This policy explains what we store, why we store it, and what we deliberately do not store.
Last updated:
Account data (email address, username, hashed password, optional two-factor secret), order data (route, traffic limit, connection limit, period, status), payment records received from our payment providers, and security events such as login timestamps.
We do not record browsing history, DNS queries, destination IP addresses or the content of your traffic. Connection metadata is aggregated to the order level (bytes used, number of simultaneous connections) so that limits can be enforced.
To operate the subscription you bought (contract performance), to prevent abuse and fraud (legitimate interest), to meet accounting obligations (legal obligation), and to answer your support requests (consent or contract, depending on the request).
Order and payment records are kept as long as accounting law requires. Server-side traffic counters are aggregated and retained for the life of the order. Closed accounts are anonymised after the statutory retention period.
We use hosting and payment providers who process the minimum data necessary. Their names are available on request. We do not sell personal data.
We set a session cookie to keep you logged in and one small cookie to remember your theme and language preference. No advertising or analytics cookies are set unless you enable them.
You may request access to, correction of, or deletion of your personal data, and you may object to processing based on legitimate interest. Write to the privacy contact in the footer. You also have the right to complain to a supervisory authority.
This page describes how the service is operated. It is not legal advice; have a lawyer review it before launch.
