Last Updated: March 20, 2026
The ClashX website (clashx.tech), hereinafter referred to as "this Website," "we," "us," or "our," is committed to respecting and protecting the privacy of every visitor. ClashX is an open-source proxy configuration tool for macOS. This Privacy Policy explains how we collect, use, disclose, store, and safeguard information when you visit and interact with this Website.
This Privacy Policy applies solely to information collected through this Website. It does not govern data processed by the ClashX desktop application, which operates entirely on your local device and does not transmit data to us.
By accessing or using this Website, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, please discontinue use of this Website.
When you visit this Website, we may collect the following categories of information through automated means:
We maintain a strict no-log policy with respect to the ClashX application and your broader internet activity. Specifically:
The limited data we collect through this Website is used exclusively for the following purposes:
Understanding visitor behavior in aggregate to improve site content, navigation, and user experience. We use GA4 with IP anonymization enabled.
Diagnosing errors, preventing abuse, maintaining security, and ensuring the Website remains available and performant for all users.
Displaying contextual and personalized advertisements through Google AdSense to fund Website hosting and development costs.
Complying with applicable laws, responding to lawful requests from public authorities, and protecting our legal rights.
For visitors in the European Union (EU) and European Economic Area (EEA), we process personal data under the following legal bases as defined in GDPR Article 6(1):
Analytics and advertising cookies are only activated after you provide explicit consent via our cookie consent mechanism. You may withdraw consent at any time.
We process minimal technical data (server logs, security monitoring) based on our legitimate interest in maintaining a secure, functional website. This interest is balanced against your rights.
We may process data when required to comply with applicable legal obligations, such as responding to lawful requests from supervisory authorities.
Essential cookies (such as theme preference storage) are processed under legitimate interest as they are strictly necessary for the Website to function as requested by you and do not require consent under the ePrivacy Directive.
This Website integrates the following third-party services. Each service operates under its own privacy policy and may collect data independently:
Purpose: Aggregate website traffic analysis, user engagement metrics, and content performance measurement.
Data Collected: Anonymized IP, pages visited, session duration, device and browser metadata, geographic location (country/city level), and engagement events.
Data Processing: IP anonymization is enabled by default. Data is processed by Google LLC in the United States under Standard Contractual Clauses (SCCs).
Retention: User-level data is retained for 14 months and then automatically deleted.
Privacy Policy: Google Privacy Policy
Opt Out: Install the Google Analytics Opt-out Browser Add-on, or decline analytics cookies via our consent banner.
Purpose: Display advertisements to support Website operational and hosting costs.
Data Collected: Cookie identifiers, browsing interests (if personalized ads are consented to), device information, and ad interaction data.
Personalization: Ad personalization depends on your consent. Without consent, only contextual (non-personalized) ads are served.
Privacy Policy: Google Advertising Privacy Policy
Ad Settings: Manage personalization at Google Ad Settings. You can also opt out of personalized advertising via DAA Opt-Out or EDAA Your Online Choices.
Purpose: Hosting our open-source repository, issue tracking, and community engagement.
Data Collected: When you click links to our GitHub repository, you leave this Website and become subject to GitHub's data practices. We do not receive personal data from GitHub.
Privacy Policy: GitHub Privacy Statement
Scope: Some pages on this Website contain affiliate links to the following partners. Clicking these links may result in the partner placing tracking cookies or identifiers for attribution purposes.
Purpose: Referral source identification, commission calculation, fraud prevention, and campaign performance analysis. You are never charged extra for using an affiliate link.
Partners & Their Privacy Policies:
Cookie Consent: Non-essential affiliate tracking cookies are only activated after you provide consent where required by applicable law.
We do not sell, rent, or trade your personal information. We may share limited data only in the following circumstances:
This Website is accessible globally, and data collected through third-party services (particularly Google Analytics and Google AdSense) may be transferred to and processed in countries outside your country of residence, including the United States.
Where personal data of EU/EEA residents is transferred outside the EEA, we ensure appropriate safeguards are in place, including:
For transfers of UK personal data, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, ensuring compliance with UK GDPR requirements.
We implement appropriate technical and organizational measures to protect data processed through this Website:
All connections to this Website are encrypted via HTTPS (TLS 1.2+). HSTS headers enforce secure connections.
