No activity logs
Our privacy posture lives in the data model and the build constraints, not only in the policy text. This page explains what we never collect, what we keep and for how long.
We do not record your online activity: no browsing content, no DNS queries, no traffic destinations. Those fields do not exist in our database schema, so they cannot be queried, exported or handed to any third party. The constraint is asserted automatically by our build pipeline: a change that adds such a field to a session or log table fails the build.
What we never collect
Browsing content, DNS queries, traffic destinations and your real IP address are never written to the database. Your IP address is resolved to a country and city in memory when you connect; the raw address is not written to the database, to log files or to backups. Traffic inside the tunnel is encrypted by WireGuard, and our nodes perform no deep packet inspection.
What we keep, and for how long
For billing, capacity planning and troubleshooting we keep only metering fields: connection time, the node used and upload and download byte counts. The retention periods below match the Privacy Policy and the data-model documentation; any change is announced and reflected in the policy.
Asserted by the build pipeline
The script scripts/check-privacy-consistency.sh in our repository runs automatically on every push and pull request. It scans the database schema, type declarations and migrations: if a forbidden field name such as client IP, destination address or DNS query appears, or an address-type field shows up in a sensitive model such as sessions or connection logs, the build fails. The promise does not depend on anyone's good intentions; the engineering process enforces it.
Keys are generated on your device
The WireGuard key pair is generated on your device. The private key is stored only in the iOS Keychain or the Android Keystore, and only the public key is uploaded when the device is registered. The private key never appears in any request, log or crash report.
Retention periods
These periods come from a single site constant shared with the Trust Center and the Privacy Policy.
- Browsing content, DNS queries, destinations
- Never collected
- Your real IP address
- Never stored
- Connection logs
- 30 days
- Session records
- 90 days
- Aggregated traffic statistics
- 13 months
- Administrator audit log
- 3 years
Connection logs contain only the connection time, the node used and byte counts, for billing and troubleshooting.
Key points
- No browsing content, DNS queries or traffic destinations
- Your real IP is resolved to a country and city in memory only; never stored, logged or backed up
- Connection logs hold only the connection time, the node used and byte counts
- Forbidden fields are asserted by a CI script on every push
- The private key stays in your device's secure storage; only the public key is uploaded
- Retention periods match the Privacy Policy line by line; changes are announced
Plan availability
The same privacy posture applies during the 3-day trial and throughout every paid subscription.
Frequently asked questions
More answers in the Support Center, or email us directly.
How can you prove there are no logs?
We publish the scope of our data model and assert the database schema with a CI script; the Trust Center lists the fields and retention period of every record type. An independent audit has not yet been performed. We plan to commission a third-party assessment and will publish the full report when it is complete; until then we do not claim to be audited.
What is in a connection log?
Only the connection time, the node used and upload and download byte counts, used for billing, fair-use accounting and troubleshooting. It contains none of the addresses or content you access. Retention periods are in the table above.
Why do you say no activity logs rather than no data at all?
Because billing and troubleshooting require a small set of metering fields with a defined retention period. We believe an accurate description of what is and is not recorded is more meaningful than an absolute slogan.
What happens if you receive a law-enforcement request?
We can only provide data that actually exists. Because browsing content, DNS queries and destinations are never collected, they cannot be queried or handed over. Our handling principles are described in the Privacy Policy.
What happens to my data after I delete my account?
Your account is deleted permanently after a 30-day cooling-off period, and all registered devices and their keys are revoked. Copies in backups are purged within 90 days.
More features
Every feature listed here ships in the iOS and Android apps today.
WireGuard protocol
An open-source tunnel built on modern cryptography: fast handshakes, a small codebase and low battery use. Key pairs are generated on your device and the private key never leaves it.
Learn moreSmart routing
A weighted score across latency, load and packet loss picks the best node. Exponential-backoff reconnection when a tunnel drops, or choose by scene, country, favourites and recents yourself.
Learn moreSeveral devices at once
Use one account on several devices simultaneously: 2, 4, 8 or 50 depending on your plan. Remove or migrate devices yourself in the app.
Learn moreFair Use Policy
No fixed data quota, only a fair-use threshold. Beyond it, speed is reduced rather than the connection cut, and it resets with the next billing period.
Learn moreA privacy posture you can check
Download the app to get started, or compare plans first.