CDNShark Policies

Privacy Policy

Last updated: Aug 11, 2026

This Privacy Policy explains how Nath Network & Telecom Inc. (“CDNShark”, “we”, “us”, or “our”) collects, uses, discloses, and protects personal information when you use our websites, dashboards, and services (the “Services”). It should be read together with our Terms and Conditions and, where applicable, our GDPR Privacy Statement.

Our role. We act as a controller for information about our own customers and website visitors — for example account, billing, and support data. When we deliver traffic, present bot Challenges, verify CAPTCHA tokens, or carry tunnel traffic for a customer’s website or application, we act as a processor on that customer’s behalf, and the customer is the controller. If you are an end user of a site that uses CDNShark, please refer to that site operator’s own privacy notice.

1. Information We Collect

• Account information — name, email address, username, password (stored in hashed form), and organization details you provide at registration.
• Billing information — billing address and transaction records. Card and payment details are handled by our third-party payment processors; we do not store full card numbers.
• Service usage and technical data — logs relating to your use of the CDN, DNS, storage, hosting, and streaming services, including IP addresses, request metadata, bandwidth and resource usage, timestamps, and error diagnostics.
• End-user data processed on your behalf — when we deliver, cache, or route traffic for your websites and applications, we may process data (such as visitor IP addresses and request details) on your behalf as a processor.
• Bot protection data — where a customer enables a JavaScript Challenge or “Under Attack” mode, we process the visitor’s IP address and browser user-agent string at the edge in order to decide whether to present a Challenge and to issue and validate a clearance cookie. See section 4.
• CAPTCHA data — where SharkCaptcha is used, we process the requesting IP address for rate-limiting and abuse prevention, the site key involved, and the challenge token presented for verification. We also maintain an aggregate count of successful solves per site. See section 4.
• Private Origin Tunnel data — for each connector you enroll we record technical and connection metadata, including hostname, operating system, architecture, connector version, public key, enrollment and last-seen timestamps, and the public IP address the connector connects from, together with session records and aggregated transfer volumes. See section 4.
• Support communications — tickets, chat messages, and correspondence with our support team, including interactions with our AI support assistant.
• Cookies and similar technologies — used to operate the site, keep you signed in, secure traffic, and understand usage.

2. How We Use Information

• To provide, operate, secure, and improve the Services;
• To authenticate you and manage your Account;
• To process payments, invoicing, and renewals;
• To provide support and respond to your requests;
• To distinguish automated traffic from human visitors, apply rate limits, and mitigate denial-of-service and other attacks;
• To establish, maintain, and meter tunnel connections between your infrastructure and our network;
• To monitor for abuse, fraud, security threats, and violations of our Acceptable Use Policy;
• To send service-related and, where permitted, marketing communications;
• To comply with legal obligations and enforce our agreements.

3. Cookies and Similar Technologies

We use strictly necessary cookies to run the Services (for example, session and authentication cookies) and may use analytics cookies to understand and improve usage. You can control cookies through your browser settings; disabling certain cookies may affect functionality.

In addition, where a customer has enabled bot protection on a hostname, our edge sets a security cookie named cdn_clearance in the visitor’s browser, scoped to that customer’s domain. This cookie records that a Challenge was completed successfully so the visitor is not repeatedly challenged. It is cryptographically signed rather than a stored identifier, is bound to a truncated form of the visitor’s IP address and a hash of the user-agent string, and expires after a short period — approximately 30 minutes in JS Challenge mode and 5 minutes in Under Attack mode. It is set for security purposes and is not used for advertising, profiling, or cross-site tracking.

4. Security and Connectivity Features

The following features process data about visitors to our customers’ sites, or about our customers’ own infrastructure. Where they operate on a customer’s traffic, we act as a processor for that customer.

4.1 Bot Protection and JavaScript Challenge

Bot protection is off by default and is enabled by a customer on a per-hostname basis. When enabled, page requests may be served an interstitial that asks the visitor’s browser to complete an automated proof-of-work computation before the request continues. Only page navigations are challenged.

To make that decision and to issue clearance, we process the visitor’s IP address and user-agent string, and we set the cdn_clearance cookie described in section 3. Customers may configure IP addresses that bypass the Challenge, and may optionally exempt verified search-engine crawlers, which are checked against published crawler IP ranges rather than by user-agent alone. We do not use bot protection data to build visitor profiles or to track visitors across unrelated sites.

4.2 SharkCaptcha

SharkCaptcha is a CAPTCHA that customers may embed in their own websites and applications, and that we also use on our own sign-in, registration, and password-reset forms. The widget issues a short-lived, cryptographically signed challenge; the visitor’s browser solves it computationally; and the resulting token is verified server-side. Tokens are valid for a short period, are single-use, and are not linked to a persistent identifier.

SharkCaptcha does not require a cookie, does not track visitors across sites, and does not collect biometric data, mouse-movement recordings, or device fingerprints. We process the requesting IP address to rate-limit challenge issuance and prevent abuse, and we maintain aggregate solve counts for each site for billing and operational purposes.

4.3 Private Origin Tunnel

The Private Origin Tunnel carries traffic between a connector that the customer installs on their own infrastructure and our tunnel gateways over an encrypted connection. Because the tunnel terminates on our network, traffic published through it passes through our gateways and, where applicable, our edge servers, in the same way as other traffic we deliver for that customer.

