What we keep, what we never collect, and why
Most VPN marketing asks you to take big claims on faith. We would rather show our work. Below is the complete list of what vpn.now stores, what we never collect, and how we handle data requests.
Privacy facts at a glance
These three facts explain the basic data flow. The full table below gives the details.
Account data
vpn.now stores your email, password hash, device names, and public keys so your account and devices can work.
Traffic data
vpn.now does not store browsing activity, DNS queries, visited sites, or traffic contents.
Short-term records
vpn.now removes aggregate server counts and sign-in security records after 30 days.
What data we collect
Here is the complete list of personal data our systems store. If an item is not on this list, we do not have it.
| Data | Why we need it | Kept for |
|---|---|---|
| Account email address | Login and important account or security notices | Life of the account |
| Hashed password | Securing your account. We never see the actual password | Life of the account |
| Free account plan status | Keeping your free access active. We do not collect payment details | Life of the account |
| Device names you choose | So you can tell your devices apart in the dashboard | Until you delete the device |
| Device public keys | Letting your devices authenticate to our servers | Until revoked or rotated |
| Aggregate per-server session counts and bandwidth | Capacity planning, so servers do not get overloaded | Purged after 30 days |
| Total data usage per account | A single running total for capacity planning and fair operation. It contains no destinations and no contents | Life of the account |
| Approximate sign-in location and IP address | Account security and spotting suspicious sign-ins. You can see your own recent sign-ins in your account. This is where you signed in to your account, not anything you did over the VPN | Purged after 30 days |
What we never collect
The following data is not stored by vpn.now, not even temporarily in a database:
- Your browsing activity
- Your DNS queries
- The contents of your traffic
- The websites you visit
Our session statistics are aggregate counts per server per day. They contain no source IP addresses, no destinations, and nothing that links a session to a specific account. If you want to understand what your provider can normally see, read what your ISP sees, and for how to judge any provider's claims, see our guide on reading a VPN logging policy.
Why we need any operational data at all
A free service still needs a small amount of operational data. We need your email to give you a login. We need your devices' public keys because that is how our VPN protocol authenticates connections. We need rough per-server usage counts so we know when to add capacity. Each item maps to one concrete job, and we collect nothing beyond that.
Retention periods
Aggregate session counts are purged after 30 days by a scheduled job. Account data lives as long as your account does. When you delete your account, your email, devices, and keys are removed. vpn.now does not collect card details or payment records.
Law enforcement requests
If we receive a legally binding request from a court with jurisdiction over us, we can only hand over what we actually store, which is the list above. We cannot produce browsing histories, connection logs tied to users, or traffic contents, because that data does not exist on our systems.
Our process for any request:
- Our legal team verifies that the request is valid and binding in our jurisdiction.
- We push back on requests that are overly broad or lack proper legal basis.
- We disclose only the specific data the order legally compels, never more.
- We will notify affected users when we are legally allowed to do so.
Audit roadmap
We have not yet completed an independent audit, and we will not pretend otherwise. A third party review of our data handling and server infrastructure is planned, and we will publish the full results here when it is done, including anything the auditors find that we need to fix.
Infrastructure model
Our VPN servers run on infrastructure leased from established hosting providers in each region. Servers run a minimal hardened image, are managed only by our own team over key based SSH, and hold no customer account data. Account information lives on separate systems, isolated from the machines that carry VPN traffic. Read more on our security page.
Questions about your data?
Read the full privacy policy, browse vpn.now privacy help, or ask us directly. We answer plainly.
Contact support