What we keep, what we never collect, and how to check
This page brings together TP VPN's privacy posture, retention periods, infrastructure and compliance status. Every number on it comes from a code constant or a live API and matches our policies; nothing here is a promise we cannot verify.
No activity logs
We do not record your online activity: no browsing content, no DNS queries, no traffic destinations. Those fields do not exist in our database schema, so they cannot be queried, exported or handed to any third party. The constraint is asserted automatically by the build pipeline: a change that adds such a field to a session or log table fails the build.
Never collected
Browsing activity
Which sites, apps or pages you open is not collected, inferred or stored.
DNS queries
We do not record which domains you resolve.
Destinations inside the tunnel
Destination IPs, hostnames and TLS SNI are never collected. Nodes forward encrypted packets and perform no content inspection (no DPI).
Your raw client IP address
Never written to any table. See "About your IP address" below.
Contacts, SMS, photos and precise location
The apps do not request these permissions, so there is nothing to collect.
Advertising or analytics profiles
We run no advertising business and give no data to ad networks.
Enforced by the build pipeline
About your IP address
Your IP address is resolved to a country and city in memory only, at connection time; the raw address is never written to the database, to log files or to backups.
- 1On connect, your IP is resolved to a country and city in memory only (a GeoIP lookup).
- 2The result — entry country and city — is stored on the session record and used for routing, capacity planning and the "current entry point" shown in the app.
- 3The raw address is discarded when the request finishes. It is never written to the database, to log files or to backups.
Edge infrastructure processes your IP in transit (completing a TLS handshake, routing packets and absorbing DDoS traffic all require it), and login and API rate limiting use in-memory counters that expire within minutes. Neither produces a durable record tied to your account.
Read the Privacy PolicyRetention periods
What we do keep, and for how long. Expired data is deleted automatically by scheduled purge jobs — you do not need to ask. Every period matches the Privacy Policy, and the values are read straight from code constants.
| Data | What it contains | Retention | Purpose |
|---|---|---|---|
| Browsing content, DNS queries, destinations | — | Never collected | — |
| Your raw IP address | — | Never stored | — |
| Connection event log | Connect, disconnect, auth-failure and kick events; time, node used and byte counts | 30 days | Troubleshooting and abuse investigation |
| Session records | Start and end time, node, total bytes up and down, entry country and city; no raw IP | 90 days | Usage disputes, device management and billing questions |
| Hourly traffic aggregates | Byte counts by account, node and protocol; no destination information | 13 months | Fair-use accounting and capacity planning |
| Order, payment and refund records | Order id, plan, amount, payment channel and status | 7 years | Statutory financial retention; survives account deletion |
| Support tickets | Subject, messages exchanged and anything you chose to include (counted from closure) | 24 months | Tracing recurring issues; you may ask us to delete sooner |
| Administrative audit log | Operator, target and time; append-only | 3 years | Staff accountability |
| Account-deletion cooling-off period | The account goes offline as soon as deletion is requested and can be cancelled during this period | 30 days | Guards against mistakes and covers the payment-dispute window |
| Residual copies in backups | After deletion runs, copies on backup media disappear as backups rotate | ≤ 90 days | Disaster recovery |
Neither the connection event log nor session records contain browsing content, DNS queries or destinations. After account deletion only transaction records inside their statutory period and an irreversible hash of banned accounts remain.
See the retention policy in the Privacy PolicyInfrastructure
Only facts that can be verified.
WireGuard only
The apps implement a single tunnel protocol, WireGuard: open source, built on modern cryptography, small codebase, fast handshakes. We offer no other tunnel protocol.
Keys are generated on your device
The WireGuard key pair is created locally in the app and the private key never leaves the device; our servers hold only the public key needed to build the tunnel.
Nodes we operate ourselves
Every node is deployed and maintained by us and scheduled by health. User devices are never used as exits or relays.
No content inspection
Nodes forward encrypted packets only. They do not parse traffic inside the tunnel (no DPI) and inject nothing.
Behaviour when the tunnel drops
If the tunnel drops unexpectedly the app reconnects automatically; in the meantime device traffic follows the system's default network path and is not blocked (fail-open). Please factor this into your own use case.
Current network size
Figures from the last sync (2026-09-01)- Nodes worldwide
- 100+
- Cities
- 17
- Countries and regions
- 15
- Tunnel protocol
- WireGuard
Independent audit
Independent audit: not yet conducted. We plan to commission a third party to independently assess our no-logs architecture and client apps; when it is complete, the full report and its scope will be published on this page. Until then, we will not claim in any form to have been audited.
Planned scope
- Whether the server-side data model and logging configuration match this page and the Privacy Policy
- Key handling and data collection behaviour of the iOS and Android apps
- How nodes are deployed and access-controlled
Vulnerability disclosure
Please send security vulnerability reports to security@tpvpn.com (see /.well-known/security.txt). We acknowledge receipt within 3 business days and keep you informed while a fix is under way. There is currently no bug bounty programme.
