design and data minimization principles.

2. Scope of This Policy

This Policy applies to: (a) the WHOX website and all associated services, (b) the WHOX Vigil browser extension, (c) the WHOX API, and (d) any other products or services that link to this Policy. By using our services, you acknowledge that you have read and understood this Policy.

3. What We Do NOT Collect

WHOX does not collect Personally Identifiable Information (PII). Specifically, we do NOT collect or store:

  • •Names, email addresses, phone numbers, or physical addresses
  • •Account credentials or authentication tokens (other than API keys you create yourself for the API — see Terms §5)
  • •Payment card numbers or financial account details
  • •Browsing history, cookies, or data from other websites
  • •Keystroke data, form inputs, or user-generated content
  • •Precise geolocation or GPS coordinates
  • •IP addresses for advertising, marketing, profiling, or cross-context behavioral tracking. We do retain request logs containing IP addresses for 30 days for abuse prevention and statistical analysis — see Section 5.

4. Information We Process

When you use WHOX services, we process the following categories of anonymized, non-personal data:

4.1 Technical Fingerprint Signals

Canvas rendering hash, WebGL renderer string hash, Audio context signature hash, Font enumeration hash, Screen configuration metadata, Navigator and User-Agent data, Timezone and locale settings

4.2 Network Metadata

Anonymized IP geolocation (country/region only, derived locally using MaxMind databases), ASN and network type classification, DNS resolver characteristics (country only), WebRTC candidate types (the candidate IPs themselves are hashed client-side and discarded — they are never written to our logs)

4.3 Behavioral Metrics (Deep Scan only)

Aggregate mouse movement velocity statistics, Scroll behavior patterns (timing only), Interaction timing data

4.4 Vigil Extension Data

Tracker blocking statistics (counts only), Fingerprint protection activation counts, Censorship probe results (domain reachability status only)

4.5 Request Logs

Source IP address (full), timestamp, request path, response status code, and User-Agent string. These access logs are kept for 30 days only — see Section 5 — and are used exclusively for abuse prevention (rate limiting, fraud detection, blocking automated scraping) and aggregate traffic analytics. They are never sold, never shared with advertising partners, and never linked to a real-world identity.

⚡ Fingerprint and behavioural signals are cryptographically hashed or aggregated before storage. Raw fingerprint values are never persisted. Request logs (Section 4.5) keep IPs for 30 days for the abuse-prevention purposes described above and are then automatically and irreversibly purged.

5. Data Retention Schedule

We implement strict data retention limits in accordance with data minimization principles:

30days
Anonymized session data: 30 days — Includes hashed fingerprint components, network metadata, and behavioral metrics. Automatically purged after 30 days.
365days
Fingerprint hashes only: 365 days — SHA-256 hashes of fingerprint components retained for uniqueness analysis and algorithm improvement. No reversible data.
∞
Aggregated statistics: Indefinite — Fully anonymized, statistical aggregates (e.g., "X% of users have Canvas fingerprint Y") may be retained indefinitely for research.
30days
Request logs (including full IP addresses): 30 days — Access and audit logs are retained for 30 days for abuse prevention, anti-fraud cross-checks, and aggregate traffic analytics, then automatically and irreversibly purged. We never use these logs for advertising, marketing, profiling, or cross-context behavioral tracking, and we never share them with third parties for those purposes.

6. Data Processing Practices

All data processing adheres to the following principles:

  • •Local Processing: IP-to-geolocation lookup uses locally-hosted MaxMind databases. No IP addresses are transmitted to third parties.
  • •Cryptographic Hashing: All fingerprint components are hashed using SHA-256 before storage.
  • •No Cross-Site Tracking: We do not use cookies, pixels, or any cross-site tracking mechanisms.
  • •No Machine Learning on Personal Data: We do not train ML models on individual user data. All algorithmic improvements use aggregated, anonymized datasets.
  • •Encryption in Transit: All data transmission uses TLS 1.3 encryption.

7. Third-Party Services

We minimize third-party dependencies:

  • •MaxMind GeoIP: Database files hosted locally. No data transmitted to MaxMind.
  • •Cloudflare: CDN and DDoS protection. Subject to Cloudflare's privacy policy for edge processing only.
  • •Payment Processors: If you subscribe to paid services, payments are processed by Stripe or Paddle. We do not store payment card details.

We do not sell, rent, lease, or share any data with third parties for advertising, marketing, or data brokerage purposes.

8. WHOX Vigil Extension

The WHOX Vigil browser extension processes data locally on your device:

  • •Tracker Blocking: Uses locally-stored rule sets. No browsing data transmitted.
  • •Fingerprint Protection: All spoofing occurs locally. No fingerprint data sent to our servers.
  • •Censorship Monitor: If enabled, anonymously probes website availability. Only reachable/blocked status and country code are transmitted. No personal data.
  • •Trust Score: Calculated using our API. Only anonymized fingerprint hashes are transmitted.

Vigil can operate fully offline for tracker blocking and fingerprint protection features.

9. Your Rights

Depending on your jurisdiction, you may have the following rights:

  • •Right to Access: Request information about what data we process about you.
  • •Right to Deletion: Request deletion of any data we may hold.
  • •Right to Rectification: Request correction of inaccurate data.
  • •Right to Data Portability: Request a copy of your data in a machine-readable format.
  • •Right to Object: Object to processing for specific purposes.

Note: Because we do not collect PII, most user data cannot be attributed to a specific individual. Requests will be fulfilled to the extent technically feasible.

10. GDPR Compliance

For users in the European Economic Area:

  • •Legal Basis: Processing is based on legitimate interest (providing and improving our privacy analysis services and protecting them from abuse).
  • •Data Controller: WHOX Limited, registered in the State of Delaware, United States of America, is the data controller.
  • •Privacy and DPO Contact: support@whox.com
  • •Supervisory Authority: You have the right to lodge a complaint with your local data protection authority.

11. CCPA Compliance

For California residents:

  • •We do not sell personal information.
  • •We do not share personal information for cross-context behavioral advertising.
  • •You may request disclosure of data collected and request deletion.

12. Children's Privacy

WHOX services are not directed to individuals under the age of 16. We do not knowingly collect information from children. If we become aware that we have inadvertently collected data from a child, we will delete it immediately.

13. Security Measures

We implement industry-standard security measures:

  • •TLS 1.3 encryption for all data in transit
  • •AES-256 encryption for data at rest
  • •Regular security audits and penetration testing
  • •Access controls and audit logging
  • •Incident response procedures

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced via our website and, where applicable, via the Vigil extension. Continued use of our services after changes constitutes acceptance of the revised Policy.

15. Contact Information

For privacy-related inquiries, data access requests, or complaints, contact us at support@whox.com. The legal entity processing your data is WHOX Limited, registered in the State of Delaware, United States of America.