The short version
- This website
- An analytics provider counts visits with first-party cookies; its advertising features and cross-device tracking are off, and it does not load when your browser sends Global Privacy Control or Do Not Track. The form on the home page sends nothing. Accounts are made in the customer app, not here. Nothing here tracks you across other sites.
- Sign-up
- Your legal name, a US address, a mobile number proved by a texted code and your email, screened against the US sanctions lists. No date of birth, ID number or tax ID. Kept while your account is open and 5 years after it closes, or 10 after a possible sanctions match or a person’s refusal. An account never verified closes after 90 days with no activity.
- Traffic
- Connection records (time, line, the address each connection came from, destination host and port, and bytes) for 90 days. Never the content.
- Texts and calls
- Bodies, transcripts and codes encrypted at rest, and kept 30 days by default. Codes cleared after 15 minutes. A line nobody holds keeps no text and no caller.
- Staff access
- Every staff view of a text or call is logged. Support staff don't see codes or message bodies by default.
- Your records
- Ask for a copy, a correction or a deletion, and Ostra answers within 45 days.
- Selling data
- Ostra does not sell personal information.
5.1Who is responsible
Ostra LLC runs ostranetwork.com and the Ostra service. Questions about this policy: hello@ostranetwork.com.
5.2This website
These pages use an analytics provider’s script and first-party cookies to count visits and see which pages are read. Its advertising features and cross-device tracking are off. For each page view the provider gets the page, the page you came from, a rough location and your type of device. The provider does not store visitors’ IP addresses, and the data is kept for 2 months. Nothing else on these pages loads from another site. The form on the home page sends nothing: it opens an email in your own mail app, and Ostra receives only what you choose to send.
How these pages answer Do Not Track: when your browser sends Global Privacy Control or Do Not Track, the analytics script does not load and no analytics cookie is set. That is how to opt out. Ostra does not track visitors across other websites, and no other company collects information through these pages about what you do across sites.
“Create an account” takes you to the customer app at app.ostranetwork.com, which is not one of these pages. What you give it when you sign up is kept as 5.3 describes.
These pages are served from Ostra’s own app server in the United States. The server writes nothing about a visit to its disk. To limit how many requests one address can make, the server holds a visitor’s address in memory for a 10-second window and drops it within a second after, so for about 11 seconds at most.
The server’s log gets no line for any page it serves. It records only how many requests the limit turned away each minute, with no address. For a request it refuses because it is malformed or sent to the wrong name, it records the reason, the name asked for and the Host header sent, with no address, at most 60 a minute.
5.3What Ostra keeps about customers
- Sign-up records: your full legal name and, for a business, its legal name; your US address; your email; your mobile number, each code asked for it with the address it was asked from, and the number’s line type and carrier as Ostra’s calls and messaging provider reports them. The address and country your sign-up came from, and the result of the sanctions screen, with any listing that came close. The statements you make (that you are 18 or older, and that you accept the acceptable use policy in force), each with the time, the address it came from and your browser. If a person at Ostra reviews your sign-up, their decision and their notes. Ostra keeps sign-up records while your account is open and for 5 years after it closes, then deletes them, unless you ask for them to be deleted sooner (5.9). If the sanctions screen found a possible match on a sign-up, or a person at Ostra refused it, its account’s sign-up and account records are kept 10 years after the account closes instead of 5, as a caution under the US sanctions rules on keeping records; a deletion you ask for still removes them (5.9). An account that was never verified (its sign-up never finished, or refused) and never held a line is closed 90 days after the last activity on it: the refusal, the last change to its sign-up, the last time any person on it signed in or used the dashboard (for any account they are on), or the last use of one of its API keys or app sign-ins. Its records are then kept as any closed account’s are. You can ask for it to be closed sooner.
- Ostra does not ask for a date of birth, a government ID or its number, or a tax ID, and keeps no copy or photo of any document. Those given before 15 October 2026 were deleted from Ostra’s database on 16 October 2026, and the backups that held them expire within 7 days of that.
