Trust
No-logs policy
Specific rather than reassuring. "We do not log" is worth nothing without a list, so here is the list.
What does exist
- Your account: an account ID, a creation date, a one-way hash of your licence key, and the date of your last sign-in with no address attached. There is no email address and no password.
- If you use the Android app: a one-way hash of an identifier your phone gives it. It answers one question — is this the same device as before — and it is why clearing the app’s data hands your account back instead of stranding you with a new empty one. It cannot be reversed into a device, it is never attached to traffic, and it is read only when the app first sets itself up.
- Orders and invoices: plan, amount, currency, deposit address and transaction id. This is a financial record, and it is the one place a chain analyst could start.
- Devices: the name you chose, its public key and its exit location. Never a private key.
- On the servers: the live routing table needed to move your packets — held in memory while you are connected and never written to disk as history.
- Aggregate operational metrics: per-node totals used to keep the fleet healthy, not attributable to an account.
What we would hand over under a valid legal order
The account and order records above. That is genuinely all that exists. We cannot produce browsing history because we never created any — not as a policy that could change, but because no such table exists in the system. We cannot produce your identity either: we never asked for it.
What we have not done
No independent audit yet, and no published warrant canary. We will say so plainly here until both are true rather than implying otherwise.