- Report to
- security@tpvpn.com
- Machine-readable contact
- /.well-known/security.txt
- Acknowledgement
- 3 business days
- Bug bounty
- None at present
While testing
- Do only what is needed to demonstrate the issue; do not access, modify or delete data that is not yours.
- No denial-of-service testing and no social engineering of staff or users.
- Please do not publish details until a fix is out and we have agreed on disclosure.
Law enforcement and third-party requests
We respond only to legal process that is served in our jurisdiction of incorporation and valid in both form and substance; informal email demands are refused. Cross-border requests should come through formal channels such as an MLAT.
- We review the scope of every request, challenge demands that are overbroad or disproportionate, and produce only the minimum set the law requires.
- Where the law permits and no valid gag order applies, we notify the affected user before disclosing, so they have an opportunity to seek relief.
- Because browsing activity, DNS queries, in-tunnel destinations and raw client IPs are never collected, our only possible answer to any process demanding them is that we do not have them.
Warrant canary
A "warrant canary" is a statement a provider publishes at regular intervals to imply it has not received a secret legal order.
We do not operate one. Its legal effect is unclear in most jurisdictions, and a missed update triggers a false alarm. We rely on the data model itself to protect privacy: data that was never collected cannot be handed over.
Transparency report
We plan to publish a transparency report every six months listing the legal requests and copyright complaints received and how they were handled. Until the first report is out, this table shows "No report yet" and no figures.
| Period | Law-enforcement and government requests | Requests where data was disclosed | Copyright complaints (DMCA) | Account actions |
|---|---|---|---|---|
| No report yet | — | — | — | — |
Refunds
Orders placed directly on this website are refundable in full within 7 days of payment, no reason required. Subscriptions bought through the App Store or Google Play are refunded by Apple or Google under their policies; we will help you submit what they require.
Read the Refund PolicyService status
Node health, past incidents and maintenance windows are published on a separate status page you can check at any time.
We do not publish an availability percentage until we have 90 days of monitoring data.
Open the status pagePolicies
Together these documents form the agreement between you and us. Each carries a version and an effective date; material changes are announced at least 30 days in advance.
Privacy Policy
We do not log your browsing activity, DNS queries or traffic destinations. This policy lists field by field what we actually collect, why, how long we keep it, who it goes to, and how you exercise your rights.
- Version
- v1.0.2
- Effective
- August 18, 2026
Cookie Policy
This site uses no advertising or analytics cookies. This policy explains the cookies and browser storage used for language, sign-in, referral attribution and checkout security.
- Version
- v1.0.0
- Effective
- September 2, 2026
Terms of Service
Using TP VPN means accepting this agreement. It sets out what the Service is, the rules for accounts, subscriptions and auto-renewal, refunds, the limits of our liability, and how disputes are resolved.
- Version
- v1.1.0
- Effective
- August 18, 2026
Subscription Terms
Subscriptions renew automatically. Eligible new subscribers receive a 3-day trial and are charged for the selected plan on day 4; the purchase confirmation controls the price, period and eligibility.
- Version
- v1.0.0
- Effective
- September 2, 2026
End User Licence Agreement
This agreement sets the licence terms for installing and using the TP VPN client software. It is between you and us — Apple and Google are not parties to it.
- Version
- v1.0.1
- Effective
- August 18, 2026
Acceptable and Fair Use Policy
This policy explains plan fair-use thresholds, prohibited conduct, how we handle abuse without inspecting traffic, and how to report or appeal.
- Version
- v1.1.0
- Effective
- August 18, 2026
Refund Policy
Orders placed on this site are fully refundable within 7 days, no reason needed. Purchases made through the App Store or Google Play must be refunded by that store — this page explains exactly how, channel by channel.
- Version
- v1.0.2
- Effective
- August 18, 2026
Copyright and Abuse Complaints
How to send us a copyright notice or counter-notice, our handling process and timelines, our repeat-infringer termination policy, and our designated agent.
- Version
- v1.0.1
- Effective
- August 18, 2026
Account Deletion
You can start deleting your account from the web or from inside the app at any time. This page explains what gets erased, what is kept, how long it takes, and the subscription step you must handle first.
- Version
- v1.0.1
- Effective
- August 18, 2026
Contact
For matters covered on this page, use the address for the relevant topic.
- Legal and data requests
- legal@tpvpn.com
- Abuse reports
- abuse@tpvpn.com
- Security vulnerabilities
- security@tpvpn.com
- DPO or EU/UK representative
- DPO / EU representative · To be completed
Highlighted items are placeholders for counsel to complete before launch.