Privacy

The short version: we do not know who you are and we do not record where you go. But we do count one thing, and it is below.

Our rules in detail

• We ask for no email, phone number or name. The account is created on your device: the app makes up the number and keeps it with you, and all that reaches us are values derived from it that do not give the number back. So we know neither the number nor whose it is, and we cannot recover it for you.
• Who goes where is not recorded. There are no logs of visited sites, domains or DNS queries. Traffic contents are encrypted: the exit node forwards packets without looking inside. While a connection is live the exit node sees your IP address — the replies have to go somewhere — but our code writes it nowhere.
• A payment is not tied to a person. You pay in Monero to an address made for that one order: such a payment carries no name, no card number and no sender address. For it you get a subscription code — a bearer code: you can enter it yourself, give it away or resell it. All we know is that a paid code activated an account, and an account has no name and no contact details. A paid order keeps its codes for 90 days, then we erase them; the amount, the time and what was bought stay in the books.
• The device key is made on the device itself and kept in the system's secure storage; only the public key reaches us — it is how the servers recognise the device.
• There is no access log for this site: visitors' addresses are not recorded.

What we do count

How much data each device transferred, and when. It is what tells us whether a node is working and how loaded it is. There are no destinations, ports or site names in it — it cannot say what you were doing, only how much it weighed.

We also keep what a subscription cannot work without: the device's public key, the end date, the device count and whether it is paid. We do not hold your account number — it is created on your device and never sent to us, which is also why we cannot recover it for you.

Messages to support

• on the site's server they are stored encrypted twice: to the operator's key, which is not on that server, and to a key that only your ticket code opens; the server itself cannot read them;
• every message in a conversation, and every reply, is tied together by its ticket code: with it you read the conversation and add to it;
• account numbers and activation codes are taken out of the text before it is stored: they are passwords, and support does not need them — a subscription is found by its six-character account ref;
• no address of yours, no name and no email is stored with a message; a conversation is deleted 90 days after its last message;
• unlike the chat, these messages do not go to a third-party provider: a person reads them.

If we are asked for it

Only what exists can be handed over. There is no list of visited sites, here or on the exit nodes, and we cannot tie traffic to a person because there is no person in our data. So we have nothing to hand over.