PryVPN Blog (English)

What "no logs" really means in a VPN, and how to check it

2026-09-24T00:00:00Z

Almost every VPN says "no logs". It's on the homepage, in the app store listing and on the ads. But a VPN can't run on nothing: it has to know which devices may connect, and it has to route your traffic. So "no logs" can mean something solid, or almost nothing. Here's how to tell.

Activity logs versus the data a VPN needs to run

It helps to split what a VPN could keep into five kinds:

Kind of record	Example	Does it say what you do?
Activity logs	The sites you visit, your DNS queries, the content of your traffic	Yes, directly
Connection logs	Your real IP address, the VPN address you were given, when you connected	Not on its own, but it can link you to what others logged
Account data	Email address, payment details	It says who you are
Operating data	Your devices' keys, which server you use, how much data passes	No, if it's kept briefly and apart from the rest
Statistics	Daily totals with no identifiers	No

The second row is the one that trips people up. A website can log "the VPN address 203.0.113.7 posted this at 14:02". If the VPN keeps "the customer at home address X had 203.0.113.7 at 14:02", the two logs together point to a person. A "no logs" promise that keeps connection logs is a weak one.

A strong no-logs service keeps no activity logs, no connection logs that link your real address to your activity, as little account data as possible, and operating data only as long as it's needed.

Five ways to check any provider

You don't have to take anyone's word for it, ours included. These five checks work on any VPN:

A policy with a list, not a slogan. Look for a table of what is stored, in what form and for how long. "We may collect information to improve our services" is not an answer.
An independent audit. Who did it, when, what it covered (the servers, the apps, or only a policy), and whether the report is public. An audit is a snapshot of one moment, not a permanent seal.
What happened when someone asked. Transparency reports that count requests from authorities, and public cases where a provider had nothing to hand over, are the closest thing to a real-world test.
The design. Some choices make logging hard in the first place: resolvers that answer lookups in memory, identifiers stored only as hashes, email addresses encrypted and passwords kept only as one-way hashes, short retention periods by default.
The business model. Running servers costs money. If a free VPN doesn't say who pays, the answer may be you, through ads, trackers or data. Privacy Guides, a community project, publishes criteria along these lines.

Red flags

"No logs" with no list of what is kept.
Vague permissions in the policy ("for analytics", "for partners").
Advertising or analytics SDKs inside the app.
No way to tell which company runs the service, or from where.
Words like "untraceable" or "military-grade". Nobody can promise the first, and the second means nothing.

Our case: what PryVPN keeps, line by line

We'd be asking you to apply those checks to others and not to us, so here's our own list. It matches our privacy policy, which is the reference.

What we never record: the sites and apps you use, your DNS queries (our resolvers answer them in memory and keep only totals that point to no one), the content of your traffic, your original IP address linked to your activity, and the times you reached any site.

What we do keep:

What	In what form	For how long
Your account	Your email address, encrypted, and your password only as a one-way hash (Argon2id); with Google, a keyed hash of your Google account's ID	Until you delete the account
Your devices	The WireGuard public key, platform, app version, and the days they were added and last used	Deleted after 90 days unused
Which server holds each device's key	Device, server and day	Removed after 24 hours unused
Your active session	Server, public key, start time rounded to the hour, bytes sent and received	Only while you're connected
Security events, such as failed sign-ins	Type, time and a daily-salted hash of the IP address	24 hours
Service logs	Route, result and timing, with no IP address (only a short daily-salted hash)	14 days
Backups	A full daily copy of the database	14 days on the server; encrypted offline copies, up to 30

To stop spam and attacks without watching anyone, our servers count behavior, such as how fast a device opens new connections, in the memory of the server for up to a minute. Those counters never include where the connections go. Email is optional, and statistics from the app are off unless you turn them on.

What this means in practice: if someone asks who used a PryVPN address at a given time, we can't tell them, because that link doesn't exist. We count every such request in our transparency report.

