Supplier guide · how it works
What traffic goes through my device?
Customer web sessions. The peer software keeps an outbound connection to a PROXIES.SX relay; when a customer is routed to your device, it opens a TCP connection from your IP to the website they asked for and passes the bytes back. HTTPS stays encrypted between the customer and the website. Below is exactly what runs, what it can access, what we cannot promise yet, and how to remove it.
Checked on against our published supplier terms
The path a request takes
Connections the software makes
| Connection | Direction | Details |
|---|---|---|
| Registration and token refresh | Outbound HTTPS to api.proxies.sx | Returns a device ID, a token valid for 1 hour, a refresh token valid for 7 days, the assigned relay and the live rate |
| Relay connection | Outbound WebSocket (wss) to a regional relay | The token is sent in the Sec-WebSocket-Protocol header. The device sends a heartbeat every 30 seconds; 120 seconds of silence closes it |
| Relay changes | Outbound only | The Android SDK honours a relay redirect only to *.proxies.sx wss addresses, at most once every 60 seconds |
| Customer tunnels | Outbound TCP from your device to the destination | Opened on a tunnel_connect instruction and framed in binary-v1 over the relay connection |
| Public IP lookup (Android) | Outbound HTTPS to api.ipify.org | The Android SDK asks this third-party service for the device's public IP and sends it with its device information |
| Inbound ports | None reachable from your network | No port forwarding or router change is needed. The Android SDK 1.3.2 also listens on 127.0.0.1:8888, which is local to the phone only |
Encryption
For HTTPS sites, the tunnel carries the customer's TLS session to the website unchanged, so the content is encrypted end to end between the two and is not readable on your device or at the relay. Plain HTTP requests are not end-to-end encrypted.
On Android, the SDK stores its credentials with AES-256-GCM through the Android Keystore. On Linux, the key lives in /etc/proxies-peer/peer.env with mode 0600.
What it can access on each platform
| Platform | Runs as | Access |
|---|---|---|
| Linux (Go 1.6.1) | A systemd dynamic unprivileged user | No capabilities, read-only system directories, no home directories, only IPv4, IPv6 and Unix sockets |
| Windows (Node.js 1.6.0) | Your user, in a console window, or as a service if you install it with NSSM | A Node.js process running peer.js; you can read every line of the script |
| Android (SDK 1.3.2) | A foreground service of type dataSync, inside the host app | Declares INTERNET, ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE, FOREGROUND_SERVICE, FOREGROUND_SERVICE_DATA_SYNC, WAKE_LOCK and READ_PHONE_STATE (the manifest comment gives the reason as carrier information) |
What we cannot promise yet
Your local network. We have not published a verified control that stops customer tunnels from reaching private addresses on your network. Until we do, run the peer on an isolated or guest network, separate from printers, cameras, storage and other local devices.
Who the customer is. This page does not describe how customers are vetted, and supplier declarations are not independently verified today. Your IP address is what websites see for traffic you carry.
Your provider's terms. Some internet providers and mobile carriers restrict proxy or server use in their terms. Whether sharing is allowed on your connection depends on your country and your contract.
What is published and what is not
The supplier contract, the Linux release with checksums, the Windows client source and the Android SDK source (MIT) are public. Exit IPs and per-device endpoints are not published.
Stopping and removing
| Platform | Stop | Then |
|---|---|---|
| Linux | sudo systemctl disable --now proxies-peer | Remove the device in the farmer dashboard, then delete its key and state files |
| Windows | Close the start.bat window; remove any scheduled task or NSSM service | Remove the device in the dashboard and delete the folder |
| Android | Stop sharing in the host app (the SDK exposes stop()) | Remove the device in the dashboard; uninstall the app |
You can stop or leave at any time, without asking and without a notice period. Earnings already recorded stay on your account and are paid as usual.
Questions
- What traffic goes through my device?
- Customer HTTP and HTTPS sessions, each as a TCP tunnel opened from your device to the website the customer asked for. The website sees your IP address. One customer session uses a device at a time.
- Can the customer or PROXIES.SX read my traffic, or can I read theirs?
- For HTTPS the tunnel carries the encrypted TLS stream between the customer and the website, so neither your device nor the relay sees the content. Plain HTTP is not end-to-end encrypted. The peer software does not route your own browsing through the network.
- Can a customer reach devices on my home network?
- We have not published a verified control for this yet. Until one is published, run the peer on an isolated or guest network, away from printers, cameras, NAS drives and other local devices.
- Does it open a port on my router?
- No. The device makes outbound connections and needs no open port on your router.
- Could websites block my IP address?
- Traffic you carry leaves from your IP, so a website that blocks proxy traffic can see and block that address like any other. Check your internet provider's or carrier's terms before sharing a connection.
- How do I remove it completely?
- Stop the software (close start.bat on Windows, disable the systemd service on Linux, stop sharing in the app on Android), remove the device from the farmer dashboard, then delete the local files. You can stop at any time; earnings already recorded stay on your account.
Sources
Checked on 27 September 2026. The supplier contract (source 1) overrides this page wherever they differ.