We deploy X-Content-Type-Options, Referrer-Policy, and other security headers to mitigate common web vulnerabilities.
Administrative access to hosting infrastructure is restricted to authorized personnel with multi-factor authentication.
GA4 anonymizes IP addresses by default, ensuring full IP addresses are never stored in our analytics data.
We collect only the minimum data necessary for stated purposes and retain it only as long as needed.
We periodically review and update our security practices to address evolving threats and industry standards.
If you are located in the European Union or European Economic Area, the General Data Protection Regulation (GDPR) grants you the following rights regarding your personal data:
Request a copy of the personal data we hold about you and information about how it is processed.
Request correction of inaccurate or incomplete personal data we hold about you.
Request deletion of your personal data when it is no longer necessary for the purpose it was collected, or when you withdraw consent.
Request that we limit the processing of your personal data under certain circumstances (e.g., while verifying accuracy).
Receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
Object to processing based on legitimate interest or for direct marketing purposes at any time.
Automated Decision-Making: We do not engage in automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with specific rights regarding your personal information:
Request disclosure of the categories and specific pieces of personal information we have collected, the sources, business purposes, and categories of third parties with whom we share it.
Request deletion of personal information we have collected from you, subject to certain legal exceptions.
Request correction of inaccurate personal information that we maintain about you.
Direct us not to sell or share your personal information for cross-context behavioral advertising purposes.
Global Privacy Control (GPC): We honor GPC signals transmitted by your browser. When detected, we will treat this as a valid opt-out request for the sale/sharing of personal information.
Sensitive Personal Information: We do not collect sensitive personal information as defined under the CPRA (e.g., Social Security numbers, financial account credentials, precise geolocation, biometric data).
India's Digital Personal Data Protection Act, 2023 (DPDP Act) grants rights to individuals (referred to as "Data Principals") whose personal data is processed. The DPDP Act is expected to become fully effective by May 2027, with rules currently being finalized. We proactively commit to the following:
You have the right to obtain a summary of the personal data being processed about you and the processing activities.
You may request correction of inaccurate or misleading data, completion of incomplete data, updating of outdated data, and erasure of data no longer necessary for its original purpose.
You have the right to a clear mechanism for raising grievances related to data processing, and to receive a timely response.
You have the right to nominate another individual to exercise your rights on your behalf in case of death or incapacity.
Consent: Under the DPDP Act, we process personal data of Indian residents based on consent provided through our cookie consent mechanism. Consent may be withdrawn at any time, and we will cease processing within a reasonable period following withdrawal.
We respect the privacy rights of users worldwide. Below is jurisdiction-specific information for other regions:
Following Brexit, the UK operates under its own data protection framework (UK GDPR and the Data Protection Act 2018). UK residents enjoy substantially the same rights as described in Section 11 (GDPR Rights), including the rights of access, rectification, erasure, restriction, portability, and objection.
Supervisory Authority: You may lodge complaints with the Information Commissioner's Office (ICO) at ico.org.uk.
International Transfers: See Section 9.2 regarding UK-specific transfer safeguards.
Australian residents are protected under the Australian Privacy Principles (APPs) contained in the Privacy Act 1988. You have the right to:
Supervisory Authority: You may lodge complaints with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
Canadian residents are protected under the Personal Information Protection and Electronic Documents Act (PIPEDA). You have the right to:
Supervisory Authority: You may lodge complaints with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.
This Website is not directed at children under the age of 16 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal data from children.
We comply with the US Children's Online Privacy Protection Act (COPPA), the GDPR's provisions on children's consent (Article 8), the UK Age Appropriate Design Code, and other applicable laws protecting children's privacy. Google AdSense on this Website is configured to not serve personalized ads to users identified as minors.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make changes:
Your continued use of this Website after any changes to this Privacy Policy constitutes your acknowledgment and acceptance of the updated policy. If you disagree with any changes, please discontinue use of this Website.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, or if you wish to exercise any of your data protection rights, please contact us through the following channels:
Within 30 days, extendable by 60 days for complex requests.
Within 45 days, extendable by 45 additional days with notice.
Within 90 days, or as prescribed by final DPDP rules.
Within 30 days, extendable by 60 days for complex requests.
For all other jurisdictions, we will respond within a reasonable period, typically no longer than 30 days.