What we don't have yet

Checks 2 and 3 are the hard ones for a new service, so here is where we stand:

No independent audit yet. Until there is one, what you can check is what we publish: the full storage table in the privacy policy, and the transparency report.
Our privacy policy is a beta draft. It explains our practices in plain language and will be reviewed by counsel before PryVPN launches publicly.
Our company details are still to be published in the legal notice, before launch.
PryVPN doesn't make you invisible. Sites you sign in to know it's you, and your device can still be recognized in other ways.

We think saying this plainly is part of what "no logs" should mean. For the product view of the same list, see our no-logs VPN page.

Hotel Wi-Fi blocking your VPN? Here's why, and what works

2026-09-24T00:00:00Z

You check in, join the hotel Wi-Fi, turn on your VPN, and it just spins on "Connecting". It's frustrating, but it's rarely a mystery. Hotel, airport and campus networks block VPNs in a handful of predictable ways, and each one has a fix.

Three causes, three symptoms

What you see	The likely cause	What works
Nothing loads, and Android says "Sign in to network"	The Wi-Fi's login page is holding every connection	Sign in first, then connect
Browsing works without the VPN, but the VPN times out	The network blocks UDP or recognizes VPN protocols	A tunnel over TCP port 443 (stealth mode)
Some sites fail or land on a hotel page	The network filters or rewrites DNS	A VPN that answers lookups inside the tunnel

A fourth case looks similar but isn't a block: the connection works, just painfully slowly, because the hotspot is shared by a hundred rooms. No VPN setting fixes that; mobile data might.

Most hotel and airport networks hold all traffic until you accept their terms or type a room number on a login page, called a captive portal. Networks can announce it to your phone (a standard, RFC 8910, describes how), and Android notices and shows a "Sign in to network" notification.

Until you sign in, no VPN can get through, because nothing can. So:

Tap the notification, or tap the network's name in Wi-Fi settings.
Accept the terms or enter the code.
Go back to the VPN and connect.

If you use Android's Always-on VPN with Block connections without VPN, the login page may not open at all. Turn Always-on off for a moment, sign in, then turn it back on. Our help article on Wi-Fi login pages has the details.

Many hotels sign you out every day, or after a few hours, even mid-session. PryVPN notices when the network starts showing its login page again and asks you to sign in, instead of hopping between servers that can't be reached.

Step 2: when the network blocks UDP

Modern VPNs, WireGuard included, send their traffic over UDP. It's fast and it's what the protocol was designed for. But many hotel, office and school firewalls only let through web traffic (TCP ports 80 and 443) and DNS, and drop everything else. Some go further and recognize VPN protocols by their shape: a WireGuard connection always starts with a handshake message of the same size and layout, which is easy for a filter to spot.

Networks do this for mundane reasons: to keep bandwidth for web browsing, to sell a "premium" connection, because a security policy says so, or simply because the firewall came configured that way.

The fix is to carry the VPN over the one thing these networks never block: encrypted web traffic on TCP port 443.

How stealth mode works

PryVPN's stealth mode puts the WireGuard tunnel inside a real TLS 1.3 connection on TCP port 443, the same protocol and port every HTTPS site uses. To most filters it looks like one more secure website.

It's real TLS, and it's checked. The app pins our server's certificate, so a network that tries to intercept the connection can't slip in unnoticed. If a network inspects encrypted traffic by replacing certificates, as some company networks and antivirus apps do, PryVPN refuses to connect and tells you, rather than sending anything through it.
Auto mode does it for you. PryVPN tries UDP first. If the server doesn't answer within about 7 seconds, it switches to stealth and remembers that for this network for a few hours. When a handshake times out, you can also tap Retry over TCP 443 (Stealth).
It has costs. Stealth is slower than UDP, because it runs the tunnel over TCP. It needs Android 10 or later. And while it's on, the PryVPN app itself stays outside the tunnel so that its TLS connection can reach our server; all your other apps stay protected.
It isn't invisible. Stealth gets through most networks that block VPNs, but a network with advanced inspection can still detect or block it. We'd rather tell you than promise more.