- Your account’s records, kept and deleted with the sign-up records: the people on it and their roles; each line’s and each order’s stated purpose; the addresses you list for a line’s SOCKS5 and HTTP ports; any blocked site Ostra opened for a line; and the names your organization gives the numbers that text or call its lines. Sender names are shown only to your organization, and each one set or removed is in the audit log by a keyed hash of the number, never the number.
- Your sign-in: Ostra emails a code each time you sign in. Each signed-in session keeps the address it came from and your browser, until 30 days after it ends. If you turn on two-step sign-in, Ostra keeps your authenticator app’s secret encrypted, and your backup codes only as keyed hashes. A person who is on no account any more has their email and sign-in deleted 5 years after their last sign-in.
- Billing records: each line’s subscription, your invoices and your payments as Ostra recorded them, and for each billed call its minutes, its line and its day. A call’s own record goes after 30 days (5.4), and once its minutes are reported the billing record keeps no caller and no call id of the provider’s: only its minutes, its length in seconds, its line, its day, and when Ostra counted it, minutes after the call ended. Kept while your account is open and for 7 years after it closes, for tax, then deleted. Stripe holds your card and billing address; Ostra never sees the card number.
- Your consent to a line’s renewal terms: the terms exactly as shown, the time, the address it came from and your browser. Kept 3 years after you consent, or 1 year after your account ends if that is later, as the terms say, then deleted.
- Emails you send Ostra, including requests for access and abuse reports.
- The audit log: who did what and when, on your account and at Ostra, such as sign-ins, approvals, changes to settings and each staff view of a text or call. It is never deleted. It never holds the body of a text, a code or a secret. It keeps no address, email or phone number either: where one is needed to match entries, Ostra writes a keyed hash of it, which only Ostra’s own server key can match to an address, and any other it finds, even in a note typed by staff, is removed before the entry is written.
5.4What Ostra records about a line's use
| Record | What it holds | Kept |
|---|---|---|
| Connection records | Time, line, the address each connection came from, destination host and port, and bytes for each connection, and how it ended. A connection Ostra refused for where it came from also records that address’s country. No content. The gateway’s own copy also holds the request’s method and status, which proxy credential or Ostra app device it used and, for a refusal by place, the region; it is deleted 2 days after its day ends once Ostra’s app server has every record in it, and never kept more than 90 days after the day it was written. | 90 days |
| Texts received | Sender, body, time received, and the code Ostra reads from it. The body and the code are encrypted at rest; the sender is not, though the disks it is on are. An iMessage’s sender can be an email address. A text’s notice to your webhooks holds its sender and time, never the body, and is kept 30 days, longer only while it is still being delivered. The daily test text Ostra’s calls and messaging provider delivers to a quiet line for Ostra is kept the same way and never shown to you. | 30 days by default; the code, 15 minutes |
| Calls received | The caller’s number when the carrier passes it on, as Ostra’s calls and messaging provider reports it with its caller-ID check; when the call came in and ended, and how it ended; the keys the caller pressed in its first 8 seconds, and the code Ostra reads from them. On a line with transcription turned on, also the spoken digits and the voicemail, as text. The keys, the transcript and the code are encrypted at rest; the caller’s number is not. | 30 days by default; the code, 15 minutes |
| Sign-up and account records | As in 5.3. | While the account is open, and 5 years after it closes (10 after a possible sanctions match or a person’s refusal) |
| Billing records | As in 5.3. | While the account is open, and 7 years after it closes |
| Renewal consents | As in 5.3. | 3 years, or 1 year after the account ends if that is later |
| Signed-in sessions | The address each came from and the browser. | 30 days after the session ends |
| Audit log | As in 5.3. | Not deleted |
Ostra never records the content of proxy traffic: no pages, no request or response bodies.
A line nobody holds keeps no text: a text to it is not stored, and a call to it is refused and its caller not kept (only that a call came, and when, for 30 days). Ostra’s own test texts are the one exception. So when your line ends, its number is deleted with it: from then on Ostra’s servers keep no text sent to it and no caller’s number, Ostra releases it at the carrier when it turns the line over, and never gives it to another Ostra customer. The phone itself keeps its texts until it is erased, which is done before the line goes to anyone else.
