No-Logs Declaration
We do not log your network activity — this is an architectural guarantee, not a marketing slogan
Last updated: April 20, 2026
This declaration defines "no-logs" in engineering terms. We want you to know precisely which data does not exist on our servers, which data does, why it exists, and how long it sticks around — instead of just printing the words "zero-log" on a landing page.
1. What we do not record
We do not write any of the following to persistent storage (disk, database, external logging system): the hosts or IPs you visit, DNS queries and responses, per-connection timestamps, source↔destination IP pairings, bandwidth broken down by destination, transport-layer payloads, TLS SNI, HTTP headers, cookies, or any artifact of network activity that could be tied back to a specific user.
2. Architectural guarantees
Relay nodes run sing-box / Hysteria forwarding software; packets are routed in memory and dropped after forwarding. We actively disable the verbose and per-connection log modes of the forwarding software and keep only error-level output. System journald retention is capped at 3 days and is configured to exclude iptables/nftables connection-tracking events. There is no NetFlow, sFlow, or PCAP-based traffic mirroring on any node.
3. The minimal dataset that does exist
Running a subscription service requires the following: (a) account data — email, password hash, creation timestamp; (b) billing data — order records, plan, payment channel, receipts; (c) quota data — cumulative traffic in the current billing cycle, current active device count; (d) per-node aggregate health — CPU, memory, concurrent socket count, total egress bandwidth; (e) web-portal access logs — kept 7 days for abuse prevention, containing nothing about subscription traffic.
4. How the device fingerprint works
We distinguish clients via an opaque hash (user-agent + salted first-seen IP), used solely for counting. The hash is non-reversible to the raw IP and is never correlated with the destinations you reach. Resetting devices immediately invalidates the old hash.
5. Third parties
Cloudflare, acting as a relay for some nodes, sees encrypted TLS/UDP flows but cannot decrypt them. Stripe and the USDT blockchain see payment events only, disjoint from subscription usage. We do not ship Google Analytics, Sentry, Datadog, or any third-party SDK that would carry user-behavior data. Server-side error sampling keeps stack traces only — never request bodies.
6. Verifiability
We plan to publish an annual transparency report covering: (a) government / legal process requests received and responses; (b) the data fields actually delivered; (c) summaries of any third-party audits. Where legally possible, we will also publish a warrant canary for the reporting period.
7. When legal process arrives
We comply with the law of the relevant jurisdiction — but because we keep no traffic metadata, the only thing we can deliver is the account-level data described in Section 3. Non-existent data cannot be retroactively produced: we do not flip on traffic logging in response to a request.
8. Verification you can perform yourself
(a) Packet capture: record your client's outbound traffic and the node's external connections in parallel — you will find no injected identity fields; (b) Log inspection: pending a formal audit program, we are willing to grant enterprise customers a read-only proof of node logging configuration; (c) Open questions: technical queries can be raised at [email protected] and we commit to public answers.
9. How long this promise holds
If any of the above is forced to change (acquisition, regulatory change, major architectural rewrite), we will announce the change via in-app notice and email at least 30 days before it takes effect, and will allow you to migrate or request a full refund free of charge during that window.
10. Contact
Challenges, audit requests, and compliance inquiries concerning this declaration can be sent to [email protected].