Privacy

What we know about you, what we keep, and for how long — in plain words, because a promise you cannot check is not worth making.

What we do not know about you

We never ask for a name, a document, an address or a phone number, and there is nowhere to enter one. An account is a random key: the app shows it, we store it, and it says nothing about who holds it.

Nothing below is sold or shared with anyone. It exists so that we can answer a lawful order, and for nothing else.

What we keep

For each connection made through our servers we record three things: the address a connection came from, where that connection went, and when. Nothing else.

The destination is recorded as our servers see it — an address, or the site name the device asked for. Records are kept for up to 365 days and then destroyed.

What is not in those records

• your account — it is not written there, and there is no way to work out which account a record belongs to
• anything you sent or received — we cannot see inside an encrypted connection and do not try
• which pages you opened on a site, what you typed, or what was shown to you

That first point is the important one. The record and the account live in different places, under different keys, and nobody can join them, ourselves included.

Who can read them, and when

Nothing in the running system can. Records are encrypted the moment they are made, on the server that makes them, with a key that is not held anywhere in our infrastructure — so the machine keeping a year of records cannot open a single one of them.

Reading requires a person to bring that key by hand. Every such reading is written down: who did it, when, and under what authority.

Why we keep them at all

Because we are a company with a name and an address, not an anonymous group, and a lawful order addressed to us has to be answerable. Such an order asks about an address at a time — and that is exactly what we keep.

What a VPN does not do

It divides trust rather than removing it: instead of your provider, your traffic passes through us. It does not make you anonymous to a site you sign in to, and it does not protect you from someone you hand your details to yourself. Always check who you are dealing with.

The check that tells us what is being blocked

The app can check whether our service is reachable from where you are, and send us what it found. It is the one thing here that describes a network rather than a person, and it is built so that it cannot do the second.

A report says which of our servers answered and which did not, and the same for a few well-known sites — that is what separates “our service is broken” from “your network blocks things”. It carries your platform, the app version and the kind of connection — wired, wireless or mobile — and a country your device works out for itself, so that it knows which local sites to check: the one you chose in the desktop app, otherwise the country of your phone's mobile operator or of your time zone, and only from a short list, so outside those countries a report carries none. An Android phone also sends its mobile operator's code, which itself names the operator's country. Nothing else: no account, no device, no name, no address. The address our server unavoidably sees becomes a country and a network operator within the request, and is then thrown away.

The switch is in the app, and turning it off is immediate: nothing is measured, nothing waits to be sent, and what the device had already collected is deleted. An individual report is kept for 14 days; only counts outlive it.

When something does not work, the diagnostics screen has a “Send to support” button. Pressing it is how you ask us for help: the app sends the history of its recent checks, our support staff see it as soon as it arrives, and the app shows a short one-time code to put in your message, so that we know which history is yours. Support sees it for 72 hours. Your address goes with it only if you tick “include my address”, which is off by default — it helps with network problems. The upload is not linked to your account, and it is deleted after 30 days, or sooner when your case is closed.

Deleting your account

You can delete your account yourself, at any time and for good — in the account portal, or from the menu of the app. It needs only your access secret. Everything about the account goes at once, and your other devices sign out the next time they ask for a server list. To make that possible we keep a one-way fingerprint of the deleted secret for 90 days; it cannot be turned back into the secret or the account. A record of an action an operator took on an account is kept for 12 months, and service logs that can mention an account for 30 days at most. The Delete account page at the bottom of this site explains each step.