1. Which services are covered?
vpnpass.shop, the My info screen, our VPN and proxy servers, and the VPNPass apps once they are released.
2. Is my VPN activity recorded?
No. None of the following is logged while the VPN is on:
- which sites, apps or services you reach
- anything inside the data you send or receive
- DNS lookups
- the IP address your provider assigned you
- when a session started, ended or how long it ran
3. What is kept to log me in?
If you signed up with email, we hold your email address, saved in lowercase, and a scrypt hash of your password. We never hold the password itself. The email serves only as your login name. We do not write to it.
Token sign-ups leave us two things for login: a one-way hash that your pasted token is checked against, and the token's final 4 characters so staff can tell accounts apart. You see the full token one time, on the sign-up screen. We also hold an encrypted copy of the token. It is attached to top-up requests sent to our payment server so that payments can be matched to the right account.
Every account also has a one-way hash of the IP address it was created from. It exists only to enforce the 3-accounts-per-IP rule. We never ask for a name, phone number or home address, and we send no email.
4. What about payments?
Each top-up and each checkout is recorded with its amount, coin, date and contents, together with your passes' start and end dates.
PayGate processes the crypto payments, and its own terms apply on its checkout page. With crypto as the only payment method, we never see a card number or bank account.
5. Proxy settings and support messages
Proxy customers have their proxy username, proxy password and allowlisted IPv4 addresses stored.
What you write in the Contact us tab, along with our answers, is kept so that the thread can continue later.
6. How are devices counted?
Each connected device gets a short-lived marker on the server, which is how the device limit is enforced. The marker records only that one of your slots is busy. Nothing else goes in it, not your IP and not what you were doing. Disconnecting deletes it.
7. Cookies and what the browser stores
All cookies come from vpnpass.shop itself. No outside party sets cookies on the site.
- vp_sid holds your login session for 30 days. vp_in carries no data beyond a signal to the page that you are logged in
- vp_lang stores the language you chose. vp_hint stores that you dismissed the language suggestion
- ref_src lasts 30 days from your first visit and records how you arrived: the site name of the link you followed, the utm_source tag in the address, or that you typed the address yourself
- The cart is not a cookie. Your browser keeps it in local storage under the name vp_cart. It reaches us only when you check out, and the cart page has a button to empty it
- Two short-lived entries sit in session storage and vanish when you close the tab: vp_src, so the visit is counted once, and vp_draft_*, which keeps what you typed in the sign-up, login or contact form (never a password) so it comes back if the form returns an error
8. Do you track me for ads?
No. The site carries no ad cookies, no tracking pixels and no analytics from other companies, and the apps will not either. Nothing we hold is sold, and ad companies get none of it.
9. A request from the police or a court
We release account data only under a legal obligation, and even then only what sections 3 to 5 list. We never produce browsing or connection logs, so they cannot be handed over.
10. How long is data kept?
For the life of the account. To close your account and have its data removed, send a request from the Contact us tab. Payment records that the law tells us to keep may be held for longer.
11. Revisions, and who to ask
Each revision updates the date at the top of this page. Questions go to the Contact us tab in My info.