No-logs
Exactly what we store, and what we don't
This is the complete list. It is the same list our engineers build against, and the privacy policy uses it word for word.
What we store
- Your account: email address, name and password (stored only as a bcrypt hash).
- Your plan and subscription.
- Your devices: the name you give each one, its platform, and its WireGuard public key.
- Which VPN server a device has a peer on, and the tunnel IP address it was given there.
- The last handshake time of each peer.
- One running total of bytes you used this month (for the Free plan data cap).
What we don't store
- Browsing history.
- DNS queries. Our DNS resolver (unbound) runs with query logging turned off.
- The source IP addresses of your connections.
- Connection timestamps, other than the "last handshake" time above.
- Per-session logs.
Why we keep each item
- Account and plan: to sign you in and know which plan you are on.
- Devices and public keys: a server can only accept your device's WireGuard tunnel if it knows the public key. We never have the private key.
- Server peer and tunnel IP: each server needs to know which tunnel address belongs to which key.
- Last handshake time: one timestamp per peer, overwritten each time, so peers that have been idle for 30 days can be removed from servers.
- Monthly byte total: one number per account for the current month, to apply the Free plan's data cap. It is a running total, not a record of individual connections.
What "no-logs" does not mean
A VPN moves trust from your network provider to the VPN provider. We keep that trust small by not recording what you do, but we can't make promises about the websites you visit, and a VPN does not make you anonymous to services you sign in to.
The browser extension only covers the browser it is installed in. The website and the installable web app don't tunnel traffic at all.