Privacy Policy

Updated October 25, 2026 · Covers the ShadowX V2 userscript & shadowx.fyi

The short version

No IPs, no usernames, no accounts, no trackers. We identify requests by random ID only.
The only logs are request records (30 days) and request IDs (45 days) — both auto-delete.
Logs exist only to debug routing errors. Never aggregated, profiled, or sold.
We never sell or share data. There is no advertising model — and never will be.
Uninstalling the script or clearing site data removes everything on your side.

How a request works — and who sees what

1Your browserThe script runs locally. Your Duolingo login stays in your cookies — we never receive your password or session.

↓

2Our serverReceives only the job (e.g. “farm 100 XP”) tagged with a random request ID. Keeps a record for 30 days, then auto-deletes.

↓

3TOR networkEncrypts each hop. Nobody in the middle — not even us — can read the payload.

↓

4Exit proxyOne of 35 rotating IPs talks to Duolingo. Your real IP is never exposed — we don't collect it in the first place.

↓

5Back to youThe result returns through the same chain. A username-free summary is posted to our private Discord for monitoring.

⎋ What we keep (briefly)

Request records — /dev/null, 30 days, auto-deleted
Request IDs — /root/debug/ids, 45 days, auto-deleted, random (no account data)
Anonymous totals — lifetime XP / gems / streaks / success counts shown on /status. Aggregate numbers only.
Why? Debugging failed relays & verifying requests route correctly through TOR-over-Proxy. Nothing else.

✔ What we never touch

Your IP address — not logged, not stored, not looked at
Your username — stripped from every log and Discord entry
Your password / session — stays in your browser, never transmitted to us
Trackers & analytics — no third-party scripts load from shadowx.fyi

Discord monitoring logs

Each processed request posts a one-line summary to a private monitoring channel. Here is the exact split:

✔ Included	✖ Never included
Proxy IP used for that request	Your username
Action type (XP / gems / streak)	Your account ID
Amount, duration, success/fail, error text	Your IP address
Your public Duolingo profile picture	Credentials or session data

On your device

The script stores settings and your usage counters (XP/gems/streak timers) in localStorage under SX_STATE. This never leaves your device. Clearing site data or uninstalling wipes it instantly — and since we hold no account, there is nothing else to delete server-side.

Anonymous Data toggle: Settings → Anonymous Data only controls an optional version-check ping. Turn it off anytime; nothing else changes.

Third parties & selling

The only third parties that ever touch traffic are the TOR network and our proxy providers — and they only see encrypted relay traffic tied to a random ID. We never sell data to anyone, ever. No advertising, no brokerage, no “trusted partners” — that model doesn't exist here and never will.

Honest disclaimers

We can't prevent bans. Duolingo still holds your official account ID on their side — TOR-over-Proxy hides your network traffic, not your account from their own systems. Desktop only, no mobile support. Automating Duolingo may violate their Terms of Service — use at your own risk. Not affiliated with Duolingo, Inc. Not directed at children under 13 (and we collect no personal data from anyone, of any age).

Policy changes

If what we collect ever changes, this page and the date above update with it. The promise stays fixed: collect almost nothing, auto-delete what exists, never sell, never track.