Legal
Effective date: April 29, 2026 — Last updated: April 29, 2026
This Privacy Policy describes how Dorunaitsu LLC ("ShieldNode", "we", "us", or "our"), a Delaware limited liability company, collects, uses, and protects information when you use our service at shieldnode.app.
By using ShieldNode, you agree to the collection and use of information in accordance with this policy. This policy must be read together with our Terms of Service, which govern your responsibilities for the data you choose to send through our proxy.
ShieldNode is an API proxy. The bodies of your API requests and responses pass through our infrastructure to reach the upstream API, but we do not log, store, inspect, decrypt for inspection, or process the content of those bodies. We never see what your requests contain or what the upstream API replies. We only record technical metadata about each call (method, path without query string, status, latency, timestamp).
For any personal data that you choose to send through ShieldNode in a request body, response body, or URL path:
This Privacy Policy describes what we do with the data we do see — your account information, encrypted upstream credentials, virtual key hashes, and request metadata.
When you register, we collect your email address and authentication credentials via Supabase Auth (Google OAuth or email/password). We do not store passwords — authentication is handled entirely by Supabase.
When you add a service to ShieldNode, you provide an API base URL and credentials (API keys, tokens, or passwords) for that service. This is the most sensitive data we handle. We protect it as follows:
Virtual keys generated by ShieldNode are hashed on creation using a one-way function. The plaintext key is shown to you exactly once and is not recoverable afterward. We store only the hash for authentication purposes.
When requests are proxied through ShieldNode, we log the following metadata for each request:
We do not log request bodies, response bodies, authorization headers, or any payload content. Log retention depends on your plan (7 days on Free, 30 days on Pro, 90 days on Team).
We may collect IP addresses for security purposes (rate limiting, abuse prevention) and session tokens stored in cookies for authentication. We do not use analytics tools, advertising trackers, or behavioral tracking of any kind.
We do not sell, rent, or trade your personal information. We share data only with the following service providers (sub-processors), limited to what is necessary for them to perform their function on our behalf:
We may add or change sub-processors as the service evolves. The list above is kept current on this page; we do not commit to individual notice for each change.
We may disclose your information if required by law, court order, subpoena, or governmental request, or to protect the rights, property, or safety of ShieldNode, our users, or the public. Where legally permitted, we will notify you of such requests so you may seek a protective order.
ShieldNode and all our current sub-processors operate primarily in the United States. If you access ShieldNode from the European Union, the United Kingdom, Switzerland, or another jurisdiction with data-export restrictions, your information will be transferred to and processed in the USA.
For transfers of personal data from the EU/EEA, UK, or Switzerland to the USA, we rely on the European Commission's Standard Contractual Clauses (SCCs) or, where applicable, the UK International Data Transfer Addendum incorporated into our agreements with sub-processors. Where a sub-processor is certified under the EU-US Data Privacy Framework or its UK / Swiss extensions, we may also rely on that certification.
By using ShieldNode while located in a region with data-export rules, you acknowledge that we and our sub-processors process your data in the USA on the legal bases described above.
We implement industry-standard security measures including:
No method of transmission over the internet or storage system is 100% secure. We cannot guarantee absolute security, and we are not liable for unauthorized access that occurs despite reasonable security measures (see Terms of Service, Section 10).
If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will:
Notification will be made by email to the address associated with your account, or by another method of equivalent reach if email is impracticable.
If you are located in the European Union, the European Economic Area, or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) or UK GDPR:
Our legal bases for processing your data are:
To exercise any of these rights, contact us at contact@shieldnode.app. We will respond within 30 days of a verifiable request, and may extend this period by an additional 60 days where the request is complex or numerous, in which case we will notify you of the extension.
Scope. These rights apply to the personal data we control as described in this Privacy Policy (account info, encrypted credentials metadata, virtual key hashes, request metadata). They do not extend to the content of API requests or responses you proxy through ShieldNode — for that content you are the controller, and any data-subject request relating to that content must be addressed to you, not to us.
Data Processing Agreement. If you process personal data of EU/UK residents through ShieldNode in your role as a controller and require a Data Processing Agreement (DPA) with us as a processor for the limited metadata we handle, contact us at contact@shieldnode.app.
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):
To submit a request, contact us at contact@shieldnode.app. We will respond within 45 days.
ShieldNode uses only essential cookies necessary for the service to function. See our Cookie Policy for full details. We do not use advertising cookies, analytics cookies, or any third-party tracking.
ShieldNode is not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected such information, please contact us immediately at contact@shieldnode.app and we will delete it promptly.
We may update this Privacy Policy from time to time. We will notify you of significant changes by email (to the address associated with your account) or by posting a notice on shieldnode.app. Your continued use of the service after changes take effect constitutes acceptance of the updated policy.
For any privacy-related questions, data requests, or concerns: