Summary
- We don't log the sites you visit, your DNS queries, your traffic or your real IP next to your activity.
- We keep a hashed account number, your devices' public keys, and a session record only while you're connected.
- We don't sell or share data for advertising, and the app has no advertising or analytics SDKs.
- You can ask us to export or delete your data at any time.
Who we are
PryVPN ("we", "us") provides the PryVPN app and the pryvpn.com website. You can reach us at support@pryvpn.com. [The company name and registered address will be added before launch.]
Data we process to run the service
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Account number (hashed) | Sign in and keep your settings | Performing our contract with you | While your account exists |
| Device public keys | Let your devices connect | Contract | While the device is on your account |
| Active session: server, protocol, bytes | Run the connection | Contract | Until you disconnect, then only daily totals |
| Security records: failed sign-ins, rate limits, truncated IP hash | Prevent abuse and attacks | Legitimate interest in keeping the service safe | 24 hours |
| Service logs: API route, result, timing and a truncated IP hash, never your account number, destinations or full IP | Keep the service running and investigate errors | Legitimate interest in running a reliable service | 14 days |
| Website request logs, with your IP address shortened (for example 203.0.x.x) | Keep this website running and stop attacks | Legitimate interest | 14 days |
| Diagnostics you choose to send | Fix the problem you reported | Consent | 30 days |
| Optional recovery email | Help you recover your account | Consent | Until you remove it |
Automatic abuse protection
To stop spam, attacks and account farms without watching anyone, PryVPN counts behavior, not activity. These counters never include the sites you visit, your DNS queries or the content of your traffic, and they are never linked to what you do online.
| What is counted | Where | Kept for |
|---|---|---|
| How fast a device opens new connections, how many it has open, and how many different destinations and login ports it reaches per minute. The device is identified only by its address inside our network, never by account or real IP | In the memory of the VPN server's kernel. Never written to disk or sent to us | Up to one minute, then discarded |
| Whether that internal address is slowed down or quarantined after exceeding a limit | Server memory only | 2 minutes (slowed down) or 30 minutes (quarantined), then forgotten |
| Server-wide totals, such as "3 connections slowed down right now", with no addresses or identities | Our control systems | 7 days |
| New sign-ups per network, where the network is a one-way hash of a shortened IP address, used to make automated sign-ups harder | Our control systems | About one hour |
| How many devices of an account are connected at once, and how many different networks it used in a day (only the number, from a truncated daily hash, never the networks) | Our control systems | While connected; the daily number for 7 days |
When a limit is hit, the consequence is automatic and temporary: a slowed or restricted connection that returns to normal on its own. The acceptable use rules in our terms explain the limits, and our abuse page shows how they work.
Reports of abuse
If you report abuse through our form or by email, we process what you send: the type of abuse, the PryVPN IP address, date and time, port, your description and evidence and, if you give them, your email address, name, organization and case number. The network you send it from is only used, briefly, to limit how many reports can be sent. We use it to investigate and answer your report, on the basis of our legitimate interest in keeping the service free of abuse and, for requests from authorities, our legal obligations. One year after a report arrives, once it has been dealt with, we erase your email, name, organization, description, evidence and the target you named, and keep only the type, dates and outcome. We count reports, without personal data, in our quarterly transparency report.
Data we never collect
- The websites or apps you use through PryVPN.
- Your DNS queries.
- The content of your traffic.
- Your original IP address linked to your activity.
- Timestamps of when you reached a given site.
This website
This site doesn't use cookies for tracking or advertising, and it doesn't load third-party analytics. To learn which pages help people, it keeps simple daily counts of page views, beta sign-ups and button clicks, without cookies. Each count holds only the event, the page path and, if you arrived from another website, that site's domain. We don't store your IP address with it or anything else that identifies you, and your browser skips counting entirely when it sends Do Not Track or Global Privacy Control. It also loads fonts from Google Fonts, which means your browser requests them from Google. [We plan to host the fonts ourselves before launch.]
If you join the beta list, we store your email address only to tell you when PryVPN is available. We first send one email with a link to confirm the address; if you don't confirm it, we send nothing else. You can ask us to delete it at any time, and every email we send includes a way to unsubscribe.
The live check on our homepage runs entirely in your browser. Nothing it reads is sent to us.
Sharing
We don't sell data. We use a small number of providers to run PryVPN, such as data centers for our servers and an email service for the beta list. They process data only on our instructions, and we'll publish the list before launch.
We may disclose data when the law requires it. Because we don't collect activity data, there is none of it to disclose.
International transfers
At launch, our VPN servers are in Germany and Canada, and we will add more countries over time. When personal data, such as your account number hash, is processed outside your country, we use appropriate safeguards such as standard contractual clauses.
Your rights
Depending on where you live, including under the GDPR, you can:
- Access the data we hold about you, and receive a copy.
- Correct it, or ask us to delete it.
- Object to or restrict some processing.
- Withdraw consent at any time, for example for the beta email list.
- Complain to your data protection authority.
Write to support@pryvpn.com. We may ask you to confirm that you control the account, for example from inside the app.
Children
PryVPN isn't directed at children under 16. If you believe a child has given us personal data, contact us and we'll delete it.
Security
We protect data with encryption in transit, short-lived credentials, staff access limited to our own network addresses and protected by a password plus a separate admin key, and audit logs of administrative actions. See our security page to report a vulnerability.
Changes to this policy
We'll update this policy as PryVPN grows and show the date at the top. For significant changes, we'll tell you in the app before they take effect.