Security and privacy

What we do not keep

No connection logs. No traffic destinations. No DNS query records. No client IP addresses — not in application logs, not in metrics, not in traces. The access log records method, path, status and duration, and that is the whole list.

This is a design constraint rather than a policy promise: the systems that would need to hold that data do not have anywhere to put it. Rate limiting, which normally wants to remember addresses, uses in-memory counters keyed on a hash that rotates daily and is never written to disk.

What we do keep

An account identifier, and the credential your app uses to authenticate. If you bought on the web, the email address you gave us — encrypted with a key that lives outside the database, and searchable only through a blind index. Deleting your account destroys that key, which makes the address unrecoverable while the payment record, which is only amounts and dates, survives for tax purposes.

If you bought inside the app, we hold no email at all.

Verify rather than trust

We have not been independently audited. A number of VPNs advertise audits; we have not commissioned one, so we do not claim one. When that changes we will publish the report rather than the adjective.

What you can check today: the app never displays server addresses, and the transports it uses are public, documented protocols rather than something in-house. What you cannot check from the outside is our no-logging claim — no user can, for any provider, which is exactly why the claim is worth so little on its own and why we would rather point at the architecture than at a badge.

Reporting something

Security issues go to the address on the contact page. We would rather hear about a problem early and awkwardly than late and publicly.