Calls
Ostra does not record calls. If spoken-digit transcription is turned on for a line, callers hear an announcement before anything is captured. Each line forwards its calls to a number of its own at Ostra’s calls and messaging provider, and Ostra rings the Ostra iPhone app and the dashboard. With transcription on, a caller nobody answers can leave a voicemail: Ostra stores its text, then deletes the recording and its transcription at that provider, so the only copy is Ostra’s. If a deletion there fails, Ostra keeps trying, and keeps the call’s record, without its content or caller after its 30 days, until it works.
A FaceTime call to a line’s number rings the wall phone itself and never reaches Ostra’s calls and messaging provider or the Ostra apps. Ostra keeps no record of it; the phone lists it among its recent calls, which Ostra does not read, until the phone is erased when the line is turned over.
The line check page
Anyone can open Ostra’s check page at check.ostranetwork.com. The check server keeps the address you arrive from in its memory only: for a minute or two, for its limits per address; for ten minutes with the DNS check’s result, and for an hour at most among the last 10,000 connections it records for Ostra’s own network tests, which Ostra staff can read. It writes no visitor’s address to its disk, and the results Ostra keeps from those tests hold no visitor’s address: only connections from Ostra’s own gateway. What the page shows about your browser is worked out in your browser.
The browser extension
The Ostra browser extension sends one browser's traffic through your line's proxy port, so Ostra keeps the same connection records for it as for any other use of the line: time, line, the address each connection came from, destination host and port, and bytes, for 90 days. The extension sees the address of each request it routes and nothing on the pages themselves. It keeps your sign-in and the line's credential in the browser's memory only, gone when the browser closes or you sign out, and saves on your computer which line you chose and whether it is on. To show where the line leaves from, it asks Ostra's check server, which records the address the request arrived from: the line's. Beyond the connection records, it sends Ostra nothing from the pages you open and nothing else about your browsing.
The Ostra apps
The Ostra apps for iPhone and Mac send a device’s traffic through your line the same way, so Ostra keeps the same connection records for it. For each device Ostra keeps its name, its kind, its key and when it was added and, if you turn notifications on, the token the push notification service built into iPhone and Mac gives the app for them, encrypted. These are kept with your account’s records; when those are deleted, or you are deleted from an account that stays open, the device’s name and tokens go and its key stays, so a removed device is never connected again. A notification of a new text or call carries its code only if you turn that on in the app. So that calls ring it, the iPhone app registers with Ostra’s calls and messaging provider, which holds the token the push notification service gives the app for incoming calls; Ostra keeps when the app last registered, with the device. A browser set to ring in the dashboard asks for the microphone, which a call needs, and renews a registration at Ostra every five minutes while the dashboard is open. Ostra keeps the record of it until ringing is turned off there or you sign out, or else until 30 days after that sign-in ends.
5.5Who can see it
You can see your own lines' records. Ostra staff see them only to run the service, answer abuse reports and meet legal duties. Every staff view of a text or call is logged, a list of a line’s senders or callers included, and support staff see no codes or message bodies by default. Ostra's admin systems are reachable only on its private network, and every person on Ostra’s staff signs in to them with two steps: a staff token and a code from an authenticator app. The one exception is the service accounts Ostra’s own machines use, which can read line health and the fleet view and nothing else.
Ostra’s servers are also administered directly, over the same private network with a key, by Ostra’s owner. That access can read the database, and the keys that decrypt texts and calls are on the server. It is used to run and repair the service. The changes made through Ostra’s own staff commands, and their views of texts and calls, are in the audit log; a direct read of the database is not.
5.6Who else handles it
- A hosting provider that runs Ostra’s servers in the United States.
- A calls and messaging provider, which texts the code that proves your mobile number at sign-up, says whether the number is a mobile line and which carrier it is on, and delivers the daily test text to a quiet line. It also answers the calls forwarded from a line: it takes the keys the caller presses and rings the Ostra iPhone app and the dashboard, and on a line with transcription turned on it turns spoken digits and a voicemail into text. Ostra then deletes the voicemail’s recording and transcription there. It keeps its own record of the calls and texts it handles, under its own policy.
