Approximated.app Data Retention Policy
Last updated: October 29, 2026
This policy describes how long Approximated, Inc. (“Approximated”) retains the categories of data processed in providing the Services, and how data is deleted. Capitalized terms have the meaning given in our Terms of Use. This policy is incorporated into our Data Processing Agreement.
Retention Periods
| Data Category | Retention |
|---|---|
| Account and billing data Name, email, authentication credentials, subscription and invoice records. | Retained for the life of the account. After account closure, deleted within 30 days, except billing records we are required to keep for tax and accounting purposes. |
| Service configuration Virtual hosts, domains, DNS records, routing and security rules. | Retained while in use. Deleted configuration is removed from active systems promptly and purged within 30 days of deletion or account closure. |
| TLS certificates and private keys | Retained while the associated domain is active on the Services; removed within 30 days of the domain being deleted or the account being closed. |
| Traffic logs and analytics Request records and security event data generated by proxying traffic. | Request-level records (including client IP addresses) are retained for 30 days by default, or for another period of between 14 and 365 days agreed with the customer. Security event and IP reputation data is retained for up to 90 days. The audit trail of changes to security rules, which records the IP address or other value each rule targets, is retained for 365 days. Audit entries are kept for that period even after the rule, or the cluster it belonged to, is deleted. Connection totals per client IP address are retained for up to 365 days. They are counted per minute, per hour and per day. Per-minute totals are kept for 2 days, hourly totals for 30 days and daily totals for 365 days. These totals can include the server name the client requested (SNI) and its TLS fingerprint. Connection totals per IP network prefix are retained for up to 730 days. Per-minute totals are kept for 7 days, hourly totals for 90 days and daily totals for 730 days. A prefix is a /24 range for IPv4 or a /56 range for IPv6. Aggregated traffic statistics that do not identify individuals are retained for up to 24 months. Request-level records contain metadata only: timestamp, hostname, method, path, status code, HTTP version, request and response sizes, duration, client IP address, the visitor IP address reported by a CDN or proxy in front of the domain, a label identifying that CDN or proxy, user agent, request ID, the security or upstream outcome, and derived country and network information. They do not contain the requested server name (SNI) or the TLS fingerprint. Request and response bodies of proxied traffic are not written to logs or storage. When a customer enables the optional web application firewall, the fragment of a request that matched a security rule is recorded as a security event. Trace requests are the exception for bodies. When a customer sends a Trace request to test one of its domains, Approximated stores the request and its result for 30 days. The stored request includes the method, path, headers and body the customer supplied, with the body limited to its first 64 KB. The stored result includes the response status, the response headers, the first 64 KB of the response body and the steps the request took through the proxy. Sensitive response header values, such as cookies, are stored only as a short hash. |
| Support communications | Retained for the life of the account and up to 24 months after account closure. |
Backups
We keep encrypted backups of production data on a rolling basis for disaster recovery. Data deleted from production systems ages out of backups within 60 days. Backups are used only to restore service and are not used to reconstruct deleted customer data for any other purpose.
Deletion Requests
You may delete Service configuration at any time through the dashboard or API, and may request deletion of your account and associated data by emailing support@approximated.app. We complete deletion requests within 30 days, except where we are required by law to retain specific records. Traffic logs, analytics and security records generated by proxying traffic, including the audit trail of changes to security rules, are not deleted on request or on account closure. They are deleted as the retention periods set out above expire.
Changes to This Policy
We may update this policy from time to time and will post the current version on this page. Changes required by law take effect when posted. Other changes that lengthen a retention period or add a category of retained personal data will be emailed to account holders at least 30 days before they take effect. All other changes, including those that shorten retention, take effect when posted.