What data we keep

The content of your traffic and the addresses you reach are not recorded. The service is not fully logless either: to keep the network running, show you your own usage and catch abuse, we keep some operational records. Below is the exact list, with nothing hedged.

What gets written

Each tunnel produces a pair of records — session open and session close. They contain:

• The account identifier and the session identifier.
• The node the connection went through.
• The IP address you connected from.
• The start and end time of the session.
• Bytes transferred up and down.
• The reason the session ended.
• Separately from sessions — authentication events (success or failure and the source IP) and the website's HTTP access log, which also contains IP addresses.

What for

Three things, and nothing beyond them. Statistics — to show you your own usage and each location's load, and to see where the network is short of capacity. Diagnostics — when a connection keeps dropping, there is nothing to investigate without the session time and the node. Anti-fraud — to tell one account resold across a hundred devices, or a credential-stuffing run, apart from normal use; without the IP address those are indistinguishable.

How long

90 days. Records are deleted automatically at the storage layer — by a TTL rule in the database itself, not by a scheduled script somebody can forget to run. Payment records live longer because tax law requires it; the full retention period for each category of data is in the privacy policy.

Who can see it

The engineers who operate the service, on a need-to-know basis. The data is not sold and not shared with third parties. We answer government authorities only under a legally binding request and only to the extent of the data we hold: data we never collect does not materialise on request. The current warrant canary is on the privacy policy page.

What does not get written

We mean these literally:

• Traffic content: the tunnel is encrypted and we cannot decrypt it on our side.
• Destination domains and addresses: the mechanism for recording them exists in the code, is off by default and is not enabled on the public network. If it ever becomes necessary, this page will change before it is switched on.
• DNS queries, browsing history, the contents of messages and files.
• Card details.

Enterprise customers' own nodes

Enterprise customers can enrol their own nodes into the network, so their employees' traffic never leaves their infrastructure. Such a node runs under its owner's logging policy, which may differ from ours: the owner is free to enable destination logging on their side. We do not make that decision for them and have no access to their records. The client app shows you when a connection is going through an organisation's node — before you connect, not after.

How it is built

An edge node holds no state: it keeps no local access log and sends only the operational events listed above to the shared statistics store. Keys are rotated. Operating-system journals on the nodes record infrastructure events, not user connections.

How to check

Your usage and your live sessions are visible in your account — those are precisely the records described here. A full export of everything tied to your account can be requested at support@logrus.space.