What we store about you, and why
vpn.now stores only the account, device, and security data needed to run the service. We do not record the sites you visit, DNS queries, traffic contents, or addresses opened in the web proxy.
This policy explains what personal data vpn.now collects, why we collect it, how long we keep it, and what rights you have over it. It applies to our available apps and website, and it will apply to our planned browser extensions after release. We wrote it in plain language on purpose. If anything is unclear, contact support and we will explain it.
In short: we store the minimum we need to run your account and secure your devices. We do not record what you do online through the service, the sites you visit, or the addresses you open in our web proxy tool.
Contents
Data we collect
We collect data in two ways. First, data you give us when you sign up and use vpn.now, such as your email address and the names you choose for your devices. Second, data our systems create so the service works, such as the public keys that let our servers recognize your devices and the access tokens our apps and extensions use to connect.
Every item we store exists for one specific reason. The table in the next section lists each item, why we keep it, and how long we keep it.
What we store and why
This is the complete list of personal and account data our systems store.
| Data | Why we keep it | How long |
|---|---|---|
| Account email address | To log you in and send important account or security notices. Marketing email only if you opt in, and you can opt out at any time. | Life of account |
| Password hash (Argon2) | To check your login without ever storing your actual password. We store only a one way scrambled hash, so even our staff cannot read your password. | Life of account |
| Free account plan status | To keep your free access active. vpn.now does not ask for or store payment details. | Life of account |
| Device names you choose | So you can tell your devices apart in the dashboard. The name can be anything you like and does not need to identify the real device. | Life of account |
| Device public keys (one per device) | So our servers can recognize each device. The matching private key is delivered once in the configuration and is never stored by us. | Life of account, removed when you delete the device |
| API access tokens for the apps | So our apps can connect to your account. We store only a SHA-256 hash of each token, never the token itself, and you can revoke a token at any time. | Until you revoke it |
| Account activation code | So a native app can be linked to your account without placing your password in the app. The searchable value is hashed and the display copy is encrypted at rest. It is an account credential that you can rotate from the dashboard. | Until you rotate it or delete the account |
| Browser extension proxy credentials, after extensions are released | A username and a hashed secret used by our Chrome, Firefox, and Opera extensions to connect through the proxy. You can revoke these at any time. | Until you revoke it |
| Aggregate per-server session counts | Totals and the daily peak per server, so we know when to add capacity. They contain no IP addresses and no account identifiers, and they cannot be linked to you. | Purged after 30 days |
| Total data usage per account | A single running total of how much data your account transfers, so we can monitor capacity and operate the service fairly. It says nothing about where the data went or what it contained. | Kept for operations |
| Approximate sign-in location and IP address | The rough location and IP address you sign in to your account from, kept so we can secure accounts and spot suspicious sign-ins. You can review your own recent sign-ins from your account dashboard. This is the address you connect to our website or app from when you log in, not your IP while the VPN is running and not anything you do over the VPN. | Purged after 30 days |
| Support requests | Your email address, subject, category, and messages when you ask us for help. Do not send passwords, private keys, or other secrets in a ticket. | Until the request is no longer needed or you ask us to delete it, subject to legal obligations |
| Diagnostic error records | Status code, request method, redacted URL, browser user agent, IP address, redacted referrer, and account ID when signed in. Query values and password-reset credentials are removed before storage. | Purged after 30 days |
| IP lookup request | When you open an IP or leak-check tool, your current IP is processed to return its network and approximate location. If an HTTPS geolocation provider is configured, the server sends the IP to that provider without exposing our API key; otherwise lookup stays on our server. vpn.now does not save this lookup. | Processed for the response; not stored by vpn.now |
Where data is stored
Account, device, support, and security records are stored in the control-plane MySQL database on the vpn.now application host. The VPN gateways are separate from that system: they receive only the public keys, assigned tunnel addresses, and limits needed to accept an active device. Gateways do not receive the account database or your password hash.
