Privacy Policy

Last updated: November 3, 2026

This website (agisec.uz)

• No cookies, analytics, ads or third-party scripts. Every file is served from this domain.
• Your theme choice (light or dark) is stored in your browser's local storage (localStorage) and is never sent anywhere.
• The web server log records only the request time, the address requested, and the response code and size — no IP addresses or browser details.
• The site is delivered through the Cloudflare network. Cloudflare processes technical data such as IP addresses to deliver the site and protect it from attacks.

Your AgiSec account

AgiSec works with an AGI Hub account. For each account we store:

• username, name and (optionally) email address; we don't ask for a phone number;
• passkey public keys, the names and platforms of connected devices, and the time of last activity;
• sessions and a security log: IP address and app identifier (sign-ins, device pairing and similar events).

Sessions are kept for at most 90 days and the security log for 90 days; devices inactive for 60 days are removed.

Password vault

Vault items are encrypted on your device (AES-256-GCM). The server stores only encrypted items, their number and size. The keys never leave your device, so we can't see your passwords. If you lose your recovery key, we can't restore the vault either.

Messenger, calls and meetings

• Messages are end-to-end encrypted (Signal protocol). Undelivered encrypted messages stay on the server for at most 14 days.
• The server sees who is talking to whom (metadata) but not the content of messages. Contact and block lists are stored on the server.
• Files travel from device to device after the recipient accepts them.
• The meeting server sees who joined and when; data about finished meetings is kept for 30 days.

VPN

• VPN access is granted by an administrator.
• For each device, the daily traffic volume (bytes sent and received) is kept for 35 days.
• Connection logs are off by default. An administrator can turn on monitoring for a specific device (domain, time, allowed or blocked) — such records are kept for 7 days. While monitoring is on, connection records stay in server memory for a few minutes so they can be filtered, and only those of the monitored device are kept.
• Device pairing and VPN unlock events are written to the security log together with the IP address.

Browser

The browser doesn't write history, cache or cookies to disk and doesn't send us the list of pages you open. Dangerous sites are detected on the device itself, using downloaded lists. Exception: your Google and GitHub sign-ins are stored on the device, encrypted (you can turn this mode off).

Third-party services

For some tasks the app contacts external services: Google (search and Lens), ipinfo.io (showing the VPN exit address), Cloudflare and Apple (speed test), URLhaus, OpenPhish and Phishing Army (lists of dangerous domains) and public DNS resolvers. Requests to them are covered by their own policies.

Where data is stored

The main server and two VPN servers are located in Uzbekistan; the third VPN server is in the Netherlands. We don't sell your data or use it for advertising.

Your rights

Under the Law of the Republic of Uzbekistan “On Personal Data”, you can request access to your data, its correction and deletion, and you can delete your account. To do so, use the Contact section on the home page.

Changes

If this policy changes, the new version will be published on this page with its date.