Privacy policy

Last updated: 5 September 2026

PryVPN sells one thing: the absence of a record. This page describes exactly what that means, in the order that matters — first what we never write down, then the little we do.

1. What we never record

None of the following is written to disk, to a log file, or to our database, at any point, for any user. The same list is served by our API at /v1/meta and repeated inside your data export, so you can verify that this page and the system agree:

• Browsing history and visited pages
• DNS queries and their answers
• Destination IP addresses and destination hostnames
• TLS SNI (the hostname visible during a handshake)
• Packet payloads, in whole or in part
• The source IP address your access provider assigned you while the tunnel is up

Because these are never collected, they cannot be produced in response to a request from anyone — a partner, an advertiser, a court, or us.

2. What we do hold

An account has to exist somewhere, and some jurisdictions place obligations on the operator of a network service. We hold the minimum that satisfies both:

• Account: email address, a PBKDF2 password hash, the plan you chose, the country you declared, the reason for use you selected, the account creation and last sign-in timestamps, and the IP address seen at registration.
• Session allotment rows: which internal tunnel address (10.8.x.x) was issued to your account, on which node, and when the session started and ended. This is an allotment record, not a traffic record: it says a tunnel existed, never what went through it.
• Operational counters: byte totals per session, used to enforce plan limits and spot abuse. Counters are numbers, not destinations.

3. How long

Retention is decided by the country you declare at sign-up, because that is what determines which law applies to your account. The schedule is published in full on the country rules page. In most markets session allotment rows are kept for 90 days; India requires five years under its CERT-In directions, and Indonesia 180 days. When the period expires the rows are purged automatically, not on request.

4. Your rights

Under the GDPR, the UK GDPR, the CCPA, the LGPD, the PDPA and comparable regimes you may access, export, correct and erase your personal data. All of it is wired into the product rather than an email queue:

• Export: the console produces a machine-readable copy of every field we hold about you, including your compliance rows.
• Erasure: deleting your account removes the account and its personal data immediately. Where a law obliges us to retain a subscriber snapshot after closure — India is the notable case — that obligation is listed on the country rules page.
• Objection and complaint: write to privacy@pryvpn.com, and you may complain to your national supervisory authority.

5. Cookies and the website

This site sets no advertising or analytics cookies and embeds no third-party trackers. Your browser stores one item, pryvpn-session, in local storage after you sign in; it holds your access token so the console can talk to the API. Clearing it signs you out. Details on the cookies page.

6. Payments

Listed prices are €2.99 (PryVPN), €4.99 (Plus) and €14.99 (Pro) per month. During the open beta PryVPN and Plus are billed at €0; Pro is out of stock. Card details, when collected, will be handled by a processor and will never touch our servers.

7. Sharing

We do not sell, rent or trade personal data, and we run no advertising business. Data is shared only with infrastructure providers strictly necessary to operate the service (hosting and outbound email), each bound by a processing agreement, and with authorities where a valid legal order compels it — which, given section 1, is a short conversation.

8. Security

Passwords are hashed with PBKDF2. Tunnel keys are Curve25519 pairs generated per session; the private half is shown to you once and is never written to our database. Traffic is encrypted with ChaCha20-Poly1305 by the kernel WireGuard implementation. Administrative interfaces are restricted to an operator allowlist.

9. Children

PryVPN is not directed at children and accounts may not be created by anyone under 18, or under the age of majority where they live, whichever is higher.

10. Changes

If this policy changes materially we will say so on the site before the change takes effect. The date at the top always reflects the current version.