You can choose it by hand in Settings › Protocol. The protocol help article explains each option.

Step 3: filtered or rewritten DNS

Some hotspots answer your lookups themselves: they send you to their own pages, insert ads, or block categories of sites. Inside PryVPN, lookups travel through the tunnel to our own resolver, so the hotel's DNS never sees them and can't change the answers.

If nothing works

A few networks allow only a short list of services, or inspect every connection in depth. No setting beats that. Your options are then:

Try another location. Some filters block particular server addresses.
Use mobile data, or share it from another phone. Mind roaming costs abroad.
Ask the front desk. Some hotels have a less restricted network for business guests.

Is it allowed?

Using a VPN on hotel Wi-Fi is normal, and the hotel's terms rarely forbid it. VPN use is legal in most countries, but a few restrict or ban it, so check the rules of the country you're visiting before you go; our travel help article covers the basics.

Work and university networks are different: they're governed by rules you agreed to. If the network blocks something you need for legitimate work or study, ask the IT service first. And on a phone your employer or school manages, don't try to work around its settings.

How PryVPN handles all of this

It detects the Wi-Fi login page and asks you to sign in, instead of failing silently.
In Auto mode, it moves from UDP to stealth on TCP 443 when UDP is blocked, and remembers it per network.
It prepares a backup server, in another city when possible, and switches to it in seconds if your server stops responding.
With Android's Always-on VPN and Block connections without VPN on, Android blocks your apps' traffic whenever the tunnel is down, instead of sending it over the hotel network. The Kill Switch article lists the few exceptions Android itself has.

None of this guarantees a connection on every network in the world. It does mean that on the typical hotel, airport or campus Wi-Fi, you get connected without having to become a network engineer first. For more on sites that are blocked rather than VPNs, see unblocking websites.

Stuck right now? Our free VPN blocked on Wi-Fi troubleshooter asks where you are and what you see, then gives you the steps for your case.

What can the Wi-Fi owner see? At home, at work and in a hotel, with and without a VPN

2026-09-24T00:00:00Z

"Can the person who runs this Wi-Fi see what I'm doing?" It's one of the most common privacy questions, and the honest answer is: more than most people think, less than some fear. Below is exactly what they see, how, and what actually changes it.

What they see, and what they don't

The table covers the usual case: a phone on someone else's Wi-Fi, opening ordinary sites and apps. Almost every site now uses HTTPS, which encrypts the page itself but not where you're going.

What the Wi-Fi owner can see	Without a VPN	With a VPN
Which devices are connected, often with their names	Yes	Yes
Which sites and services you use	Yes, by name	No, only "a VPN server"
The pages you read and what you type on HTTPS sites	No	No
The same on the rare site or app without HTTPS	Yes	No
When you're online and how much data you use	Yes	Only the total
The words you search for on Google or Bing	No, only that you used the search engine	No

Incognito mode doesn't change a single row. A private window only decides what your own browser keeps once you close it. The traffic leaves your phone exactly as it would from a normal tab. We compare the two in incognito mode vs. a VPN.

To see these rows filled in with your own visit, try our free Wi-Fi privacy test. It runs in your browser and sends nothing anywhere.

Who the "owner" is: home, work, hotel, campus

The same technology gives different people the same view, so it helps to know who is on the other end:

At home, it's whoever manages the router: you, a parent, a flatmate or a landlord. Most routers list connected devices, and some offer "parental controls" that keep a history of the sites each device visits.
At work, it's the IT department. Company networks often filter and log traffic for security, and on a phone the company manages, they can see far more from the device itself.
In a hotel, café or airport, it's the business or the company it pays to run the hotspot. The login page may ask for an email, a room number or a social media account, which links your visit to a name.
At a university, it's the campus IT service, bound by its own acceptable use policy.