Server-side credentials, including database and third-party API keys, live in a protected environment file on the application server. They are not placed in browser JavaScript, HTML, downloadable apps, or the source repository. A device private key is returned in its configuration and is not stored by the control plane.
Hosting providers and regions can change as the network grows. Because we do not want to publish an inaccurate permanent location, you can ask the privacy team for the current host and processing region that applies to account data.
What we never collect
The following data is not collected or stored by vpn.now. Not in databases, not in backups, not anywhere:
- Your browsing activity
- Your DNS queries
- The contents of your traffic
- The websites you visit
- Your real IP address while you are connected
The free web proxy
The free web proxy tool at our web proxy page works the same way. The addresses you open through it are not logged. We do not keep a record of the pages you load with the proxy.
We do not claim this makes you anonymous. It means that what you do through the service is not recorded by us, so we have nothing about your online activity to lose, sell, or hand over.
How long we keep data
The table above lists the exact retention for each item. In short:
- Account email, password hash, device names, and public keys stay for the life of your account and are removed when you delete it from your account dashboard.
- Your free account status stays for the life of the account. We do not collect payment details.
- API tokens, and browser extension credentials after extensions are released, are kept until you revoke them or delete the related device.
- Support requests are kept while they are needed to answer and document your request, or deleted when you ask unless a legal duty requires longer retention.
- Aggregate per-server session counts are purged after 30 days by an automatic scheduled job.
- Sign-in location and IP records are purged after 30 days by the same scheduled job.
- Redacted application error records are purged after 30 days. Production web access logs omit query strings, visitor IP addresses, user agents, referrers, and password-reset tokens.
Who we share data with
We do not sell personal data, ever. We share data only with service providers needed to host vpn.now and deliver account email. Each provider receives only what its job requires. We do not use a payment provider because vpn.now does not collect payments.
We may also disclose specific data if a court with jurisdiction over us legally compels it. Our transparency page explains that process and what we can and cannot produce.
International data transfers
vpn.now operates servers and works with providers in more than one country, so your account data may be processed outside the country where you live. When we move data across borders, we rely on standard contractual clauses or other lawful transfer safeguards to keep it protected to the same standard described in this policy.
Your rights
You can access, correct, export, or delete your personal data. Most of this works directly from your account dashboard: you can change your email, manage devices, revoke tokens and extension credentials, and delete your account. For anything else, including a full export of your data, open a support ticket and we will handle it within 30 days.
Depending on where you live, laws such as the GDPR or CCPA may give you more rights. We honor requests under those laws no matter where you are.
Cookies
Our website uses only the cookies that are strictly necessary, such as the ones needed to log you in and keep our forms secure. We do not use advertising or cross site tracking cookies. The full details are in our cookie policy.
Website analytics
To understand how many people visit the website and which pages are useful, we run our own analytics software on our own server rather than handing that data to an advertising company. We have configured it to respect your privacy:
- It sets no cookies. There is nothing for you to consent to and nothing stored in your browser.
- It honors your browser's Do Not Track setting. If you turn that on, you are not counted.
- It anonymizes visitor IP addresses, which are used only to derive a rough country and are never stored in full.
- It records only aggregate visit data, such as page views, the page you arrived from, and approximate country.
This runs only on the public website. It is not in the VPN apps and will not be included in the planned browser extensions, and it tells us nothing about what you do over the VPN. It cannot recognize you across other websites.
Children
vpn.now is not for children under 16, and we do not knowingly collect data from them. If you believe a child has created an account, contact support and we will delete it.
Changes to this policy
If we change this policy, we will update the effective date at the top and explain the change in plain language. For meaningful changes, we will email account holders before the change takes effect. We will never quietly expand what we collect.
Contact
Questions about this policy or your data? Contact support and ask for the privacy team. We answer plainly.
Have a question we did not cover? Contact support