Privacy Policy

We do not log or store: the websites you visit, your DNS queries, the contents of your traffic, your originating IP address tied to browsing, bandwidth-per-destination, or connection timestamps linked to activity. Our VPN nodes route encrypted traffic without recording it. This commitment is reflected in the aggregate, non- identifying metrics shown on our transparency page.

• Account data: your email address and, optionally, your display name. Authentication is handled via magic-link email, one-time codes, or OAuth providers (GitHub, Google); we store the provider account identifiers needed to sign you in.
• Device records: the public keys, device names, and assigned tunnel IPs for devices you register, so we can provision and revoke VPN access. We never store device private keys.
• Billing data: subscription status, plan, and billing period. Card details are handled entirely by Stripe; we store only a Stripe customer identifier and never see your full card number.
• Notification preferences: your choices for marketing, transactional, and security emails.
• Operational metrics: aggregate, non-identifying fleet health data (server load, online status, total session counts) that contains no user-identifying information.

We use the data above to: authenticate you and operate your account; provision, configure, and revoke your VPN devices; process payments and manage subscriptions; send service communications; and protect the Service against abuse and fraud. We do not sell your personal data.

• Stripe — payment processing and billing.
• Resend — transactional and account email delivery.
• OAuth providers (GitHub, Google) — optional sign-in, used only if you choose them.

These providers process data on our behalf under their own data protection commitments and only to deliver their function.

We use cookies strictly to keep you signed in: a session cookie that holds your authentication token. We do not use advertising or cross-site tracking cookies. Clearing this cookie signs you out.

You control which emails you receive from your account’s notification preferences (marketing, transactional, and security categories). Certain messages are essential to the Service and are always sent regardless of preferences: sign-in links and one-time codes (without them you could not log in) and payment-failure notices (so you do not unexpectedly lose access).

We retain account, device, and billing metadata for as long as your account is active. You can permanently delete your account at any time from your account settings; deletion revokes all VPN access, cancels any active subscription, and erases your stored data. We may retain limited billing records where required by law (for example, tax and accounting obligations).

Depending on where you live, you have rights to access, correct, export, restrict, or delete your personal data, and to object to certain processing. vpnVPN supports these directly:

• Access & portability: export a complete copy of your account data as JSON from your account settings.
• Erasure: delete your account and all associated data from your account settings.
• Rectification: update your profile details at any time.

To exercise any other right, or if you have a complaint, contact us using the details below. EU/EEA users also have the right to lodge a complaint with their local data protection authority.

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

We may update this Privacy Policy from time to time. We will revise the “last updated” date above and, for material changes, notify you by email or in-product.

For privacy questions or to exercise your rights, email privacy@vpnvpn.dev.