How they see it

No one needs special skills for this. The information comes from four places:

The router's device list. It shows each connected device and often its name, such as "Ana's Galaxy". Android uses a random hardware (MAC) address for each network by default, so your phone isn't recognizable from one network to the next by that address, but the name you gave it may still show.
DNS lookups. Before your phone opens a site, it asks for the site's address. Unless those lookups are encrypted (with DNS over TLS or HTTPS, which is what Android's Private DNS setting uses), the network's DNS server sees every name, with the time.
The site name in secure connections. When an HTTPS connection starts, your phone usually sends the site's name in plain text so the server knows which certificate to present. A newer standard, Encrypted Client Hello, hides it, but only when both the browser and the site support it, and that isn't the norm yet.
Addresses and volume. Many services can be recognized from the addresses your phone connects to, and the size and timing of traffic tell a video call from a download.

What they don't get, on HTTPS sites, is the content: the article you read, the product you look at, the password you type.

What a VPN changes

With a VPN on, your phone builds an encrypted tunnel to the VPN server before anything else goes out, and every app's traffic travels inside it, lookups included. The Wi-Fi owner now sees one encrypted connection to a server: when it's active and how much data passes. The sites, the names and the lookups disappear from their view.

In PryVPN, the lookups are answered by our own resolver inside the tunnel, which keeps no query logs. You can confirm it with the leak test in the app. And if you turn on auto-connect for untrusted Wi-Fi, the tunnel is up the moment you join a network you haven't marked as yours, so there's nothing to remember.

One thing moves rather than disappears: the VPN provider is now in the position the network was in. That's why it matters what a VPN keeps, which we explain in what "no logs" really means.

What a VPN doesn't hide

A VPN protects the path between your phone and the internet. It doesn't make you invisible:

Sites and apps you sign in to know it's you, VPN or not.
Your device is still on the network. The owner can see it's connected and how much it sends, just not what.
A managed phone is a different story. If your employer or school manages the device, or you use a work profile, the organization can see a lot from the device itself, and it may not let you use your own VPN at all. See another VPN or a work profile.
The network can still block you. Some hotels and offices block VPNs. We cover why, and what gets through, in hotel Wi-Fi blocking your VPN.

Work and university networks: an honest note

If the network or the phone belongs to your employer or your university, their rules apply to it. A VPN is for keeping your browsing private on networks you don't control, not for getting around rules you agreed to. On a device an organization manages, assume it can see what the device does, and keep personal things on your own phone.

Quick answers

Can the Wi-Fi owner see my history if I use incognito mode? Yes. They see the same list of sites as with a normal tab. Incognito only stops your browser from saving the history on your phone.

Can they read my WhatsApp or Signal messages? No. Those apps encrypt messages end to end. The network can see that you use the app and roughly how much, not what you write.

Can they see what I search for on Google? Not the words, because the search is encrypted with HTTPS. Without a VPN, they can see that you used Google.

Does a VPN hide my browsing from my mobile carrier too? Yes. On mobile data your carrier is in the same position as the Wi-Fi owner, and with a VPN it sees one encrypted connection. For home internet, see what your internet provider can see.

PryVPN Blog (English)

What "no logs" really means in a VPN, and how to check it

Activity logs versus the data a VPN needs to run

Five ways to check any provider

Red flags

Our case: what PryVPN keeps, line by line

What we don't have yet

Hotel Wi-Fi blocking your VPN? Here's why, and what works

Three causes, three symptoms

Step 1: the login page

Step 2: when the network blocks UDP

How stealth mode works

Step 3: filtered or rewritten DNS

If nothing works

Is it allowed?

How PryVPN handles all of this

What can the Wi-Fi owner see? At home, at work and in a hotel, with and without a VPN

What they see, and what they don't

Who the "owner" is: home, work, hotel, campus

How they see it

What a VPN changes

What a VPN doesn't hide

Work and university networks: an honest note

Quick answers