Privacy

We do not know who you are and we do not record where you go. But we do count one thing, and it is below.

Our rules in detail

• We ask for no email, phone number or name. In our app the account is created on your device: the app makes up the number, keeps it with you and never sends it. When a subscription is activated on this site instead (for iPhone, iPad and Mac), the site makes the number up, shows it to you and writes it down nowhere. On the My subscription page you type the number in yourself; between clicks the page carries it sealed under a key that exists only in the server's memory and is replaced every 15 minutes. All we keep are values derived from the number that do not give it back. So we know neither the number nor whose it is, and we cannot recover it for you.
• Who goes where is not recorded. There are no logs of visited sites, domains or DNS queries. Traffic contents are encrypted: the exit node forwards packets without looking inside. While a connection is live the exit node sees your IP address — the replies have to go somewhere — but our code writes it nowhere.
• A payment is not tied to a person. You pay in Monero to an address made for that one order: such a payment carries no name, no card number and no sender address. For it you get a subscription code — a bearer code: you can enter it yourself, give it away or resell it. All we know is that a paid code activated an account, and an account has no name and no contact details. A paid order keeps its codes for 90 days, then we erase them; the amount, the time and what was bought stay in the books.
• The device key is made on the device itself and kept in the system's secure storage; only the public key reaches us — it is how the servers recognise the device.
• There is no access log for this site: visitors' addresses are not recorded.

What we do count

How much data each device transferred, and when. It is what tells us whether a node is working and how loaded it is; for a free trial it is also what ends the trial once its 1 GB is used. There are no destinations, ports or site names in it — it cannot say what you were doing, only how much it weighed.

We also keep what a subscription cannot work without: the device's public key, the end date, the device count and whether it is paid; for a free trial, a mark that it is one and whether its 1 GB is used up. Your account number is not among them, which is also why we cannot recover it for you. The daily limit on free trials is a single count of how many started today, with no addresses or accounts in it.

Messages to support

• on the site's server they are stored encrypted twice: to the operator's key, which is not on that server, and to a key that only your ticket code opens; the server itself cannot read them;
• every message in a conversation, and every reply, is tied together by its ticket code: with it you read the conversation and add to it;
• account numbers and activation codes are taken out of the text before it is stored: they are passwords, and support does not need them — a subscription is found by its six-character account ref;
• no address of yours, no name and no email is stored with a message; a conversation is deleted 90 days after its last message;
• unlike the chat, these messages do not go to a third-party provider: a person reads them.

If we are asked for it

Only what exists can be handed over. There is no list of visited sites, here or on the exit nodes, and we cannot tie traffic to a person because there is no person in our data. So we have nothing to hand over.