What "no activity logs" really means

Almost every VPN provider claims to keep "no logs", yet the phrase means very different things in different contexts. Any service that bills customers, fixes faults and prevents abuse necessarily keeps some operational data. The real questions are what is kept, for how long, and whether the promise can be verified. This article answers them for TP VPN, item by item.

Why "no logs" is easy to misread

"Logs" can mean many things: the sites you visited, DNS queries, connection times, byte counts, sign-in records, payment records. Lumping them together and summarising them as "none" is neither accurate nor checkable. We chose not to use an absolute slogan. Instead we publish a table that states how each kind of data is handled, and we keep that table consistent with the database schema.

What we never record

We do not record your online activity. Specifically:

Browsing content. Which sites you visit, what you read, what you send.
DNS queries. Which domain names your device resolved.
Traffic destinations. Which IP addresses or ports your packets went to.
Your real IP address. It is resolved to a country and city in memory at connection time; the raw address is never written to the database, log files or backups.

These fields do not exist in our database schema, so they cannot be queried, exported or handed to any third party. Nodes do not perform deep packet inspection on tunnel traffic.

What we record, and why

Record	Fields	Purpose	Retention
Connection logs	Connection time, node used, upload and download byte counts	Billing, fair-use accounting, troubleshooting	30 days
Session records	Session start and end, device identifier, node	Device limits, troubleshooting	90 days
Aggregated traffic statistics	Byte totals per period, without per-connection detail	Capacity planning	13 months
Orders and payments	Order number, amount, payment method, time	Tax and audit requirements	7 years
Support tickets	The descriptions and replies you exchange with us	Providing support	24 months after closure
Administrator audit log	Actions taken in the admin console	Internal compliance	3 years

None of these fields concerns the addresses or content you access. Data is deleted automatically when its retention period ends. The numbers match the Privacy Policy and the Trust Center; any change is announced and reflected in the policy.

How we prove it: in the data model, not only in the policy

Policy text can be edited at any time; code leaves a trail. We enforce the privacy constraints at two levels:

The data model. The session and connection-log tables simply have no columns for "destination address", "DNS query" or "client IP". A field that does not exist cannot be filled with data and cannot be switched on later.

An automated build-time assertion. The script scripts/check-privacy-consistency.sh in our repository runs on every push and every merge request. It scans the schema definitions, type declarations and migration scripts; if a forbidden field name such as client IP, destination address or DNS query appears, or an address-like field shows up in a sensitive model such as sessions or connection logs, the build fails and the change cannot be merged.

The promise therefore does not depend on anyone's good intentions. Even if an engineer meant well and wanted to "record a little more", the pipeline would refuse.

Keys never leave the device

WireGuard key pairs are generated on your device and the private key is stored only in the iOS Keychain or the Android Keystore; only the public key is uploaded when a device is registered. The private key never appears in any request, log or crash report, and we have no way to establish a tunnel on your device's behalf.

What happens with a law-enforcement request

We can only provide data that exists. Because browsing content, DNS queries and destination addresses are never collected, they cannot be looked up or handed over; at most, the metering and billing fields in the table above are available. The handling principles are set out in the Privacy Policy.

Status of independent audits

An independent audit has not yet been carried out. We plan to commission a third party to assess the logging architecture and the apps, and we will publish the full report and its scope in the Trust Center when it is complete. Until then we will not claim, in any form, to have "passed an audit".

Why there is no warrant canary

Some providers publish a regularly updated statement whose absence is meant to hint at a secret request. We do not run such a mechanism: its legal effect is unclear in most jurisdictions, and a missed update triggers a false alarm. We rely on the data model itself to protect privacy: data that was never collected cannot be surrendered.

How you can check

Read the Trust Center; its retention figures come from the same constants as this article.
Read sections 2 and 3 of the Privacy Policy and compare them line by line with this article.
Watch the policy version and effective date: material changes are announced at least 30 days in advance.
If you find an inconsistency or a security issue, email security@tpvpn.com; we acknowledge within 3 business days.