- No outside identity-verification company. The sanctions screen runs on Ostra’s own servers against the US government’s sanctions lists, downloaded to them, and no name leaves them. Where an address is placed is looked up in a location database kept on Ostra’s own servers; no address leaves them.
- Stripe, which takes card payments and holds your card and billing address. Ostra never sees the card number.
- An email delivery provider, which delivers the email Ostra sends: sign-in codes and notices about your account, lines and billing.
- The push notification service built into iPhone and Mac, which carries notifications to the Ostra apps.
- An alerting provider, which carries Ostra’s alerts about its own service to its staff’s phones. An alert names lines, accounts and records by their ids, and never holds a text, a call’s content or a code.
- An analytics provider, which counts visits to these website pages and which pages are read (5.2). It does not store visitors’ IP addresses, keeps the data 2 months, and does not load when your browser sends Global Privacy Control or Do Not Track.
- A security provider’s bot check on the customer app’s sign-up pages: it reads your browser’s signals to check that a person is signing up, and gives Ostra only a pass or a fail. These website pages still load nothing from that provider.
- An email provider that holds email sent to Ostra’s addresses.
Ostra does not sell personal information or share it for advertising.
5.7Holds and legal requests
Scheduled deletion, and a deletion you ask for, stop for records under a hold: an open abuse case or a lawful preservation request. A code read from a text or a call is still cleared after 15 minutes: the held text or call keeps the digits it was read from. Ostra discloses records to law enforcement as 3.9 describes.
5.8Security
Texts, call transcripts and the codes read from them are encrypted at rest. So is an authenticator app’s secret. Proxy secrets and backup codes are kept only as keyed hashes. A text’s sender and a caller’s number are not encrypted in the database. The servers’ disks are encrypted.
The keys that decrypt texts and calls are on Ostra’s app server, which needs them to work, and a copy of each is kept off the servers, with Ostra’s owner. The app server’s backups, which hold customer data, are encrypted and kept on a second Ostra server, which does not hold their keys: those are on the app server, with the same copy off the servers. Each of them is deleted once it is 7 days old, whether or not the backups after it worked. Ostra’s gateway and control server back up their own settings and keys the same way, encrypted on another Ostra server, and hold no customer data or visitor addresses in them. The gateway’s are deleted once they are 7 days old; the control server’s are kept 30 days, and the last one of each month for 6 months.
You can turn on two-step sign-in with an authenticator app, and an account’s admins can require it for everyone on the account.
5.9Your choices
Ask for a copy of what Ostra holds about you, a correction or a deletion by email to hello@ostranetwork.com. Records under a hold, and records Ostra must keep by law, stay until the hold or the duty ends.
These are your rights wherever you live, California included: to know what personal information Ostra holds about you and get a copy, to have it corrected, and to have it deleted. Someone you authorize can ask for you. Ostra confirms who is asking before it acts: the request comes from the email on your account, or you confirm it from there, and for a deletion or a copy of your texts and calls you also give one detail from your sign-up or your account. Ostra answers within 45 days, sends a copy only to the email on your account, and never treats you differently for asking. Ostra does not sell personal information or share it for cross-context behavioral advertising.
A deletion: Ostra closes your account first if it is open, so your lines end and their numbers with them. It then deletes your texts, calls and connection records, your sign-up and account records, your sign-in record and sessions, your webhooks and sender names and your lines’ settings, clears the names of your keys, devices and credentials, and in the audit log replaces your email, your numbers and your addresses with keyed hashes. Ostra keeps what the law or the terms need: billing records until 7 years after the account closes, your renewal consents for their period (5.3), and which line your account held and when, under the account’s id. If you are one of several people on an account that stays open, you are removed from it, the devices you added to it are disconnected, and its acceptances and phone checks keep no address or browser of yours; its own sign-up record and renewal consents keep what was given for them, for their own periods. Copies elsewhere end on their own clocks: backups within 7 days, the gateway’s copy of connection records within 90 days, the wall phone when it is erased at the line’s turnover, and Ostra’s providers keep their own records under their own policies.
5.10Changes to this policy
When this policy changes, the date at the top changes and customers are told by email.