Skip to content
Oxrion

Legal

Privacy Policy

Last updated: 1 November 2026

1. Who we are

This policy explains how Oxrion ("we", "us") handles personal data when you use our website, our documentation, Oxrion Console, the encoder service, Oxrion Desktop, the Oxrion CLI and the Oxrion loader. Oxrion is the data controller for the data described here. You can reach us at support@oxrion.com.

2. In short

  • We don't keep your code. The PHP files you protect are processed in memory and sent back. We keep neither your source nor the protected files.
  • Your customers' data stays with you. License History, customer emails, your email accounts, webhooks and your keys stay on your computer. We never receive them.
  • Protected files never contact us. The Oxrion loader runs them on your server without sending us anything.
  • No tracking without your OK. Analytics, chat and referral cookies on our website load only if you allow them. We don't sell personal data.

3. What we collect

3.1 Your account

Your email address, a hashed version of your password, your name if you give it, your plan, credits and subscription status. When you buy, Lemon Squeezy shares with us your name, email, country, order and subscription details. We never see your card or bank details.

3.2 When you protect code

Oxrion Desktop and the CLI send the encoder service, over an encrypted connection:

  • the PHP files you selected, with their paths inside your project;
  • the options you chose, including public keys, the external key value for Server lock, the expiry date, and any Stamp notes you wrote (which may contain your name, company, website or email);
  • your Encoder Token.

The files are protected in memory and returned in the same connection. We do not store the files, the protected output, the external key or your Stamp notes. We do keep:

  • usage records — how many files you protected and when, with the options used, to count your quota and credits and to show your usage in the Console;
  • file fingerprints — a one-way hash of each file you protected, so that protecting the same file again doesn't use your quota. A fingerprint cannot be turned back into your code. Fingerprints are kept only while your subscription is active;
  • request logs — IP address, time, account and result of each request, to keep the Service secure and fix problems.

3.3 Oxrion Console

Your IP address, browser type and the actions you take, to run your account and keep it secure. The sign-up form uses Cloudflare Turnstile to block automated sign-ups.

3.4 Our website and documentation

Our hosting providers process your IP address and browser details to deliver the pages. Analytics, live chat and referral tracking are used only if you allow them — see Cookies.

3.5 Support

The messages you send us by email or chat, and the details you include in them.

4. What we don't collect

  • Oxrion Desktop and the CLI contact Oxrion only when you protect files, and send only what is listed in section 3.2. They contain no analytics or tracking.
  • Everything else stays on your computer: your Vault and keys, License History (your customers' names, emails and notes), your email templates and SMTP accounts, webhooks and app settings. Licenses you email go through your own email provider; webhooks go to your own server. We are not involved in either.
  • Your private keys and your Vault password never leave your computer.
  • The Oxrion loader contains no network code. Protected files run without contacting Oxrion and send us nothing.

5. Why we use it

  • To provide the Service — your account, protecting files, quota, credits, billing and support. Legal basis: performance of our contract with you.
  • To keep the Service secure — preventing abuse, fraud and automated sign-ups. Legal basis: our legitimate interest in a secure service.
  • To send service emails — sign-up, security, billing and changes to our terms. Legal basis: performance of our contract.
  • To improve our website — analytics. Legal basis: your consent, which you can withdraw at any time.
  • To meet legal obligations — for example accounting and tax records. Legal basis: legal obligation.

6. Cookies and similar technologies

We use cookies and browser storage only where needed, and everything else only with your consent. You can change your choice at any time with Cookie settings at the bottom of every page.

Necessary
Your theme (light or dark), shared by oxrion.com, Oxrion Console and the docs, and your cookie choices, stored in your browser. In Oxrion Console: the sign-in session, a security token against forged requests, and Cloudflare Turnstile on the sign-up form.
Always on
Analytics
Google Analytics, loaded through Google Tag Manager, to understand which pages are visited and improve the site.
Only if you allow it
Support chat
Crisp, the live chat on our website, which remembers your conversation.
Only if you allow it
Referrals
Lemon Squeezy's affiliate script, which remembers if a partner referred you so they can be credited.
Only if you allow it

We don't use advertising cookies. Our fonts are served from our own website.

7. Service providers

We share personal data only with providers that help us run the Service, and only what they need:

  • Lemon Squeezy — our reseller and Merchant of Record: checkout, payments, invoices and tax. Lemon Squeezy is responsible for the payment data it collects, under its own privacy policy.
  • Hosting and network providers — run our application, the encoder service, Oxrion Console and its database.
  • Vercel — hosts our website.
  • Zoho — sends and receives our email, including service emails.
  • Cloudflare — carries the traffic to Oxrion Console and the encoder service, and runs Turnstile on the Console sign-up form to block automated sign-ups.
  • Google — Google Analytics, only with your consent.
  • Crisp — live chat on our website, only with your consent.
  • GitHub — hosts the downloads of Oxrion Desktop, the CLI and the loader. When you download them, GitHub processes your IP address.

We may also disclose data if the law requires it. We do not sell or rent personal data.

8. International transfers

Our providers may process data outside your country, including in the United States and the European Union. Where the law requires it, these transfers rely on appropriate safeguards such as the European Commission's standard contractual clauses, or on your explicit consent where Turkish law requires it.

9. How long we keep it

  • Account data and usage records — while your account exists. When you delete your account, we delete them within 30 days; backups are overwritten within a further 90 days.
  • File fingerprints — while your subscription is active; they are not carried over to a new subscription.
  • Request logs — up to 12 months.
  • Billing records — as long as tax and accounting laws require.
  • Support messages — up to 2 years after the conversation ends.

10. Security

Connections to Oxrion are encrypted, passwords are stored only as hashes, files are processed in memory and access to our systems is restricted. No system is completely secure; if a breach affects your personal data, we will tell you and the relevant authorities as the law requires.

11. Your rights

Depending on where you live — including under the EU and UK GDPR, Türkiye's Personal Data Protection Law No. 6698 (KVKK) and the California Consumer Privacy Act — you have the right to:

  • know whether we process your data, and get a copy of it;
  • have it corrected or deleted;
  • restrict or object to its processing, and receive it in a portable format;
  • withdraw consent at any time, without affecting earlier processing;
  • complain to your data protection authority — in Türkiye, the Personal Data Protection Authority (KVKK).

You can delete your account yourself in Oxrion Console. For anything else, email support@oxrion.com; we reply within 30 days. We do not sell personal information or share it for cross-context advertising.

12. Children

Oxrion is a tool for developers and is not meant for anyone under 18. We do not knowingly collect data from children.

13. Changes to this policy

We may update this policy. We will tell you about material changes by email or in the Console before they take effect, and the date at the top always shows the latest version.

14. Contact

Privacy questions and requests: support@oxrion.com.