Privacy.
This describes the behavior of this implementation, including what stays in your browser and what reaches the server.
No user accounts
FreeSSL has no login, registration, profile, payment flow, or user database. Visitors are not asked for an email address. The operator's ACME account email is separate from visitor use.
Certificate private keys
Your ECDSA P-256 or RSA 2048 certificate key is generated using Web Crypto in your browser. A signed certificate signing request (CSR), containing the public key and requested domain names, is sent to the server. The certificate private key is not sent to the API, stored in Redis, or written to localStorage or sessionStorage. Downloads and ZIP packaging happen in the browser.
The key remains in browser component memory until the page is discarded or a new request is started. JavaScript cannot guarantee physical memory erasure, and browser extensions or a compromised device may access page data. Download your files before closing, refreshing, or navigating away. We cannot recover a lost key.
Temporary order data
The server stores domain names, the public CSR, ACME order references, challenge metadata, timestamps, an ownership-token hash, status, and issued public certificates in Redis. Records expire automatically after the configured order lifetime, normally 30 minutes. Updating or checking an order does not extend that lifetime. Expiration removes live Redis records; Redis persistence, backups, filesystem snapshots, or host-level backups may retain older bytes according to the operator's retention settings.
Cookies and preferences
An HttpOnly, SameSite=Strict cookie proves ownership of an anonymous order and expires with it. It is marked Secure when the site uses HTTPS. The theme preference is stored locally in your browser. There are no advertising or analytics scripts in this implementation.
Rate limits and operational logs
The reverse proxy necessarily processes connection IP addresses. Application rate limiting uses a keyed hash of the IP address, grouping IPv6 addresses by /64, with expiring counters. Application logs include request IDs, operations, durations, HTTP statuses, and error codes. They do not include request bodies, private keys, ACME account keys, ownership cookies, or raw exception messages. The supplied Nginx configuration disables access logs. Hosting providers and other infrastructure may keep their own logs; the operator controls those retention policies.
Public certificate information
Let's Encrypt receives the CSR, requested domains, and challenge responses. It independently validates domain ownership. Production certificates are publicly logged in Certificate Transparency, including their domain names. Do not request a certificate expecting those names to remain secret. Let's Encrypt operates under its own privacy policy and subscriber agreement.
Network checks
DNS challenges may be checked through the system resolver, Cloudflare (1.1.1.1), and Google Public DNS (8.8.8.8), without cloud accounts or API keys. SSL and security checks contact the specified public website and its DNS servers. Remote operators and DNS resolvers may log these queries. Reports are not stored as user profiles.
Server-managed ACME account
The server has its own private ACME account key, stored in a restricted persistent directory. That key authorizes CA account operations; it is different from your certificate key. It must be protected and backed up by the operator.