Privacy Policy
Last updated: 4 August 2026
1. Who We Are
Proxyma is developed and maintained by:
Le Sy Hau
Individual software developer
237/3 Hoa Binh Street
Phu Thanh Ward, Ho Chi Minh City
Vietnam
Email: [email protected]
We are an individual person, not a registered company. We are the data controller for the limited personal data described in this policy.
2. The Privacy-First Design of Proxyma
Proxyma is built to index and search your documents on your own infrastructure. All document processing, vector embedding, keyword indexing, and AI conversations happen on the machine or server that runs Proxyma. When that machine is yours, none of this data is transmitted to or stored on any server we operate — this is a core design principle, not an optional setting.
Two things sit outside that: a cloud AI provider you choose to configure yourself (section 3.6), and the demonstration instance we host for you to try (section 3.7). Everything else below describes the limited cases where personal data flows.
3. What Data We Collect and Why
3.1 Purchase and licensing
Proxyma Community is free. The Personal and Professional tiers are available as a one-time purchase per device. Those purchases are processed by Lemon Squeezy (Lemon Squeezy LLC), who acts as the Merchant of Record. When your purchase completes, Lemon Squeezy triggers an automated function that generates your license key and delivers it to your email address. This function processes order data only in transit to create the key; no personal data is stored on any server we operate. Your name, email address, billing details, and payment information remain under Lemon Squeezy's control at all times. Their privacy practices are described at lemonsqueezy.com/privacy. Enterprise licensing is negotiated directly; contact us at [email protected] for pricing.
3.2 License validation
Proxyma verifies your license's signature locally, using a public cryptographic key bundled with the software. That part never leaves your machine.
Two things do reach our license server, and only for paid tiers. Activating a license sends the license key, a random identifier for that installation, and your computer's name (so you can tell your own machines apart in a device list). After that, Proxyma re-checks the license in the background roughly every six hours, sending the license key and that same random installation identifier — and nothing else. This is what makes a refunded or revoked license stop working.
These calls never carry your documents, your file names or paths, your search queries, your conversations, or anything about your hardware. The installation identifier is a random value generated on your device; it is not a hardware fingerprint. If the re-check cannot reach us, Proxyma keeps working normally for 14 days and then limits itself to the free Community tier's features until it can check again — nothing is deleted.
The free Community tier requires no license and makes neither call.
For the Enterprise tier using an on-premises license server: that server is operated by your organization and is subject to your organization's own privacy policy, not this one.
3.3 Optional telemetry (opt-in only)
Proxyma can optionally collect anonymized error reports and usage statistics to help improve the product. This feature is strictly opt-in and is disabled by default. You can enable or disable it at any time in Settings → Privacy.
Telemetry data does not include: document content, file names or paths, search queries, or conversation content.
Enterprise deployments never send telemetry at all, regardless of this setting — it is disabled at the license level and cannot be turned on.
Legal basis under GDPR: consent (Article 6(1)(a)). You may withdraw consent at any time by disabling telemetry in Settings.
3.4 This website (proxyma.ai)
The proxyma.ai website does not use analytics or advertising cookies. The only browser storage used is a single localStorage entry to remember your theme preference. No IP addresses or browsing data are logged by us beyond what Cloudflare retains as the CDN and DNS provider for this website.
Cloudflare acts as a data processor for the website. Their privacy practices are described at cloudflare.com/privacypolicy.
3.5 Support and email contact
If you contact us at [email protected], your email address and message content are processed to respond to your inquiry and are not shared with third parties.
Legal basis under GDPR: legitimate interest (Article 6(1)(f)).
3.6 AI providers you configure yourself
By default Proxyma uses a local AI model (Ollama) and no document content is sent anywhere. If you choose to configure a cloud AI provider instead — currently Anthropic, OpenAI, DeepSeek, Mistral, Azure OpenAI or Google GenAI — then your question and the relevant retrieved excerpts are sent to that provider to generate an answer. Your full document library is never uploaded.
That provider acts as a subprocessor for those requests and handles the data under its own privacy policy, which we encourage you to read before configuring it. This only happens for a provider you have actively set up; it never happens with the default local model.
3.7 The hosted demonstration instance (enterprise-demo.proxyma.ai)
We host a Proxyma Server deployment at enterprise-demo.proxyma.ai so people can try the product without installing it. This is the one place where we, rather than you, run the infrastructure.
If you create an account there, we process your email address, your password (stored only as a BCrypt hash) or your identity from the Google or Microsoft account you signed in with, plus anything you upload or connect, your conversations, and your search queries. All of it sits on our server for as long as your account exists.
Please do not upload confidential or personal data to the demonstration instance. It exists to show what the product does. For real work, install the desktop app or host Proxyma Server yourself — then none of this applies and nothing reaches us at all.
You can delete your demonstration account at any time from within the app, which removes your account, your documents, your embeddings and your conversation history. The Privacy Policy served inside that deployment describes its processing in full detail, and you are asked to accept it when you create the account.
Legal basis under GDPR: performance of a contract with you (Article 6(1)(b)) for running the account you asked for.
4. Data Retention
| Data | How long we keep it |
|---|---|
| Order data from Lemon Squeezy webhook (name, email, order reference) | Not retained — processed in transit only to generate the license key; not stored |
| Telemetry records (if you opted in) | 12 months, then deleted or permanently anonymized |
| Support email correspondence | 3 years after the last contact |
| Demonstration account at enterprise-demo.proxyma.ai (account, documents, conversations) | Until you delete the account, after which it is removed along with its derived index and embeddings |
5. Data Sharing
We do not sell or rent your personal data to anyone. Data flows only through the following parties:
- Lemon Squeezy (Lemon Squeezy LLC) — Merchant of Record and data controller for Personal, Professional and applicable Enterprise purchase and billing data. We do not retain a copy of this data.
- Cloudflare, Inc. — CDN, DNS, and DDoS protection for the proxyma.ai website.
- An AI provider you configure yourself — subprocessor for the individual requests described in section 3.6. None by default.
- Google or Microsoft — only if you choose to sign in to the demonstration instance with one of those accounts, and only to confirm your identity.
6. International Data Transfers
We are based in Vietnam. Because we do not store purchase data, the personal data we directly handle is support email correspondence when you choose to write to us, and — if you create one — a demonstration account at enterprise-demo.proxyma.ai. Lemon Squeezy, as the sole data controller for all purchase data, handles international data transfers under their own applicable transfer mechanisms.
The demonstration instance runs on Google Cloud infrastructure in Singapore (region asia-southeast1). If you are in the EEA and create an account there, or configure a cloud AI provider under section 3.6, personal data is transferred outside the EEA. We rely on the European Commission's Standard Contractual Clauses, or the recipient's own approved transfer mechanism where it has one, as the safeguard. Running Proxyma yourself avoids both transfers entirely.
7. Your Rights
Rights under GDPR (EEA users)
- Access — request a copy of the personal data we hold about you
- Rectification — request correction of inaccurate data
- Erasure — request deletion of your personal data
- Restriction — request that we limit how we use your data
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interest
- Withdraw consent — for telemetry, disable it at any time in Preferences
We will respond to any rights request within 30 days.
8. Security
We implement appropriate measures to protect the personal data we directly handle (primarily support email correspondence). Because Proxyma processes your documents locally on your own device or server, the security of your document content depends entirely on your own infrastructure security.
9. Children
Proxyma is not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently received data relating to a child, please contact us and we will delete it promptly.
10. Changes to This Policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent revision. For material changes, we will post a notice on proxyma.ai.
11. Contact
Questions about this Privacy Policy: [email protected]