Privacy policy

www.cdnca.com is a static website with no accounts. The site itself sets no cookies and loads no advertising scripts.

We use Google Analytics 4 to measure visits (visit counts, referrers, pages viewed, device types and similar) so we can understand how the site is used and improve it. Google processes this data. It loads only after you choose Accept in the banner; once loaded, Google Analytics sets cookies on this site: _ga (distinguishes visitors) and _ga_* (keeps session state), kept for up to 2 years under Google’s default settings. Advertising storage and personalisation are always off and IP addresses are sent anonymised.

If you choose Decline or have not chosen yet, Google Analytics is not loaded and no analytics requests are sent to Google.

Your choice in the banner is kept only in your own browser’s local storage and is never sent to us. You can withdraw or change it at any time under Cookie settings in the footer or below; after withdrawing, analytics scripts no longer load, and cookies already set can be cleared in your browser settings. If anything about analytics changes we will update this page and ask you again.

As with any website, the server sees your IP address and browser identifier when handling a request; these are part of the web server’s ordinary access logs.

Cookie settings

Sign-up, sign-in and purchases of licences and plugins happen in the licence portal at auth.cdnca.com. We collect:

• Account details: username, e-mail, password (stored only as a one-way hash) and when you accepted the terms; a phone number is optional.
• Sign-in details: the IP address, browser identifier and start and end time of each session, and the requesting IP when an e-mail code is sent. You stay signed in for 30 days by default; signing out ends the session.
• Identity verification (only if you submit it): the legal representative or company name and unified social credit code. When identity is checked through Alipay or WeChat we keep only a masked name and ID number plus a one-way digest, never the full number.
• Payout account for developers or suppliers (only if you add one): holder name, bank and account number; the number is stored encrypted and shown masked.
• Orders and payments: what you bought, the amount, payment method and status.

We use this to sign you in and protect your account, issue and manage licences, process orders and payouts, complete identity verification where the law requires it, and send codes and account notices.

The control plane and nodes you deploy run on your own servers. Your sites’ visitor traffic stays on them and is not sent to us. The control plane reports only the following to the licensing service:

• Commercial edition: installation ID, installation name, control plane public key and activation time; the source IP of activation and renewal requests (to record the control plane IP and flag changes); the running version; and usage counts (sites, domains, nodes, plans, release channels and monthly traffic).
• Community edition: an anonymous report of installation ID, version, source IP and node and site counts, at most once an hour, with no account needed.
• The content of CC/WAF rules created by tenants, to improve the official rule library; rule owners appear only as an installation-salted hash. History older than 180 days that is not the latest snapshot is removed.
• Rule intelligence (on by default; the platform administrator can turn it off in the control plane): block statistics and attack fragments from requests stopped by strong signals. Fragments are stripped of e-mail addresses, phone numbers, ID and bank card numbers, IPs, tokens and similar personal data on the node, the control plane and the licensing service; a report that still contains any is rejected whole.

We use this to check licences, measure usage, deliver upgrades and plugins, and improve security rules.

This information is kept in the database of the licensing servers we operate; keys, payout account numbers and other sensitive fields are encrypted. We do not sell personal data. It passes through the following third parties only where needed to provide the service:

• Cloudflare, as the CDN that carries requests to this website; it sees visitors’ IP addresses and request details.
• Payment channels: when you pay, the amount and order number go to the channel you choose (Alipay, WeChat Pay, Epay, Codepay, crypto collection or bank transfer, depending on what the portal offers at the time).
• Identity verification: if you verify through Alipay or WeChat, that platform performs the check.
• E-mail delivery: codes and notices are sent through the mail service we configure (our own SMTP, Alibaba Cloud DirectMail or SendGrid).

• Google, which processes website analytics through Google Analytics once you accept (see “This website, cookies and analytics” above).

In the licence portal you can view your account details, change your password and sign out. To correct or delete your personal data, or with any question about this policy, contact us using the details below. When this policy changes the date at the top changes too; changes involving cookies or analytics scripts will ask for your choice again.

Contact：[email protected] · All contact options