For each connector we record the technical and connection metadata listed in section 1, including the public IP address the connector connects from, so that we can operate, secure, troubleshoot, and meter the service. We record per-session connection records and hourly aggregated transfer volumes for billing and capacity planning. Enrollment tokens are stored only in hashed form, and access secrets configured on a route are encrypted at rest.

5. CDNShark Backup and CDNShark Sync

CDNShark Backup and CDNShark Sync are desktop applications that store files you select on our storage infrastructure. This section describes what we hold, and what we can and cannot read. It applies in addition to the rest of this Policy.

5.1 How your files reach us

Both applications communicate with our object storage directly. When you sign in, our API issues the application a scoped storage credential; file content then travels between your device and the storage service without passing through our control plane. We are the operator of that storage, and the files are held on our infrastructure.

5.2 Device and usage information

For each computer signed in, we record a device name that you choose, the IP address the sign-in came from, when the device was added and when it was last active, and a record of the access token issued to it. You can view and revoke every signed-in device from your Account at any time. Revoking a Sync device also rotates the storage credential for that workspace, so the revoked device loses access to the stored files as well as to our API.

We record the total number of bytes stored so that usage can be measured against the storage allowance included with your plan.

5.3 Encryption, and what we are able to read

CDNShark Backup encrypts file contents on your device before upload. The repository password is generated by us and stored in our systems. Your files are therefore not readable by anyone who obtains the stored data alone, but we retain the technical ability to decrypt them. We do not describe CDNShark Backup as zero-knowledge.

CDNShark Sync offers three settings, chosen once when a workspace is created and fixed for the life of that workspace:

• Standard — files are stored as supplied. We are able to read them.
• Client-side encryption — files are encrypted on your device before upload, using a key that we issue and retain. The stored data is not readable without that key, and we retain the technical ability to decrypt it.
• End-to-end encryption — the encryption key is protected by a passphrase created on your device, which is never transmitted to us. We store only a salt and the wrapped key material, neither of which we can open without the passphrase or the recovery code. We are not able to read files stored in this mode, and we are not able to reset the passphrase or recover the data.

5.4 What encryption does not conceal

In every setting, including end-to-end encryption, the following remain readable to us and to anyone with access to the stored data: file and folder names, folder structure, file sizes, timestamps, and the fact that a particular file exists. Only the contents of files are encrypted. If the names of your files are themselves sensitive, you should take this into account when deciding what to store.

5.5 Retention and deletion

Deleting a file records a deletion marker and retains a limited number of earlier versions so that the file can be restored; those versions are removed as newer ones accumulate. Changing the encryption setting of a Sync workspace erases everything stored in it, including version history, because content written under one setting cannot be read under another. Files held on your own devices are not affected. Data stored by either application is removed on account closure in accordance with the Data Retention section of this Policy.

5.6 Storage you supply yourself

CDNShark Sync can instead be configured to use S3-compatible object storage that you supply and control. Used in that way, we do not receive your files, your storage credentials, or metadata about them, and no CDNShark account is required. Your relationship in respect of that storage is with your own provider.

5.7 Access by our personnel

Access to stored customer data is restricted to personnel who require it in order to operate the Services or to respond to a support request, and is limited to what is necessary for that purpose. Where a Sync workspace uses end-to-end encryption, no level of access available to us permits the contents of files to be read.

6. How We Share Information

We do not sell your personal information. We may share it with:

• Service providers — payment processors, infrastructure and network providers, and other vendors who process data on our behalf under appropriate confidentiality and data-protection obligations;
• Legal and safety — authorities or third parties when required by law, to respond to legal process, or to protect the rights, property, or safety of CDNShark, our customers, or the public;
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

7. Data Retention

We retain personal information for as long as your Account is active and as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. Logs and diagnostic data are retained for a limited period consistent with operational and security needs, after which they are deleted or anonymized.

Content that you store using CDNShark Backup or CDNShark Sync is retained while your Account is active and for as long as you continue to store it. Within a Sync workspace, a limited number of earlier versions of each file is kept so that changes can be undone, and older versions are removed as newer ones are created. Following closure or termination of your Account, stored content is removed after any applicable retention period described in our Terms and Conditions. Where a Sync workspace uses end-to-end encryption, we are able to delete the stored data but never to read it.

Security and connectivity data is short-lived by design: clearance cookies and CAPTCHA tokens expire within minutes and are not retained as records; edge request logs are retained for a limited period; and tunnel connection records and aggregated usage are retained for as long as needed to operate the service, support billing, and investigate abuse.

8. Security

We implement technical and organizational measures designed to protect personal information against unauthorized access, loss, or misuse, including encryption in transit and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. International Transfers

We operate a globally distributed network, and your information may be processed in countries other than your own. Traffic is generally handled by the edge, gateway, or tunnel location nearest the visitor or connector, which may be outside your country of residence. Where required, we implement appropriate safeguards for such transfers, as described in our GDPR Privacy Statement.

10. Your Rights

Depending on your location, you may have rights to access, correct, delete, or restrict the processing of your personal information, to object to processing, and to data portability. To exercise these rights, contact us using the details below. Residents of the EEA or UK should also see our GDPR Privacy Statement. Where we process data on behalf of a customer as a processor, we will refer your request to that customer.

11. Children’s Privacy

The Services are not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, please contact us so we can delete it.

12. Third-Party Sites and Content

The Services may link to or interoperate with third-party sites and services. We are not responsible for their privacy practices, and we encourage you to review their policies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by additional notice.

14. Contact Us

For privacy questions or to exercise your rights, contact us at legal@cdnshark.com.