Privacy Policy
Effective 22 July 2026 · Last updated 22 July 2026
PacketProx is enterprise access software. It is deployed by an organization — typically your employer or the body that issued your access — to let approved devices reach that organization’s own applications. This policy explains what the PacketProx iOS app handles, what it cannot see, and who receives what.
The short version
- We cannot read your traffic. Not as a promise — as a property of the design. Your data passes through already encrypted, and the relay holds no key to decrypt it.
- Only the destinations your administrator assigns go through PacketProx. Everything else your device does bypasses it entirely and is invisible to the service.
- We never sell, rent, trade, or advertise against your data, and we never use it for tracking.
- There are no passwords. Access uses a passkey and a key sealed in your device’s security hardware that cannot be copied off it.
- Your organization — not CrimeiX — decides who is enrolled and what they may reach, and in most deployments holds all of the data.
1. Who this policy covers
CrimeiX LLC (“CrimeiX”, “we”) publishes the PacketProx app for iOS. PacketProx runs in one of two deployment models, and which one applies to you determines who holds your information.
| Model | Who operates it | What CrimeiX receives |
|---|---|---|
| Organization-operated self-hosted / on-premises |
Your organization runs the PacketProx server on its own infrastructure. | Nothing. Your information never reaches CrimeiX. We have no access to it and cannot retrieve, disclose, or delete it. |
| CrimeiX-operated hosted |
CrimeiX runs the deployment on your organization’s behalf. | We process the information below strictly on your organization’s instructions, as its service provider. |
When you enroll, you enter your organization’s enrollment address, and that address determines which model applies. If you are unsure which one you are on, ask your administrator.
2. Information the app handles
Enrollment identity
- Email address — you enter it to request access or to redeem an invitation.
- Name and phone number — only if your administrator supplied them when creating your invitation. The app does not read these from your device or your contacts.
- Invitation code, where your organization issues one.
Device identity and integrity
- Apple App Attest data (a key identifier and an attestation object) — used once, at enrollment, to confirm the app is genuine and running on genuine Apple hardware. This check is performed by Apple as part of iOS and verified by your deployment.
- A passkey (WebAuthn) public credential registered during enrollment.
- A public key and certificate request. The matching private key is generated inside your device’s Secure Enclave and is non-exportable — it never leaves the device, and neither CrimeiX nor your organization can extract or receive it.
- A device identifier assigned by your deployment.
Access records
For each connection carried through PacketProx, your deployment records the destination hostname, the time and duration, the source IP address, byte counts, the device and user identity, and whether the connection was allowed or denied. Your organization uses these records for security monitoring, troubleshooting, and its own compliance obligations.
On-device diagnostics
Connection status and error details are stored on your device to support troubleshooting. They are not transmitted to CrimeiX.
3. What the app does not collect
The content of your network traffic is never collected, inspected, logged, or retained. Traffic is already encrypted by the destination’s own TLS before it enters PacketProx, and it is carried inside a second encrypted tunnel. The relay holds no key to that inner layer, so the content cannot be read — by CrimeiX, by whoever operates the relay, or by anyone observing the network. This is enforced by the architecture, not by policy.
- Traffic to destinations your administrator has not assigned. Only assigned hostnames are routed through PacketProx. All other network activity on your device — personal browsing, other apps, everything else — takes its normal path and is never seen by the service.
- Passwords. PacketProx does not use them, so there are none to collect, store, or leak.
- Location, contacts, photos, camera, microphone, calendar, or health data. The app requests no such permissions and has no access to them.
- Advertising identifiers or tracking data of any kind. The app contains no third-party analytics, advertising, or tracking SDKs.
4. How information is used
Information is used only to operate the access service:
- to confirm you are eligible to enroll and to issue your device credentials;
- to authenticate your device on each connection;
- to authorize each connection against the applications your administrator has assigned to you;
- to produce the security audit records described above; and
- to revoke access when a device is lost or a person leaves the organization.
It is not used for advertising, profiling, product analytics, model training, or any purpose unrelated to providing the access your organization has configured.
5. Disclosure to third parties
We do not sell, rent, or trade personal information. We do not use or disclose data collected through the PacketProx VPN service to any third party for any purpose other than operating the service, and we never use it for advertising, marketing, profiling, or tracking.
Information is shared only in these limited circumstances:
- With your organization. Your enrollment identity and access records are visible to your organization’s administrators. This is the purpose of the product: your employer is providing and overseeing this access.
- With Apple. App Attest verification is performed by Apple as a function of iOS. Apple’s handling of that data is governed by Apple’s own privacy policy.
- With service providers (hosted deployments only). Infrastructure and email-delivery providers acting on our instructions under contract, and only as needed to run the service.
- Where required by law. We will disclose only what is legally required, and will notify the affected organization unless prohibited. In organization-operated deployments we hold no data and therefore have nothing to disclose.
6. Retention
- Organization-operated deployments: retention is entirely determined and controlled by your organization. CrimeiX holds no copy.
- CrimeiX-operated deployments: enrollment records are retained for as long as the account is active. Access records are retained for the period your organization configures, and where it configures none, for a default of one year, after which they are deleted.
- Device certificates are deliberately short-lived and expire automatically; revoked credentials stop working within seconds.
7. How information is protected
- Device private keys are generated in, and never leave, the Secure Enclave.
- All connections use TLS 1.3 with mutual authentication; both sides prove their identity.
- There is no password anywhere in the system to be phished, guessed, or reused.
- Access can be revoked instantly, cutting live connections rather than only future ones.
- Every authorization decision is recorded in an audit trail.
8. Your rights and choices
You may request access to, correction of, or deletion of your personal information.
- Start with your organization’s administrator. They control the deployment, decide who is enrolled, and in self-hosted deployments hold all of the data. They can revoke your enrollment and delete your records.
- For CrimeiX-operated deployments, you may also contact us at the address below. Because we act on your organization’s instructions, we may need to refer your request to them.
- Removing the app deletes the credentials stored on your device. Ask your administrator to revoke the enrollment on the server side as well.
If you are in the EEA or the UK, you have rights of access, rectification, erasure, restriction, portability, and objection, and may complain to your supervisory authority. If you are a California resident, you have the rights described under the CCPA/CPRA; note that we do not sell or share personal information as those terms are defined by that law.
9. Children
PacketProx is enterprise software issued to adults by an organization. It is not directed to children, and we do not knowingly collect personal information from anyone under 13 (or under 16 in the EEA).
10. Changes to this policy
If this policy changes we will post the revised version at this address and update the effective date above. Material changes affecting how information is used will be communicated to the organizations operating PacketProx deployments.
11. Contact
CrimeiX LLC
2583 Hayden Pl
Medford, OR 97504
United States
privacy@packetprox.com