PryVPN never records the sites you visit, your DNS queries, the content of your traffic or your real IP next to your activity. To run the service it keeps your email address (encrypted) with a hash of your password, or your Google account's ID, your devices' public keys and short-lived service records, each with a fixed retention period. The beta is paid for by the project itself: no ads, no advertising or analytics SDKs, and no data sold.
The first question anyone should ask a free VPN is simple: what do you keep about me, and who pays for all this? A vague answer is a warning sign. So this post answers both questions in detail, the way we'd want a provider to answer us.
Two ground rules for this blog, while we're at it. No sponsored posts and no affiliate links. And every claim about PryVPN matches our privacy policy; if the policy changes, this article changes with it and shows the new date.
What we never collect
Some things are not "kept briefly" or "anonymized". They are simply never written down:
- The websites or apps you use through PryVPN.
- Your DNS queries. Our resolvers answer them in memory and keep only totals that name no one.
- The content of your traffic.
- Your original IP address linked to your activity. Client IP addresses are never stored in clear, only as short, daily-salted hashes.
- Timestamps of when you reached a given site.
That list is what "no activity logs" should mean for any VPN. If you want to check other providers against it, our guide to what "no logs" really means walks through the tests.
What we do keep, and for how long
A VPN can't work with nothing. It has to know which devices may connect, and it has to keep the service running. Here is the short version of the tables in our privacy policy:
| What | In what form | Kept for |
|---|---|---|
| Account | Your email address, encrypted, and your password only as a one-way hash (Argon2id); with Google, a keyed hash of your Google account's ID | Until you delete the account |
| Devices | WireGuard public key, platform, app version, optional name, and the days it was added and last used | 90 days unused |
| Which server holds each device's key | Device, server, day placed and last used | Removed after 24 hours unused |
| Active session | Server, public key, start time rounded to the hour, bytes sent and received | Only while you're connected |
| Security events (such as failed sign-ins) | Type, time and a daily-salted hash of the IP address | 24 hours |
| Service logs | Route, result and timing, with no IP and no query strings | 14 days |
| Website access logs | IP address shortened to /16 (IPv4) or /32 (IPv6) | 14 days |
| Abuse counters (connection rates) | Only in the VPN server's kernel memory, never written to disk | Up to one minute |
| Optional usage statistics | Daily counts, off unless you turn them on; groups under 10 hidden | 396 days |
| Diagnostics | Only if you send them; not linked to your account | 30 days |
A few details matter as much as the table:
- Dated to the day. Anything tied to your account is dated to the day at most (to the hour only while a session lasts). Minute-level detail that some logic needs lives only in memory and is forgotten within an hour.
- An email or Google, nothing more. To create an account we ask for an email address and a password, or your Google account: no name, no phone number, no card. We use the address only for your account: the sign-up code, password resets and notices of new devices.
- Backups expire too. Data you delete leaves the server's daily backups within 14 days and the encrypted offline copies within 30.
- Deleting is one tap. You can delete your account in the app or on our account deletion page.
How we stop abuse without watching anyone
Shared VPN addresses attract spam and attacks, and a service that ignores abuse ends up on blocklists that hurt everyone. The usual answer is to log everything "just in case". We chose another one: count behavior, not activity.
The VPN server's kernel counts how fast a device opens connections and how many different destinations and login ports it reaches per minute. The device is identified only by its address inside our network, never by account or real IP. If a limit is hit, the connection is slowed for 2 minutes or restricted to web browsing for 30, and the flag then disappears on its own. None of it is ever written to disk. Our abuse page explains the limits, and the transparency page counts every report and every request from an authority.
Who pays for the beta
The honest answer is short: the project pays for it. The beta is funded by PryVPN itself, not by your data.
- No ads in the app, and no advertising or analytics SDKs (no Firebase either).
- No data selling, and nothing injected into your traffic.
- No plan to take away the free version. If paid extras arrive one day, the free PryVPN stays. Our free page says the same and will be updated first if anything changes.
Keeping costs low is part of the design. Servers hold no browsing data, the software is small, and capacity grows with demand: when servers are full, new people join a waiting list instead of everyone getting a slower VPN.
How to check us
You don't have to take this post on trust:
- Read the policy tables in the privacy policy. They're written to match what our code stores, line by line.
- Watch the transparency page. Every request from an authority and every abuse report is counted there.
- Test the app. The in-app leak test shows which IP and which DNS server you're really using; our help article on privacy explains what to expect.
- Ask us. Write to privacy@pryvpn.com and we'll answer in plain words.
If that's the kind of VPN you'd like to use, join the beta. It's free, with no card: the app only asks for an email and a password, or your Google account.
Sources
Spotted a mistake? Write to support@pryvpn.com and we'll fix it and update the date.
