VPN privacy is more than a ‘no logs’ sentence

Begin with a data-flow map

A privacy claim is useful only when it matches the system that exists. Map what leaves the device during sign-in, subscription verification, server selection, tunnel creation, advertising, crash reporting, and support. Record the receiving system, purpose, retention period, and who can access it.

This exercise separates browsing activity from operational metadata. A service may avoid recording destinations and DNS queries while still processing account identifiers, public IP addresses at connection time, VPN credentials, server load, or purchase tokens. Those categories should be described accurately rather than hidden behind one broad slogan.

Minimize the control plane

The control plane creates accounts, assigns credentials, verifies entitlements, and reports server availability. It does not need the contents of tunneled traffic. Keep those responsibilities separate in code and access policy so ordinary support or billing work cannot expose traffic information.

Use random internal identifiers instead of carrying email addresses into every table and log. Remove secrets from application logging, rotate administrative keys, and restrict production access to the smallest practical group.

• Define which connection events are necessary and why.
• Set automatic retention limits for operational records.
• Do not place VPN keys, access tokens, or full request bodies in logs.
• Review every analytics and advertising SDK independently.

Make deletion technically possible

A policy that offers deletion needs a working route through primary databases, credential stores, support tools, and backups. Decide which records can be erased immediately, which are anonymized, and which must be retained for a documented security or legal purpose.

Deletion should revoke active VPN credentials, not merely hide the account in an app. Test the process as a system behavior and give support staff a way to confirm completion without restoring the deleted personal data.

Write claims with boundaries

Encryption protects data between the device and the VPN endpoint; it does not make the entire internet path invisible. Mobile operating systems, app stores, payment providers, advertising providers, and destination services each have their own visibility. A trustworthy explanation states these boundaries plainly.

Privacy work is ongoing. Recheck data flows whenever a new SDK, server provider, authentication method, or monetization feature is introduced, and update public disclosures at the same time as the product change.