Effective date: October 17, 2026
This policy explains what Default Deny LLC ("Allowist", "we", "us") collects when you use Allowist, why, how long we keep it, and the choices you have. It applies to the website, the dashboard, the agents, the Allow Link and Allow URL pages, and support.
Account data. Your email address, the name you set in your profile, your organization's name, your role, sign-in method (password, Google, Microsoft or SAML), the time of your sign-ins, and the address they came from. If you sign in with Google or Microsoft we receive the identifier, email address, display name and profile picture those providers share; a name you set in Allowist is not overwritten by the provider's name.
Agent data. For each device running an agent: hostname, public IPv4 and IPv6 addresses, operating system, agent type and version, a stable device identifier (the Windows machine GUID, Linux machine-id or macOS platform UUID), the address the check-in actually came from, and the time of each check-in. Agents send nothing else: no files, usernames, browsing or traffic data.
List data. The addresses, hostnames and URLs on your lists, their labels and expiry, the sources you subscribe to, and your exclusions.
Allow Links and Allow URL. When someone uses an Allow Link or an Allow URL page, we record the address(es) added, the time, the email address the link was issued to (if any), and whether the address was verified by our probe.
Feed access. When a firewall fetches a list we record the fetching address, the format requested, the result and the client software identifier, so you can see which devices are polling your lists.
Audit log. Who did what and when inside your organization: list changes, agent events, sign-ins, settings changes, invitations and token use.
Billing. Subscriptions are processed by PayPal. We store your plan, subscription identifier and billing status; we never receive your card or bank details.
Support. Messages you send through the support form or by email, and the address they were sent from.
Website. Our website and dashboard use only essential cookies: a session cookie so you can stay signed in, and Cloudflare's security cookies. We do not use advertising or cross-site tracking cookies, and we do not sell data.
We rely on the performance of our contract with you for most of this, on our legitimate interest in keeping the service secure for the security measures, and on your consent where we ask for it (for example, product emails you can opt out of).
We use a small number of providers to run Allowist, each only for the purpose named:
We do not sell personal data and do not share it with advertisers. We disclose data to authorities only where the law requires it, and we will tell you unless we are prohibited from doing so.
No system is perfectly secure. If we learn of a breach affecting your data we will notify you without undue delay.
You can view and change your profile and organization settings in the dashboard, export your organization's data and audit log on plans that include export, and delete your organization yourself. Depending on where you live you may also have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to complain to a supervisory authority. To exercise these rights, use the Support page; we respond within 30 days.
Allowist is operated from the United States and your data is stored there. If you use the service from elsewhere, you accept that your data is transferred to and processed in the United States.
Allowist is a business service and is not directed at children under 16. We do not knowingly collect their data.
We may update this policy. Material changes are announced in the dashboard or by email at least 14 days before they take effect. The effective date at the top tells you when it was last changed.
Privacy questions or requests: the Support page at allowist.com/support.html, or write to Default Deny LLC, Portland, Oregon, USA.