What we do not collect
- The sites and apps you use, your DNS lookups or the content of your traffic.
- The IP address you connect from. A VPN server has to hold it in memory while you are connected in order to route your packets; it is not written to disk.
- Connection logs. Access and service logging are switched off on our VPN servers.
- Analytics, advertising or tracking of any kind on this website. We set no cookies.
What we keep
- Account: the 16-digit account number, language, subscription end date, your referral code, who invited you, and the date the account was created.
- Sign-in methods, only if you link them: your Telegram user ID, Apple ID identifier or email address.
- Sessions: a hash of each sign-in token, the platform and its dates. The token itself is not stored.
- Devices: the name and platform you chose, when the device was added and last fetched its configuration, and its keys. We generate device keys on our servers so that the site can show you a QR code, which means we hold them until you rotate them or remove the device.
- Connection reports: when an app or our Telegram bot reports an attempt, we store the device, server, protocol, a coarse network label such as “wifi” or a carrier name, the outcome, latency and time. Reports are tied to your account so that a failed day can be credited back. They are deleted after 7 days, and only totals are ever published.
- Payments: plan, amount, currency, status, dates, the payment provider's reference and any gift code. Card details go straight to the payment provider; we never see them.
- Support messages you send us.
To slow down abuse, the website and API count requests per network address for up to one hour. Counters are stored under a keyed hash that cannot be turned back into an address, and expired counters are deleted every day.
For each server we record totals such as load and overall traffic. These are not broken down by user.
Why we use it
- To run the service: issuing configurations, checking that a subscription is active, and processing payments.
- To credit days automatically and to choose servers and protocols that work on your network.
- To publish network statistics, as totals only.
- To send notices about your subscription if you linked Telegram or an email, and to answer support requests.
- To prevent abuse and to meet legal obligations.
Who else is involved
We do not sell personal information and do not share it for advertising. These parties handle data on our behalf or at your request:
- Hosting providers for the website, the API and the VPN servers.
- Cloudflare, which carries connections to this website, and so handles your IP address when you open it. Our API and your VPN traffic do not pass through it.
- Payment providers, such as Stripe, Apple or Crypto Pay, depending on how you pay. They receive what you give them at checkout under their own privacy policies.
- An email delivery provider, only if you use email sign-in.
- Telegram, if you use our bot or the Telegram sign-in button, which loads from telegram.org on the sign-in page.
- Cloudflare's public STUN server, only if you run the WebRTC test on the “Am I protected?” page.
How long we keep it
- Connection reports: 7 days.
- Sign-in sessions: up to 180 days, or until you sign out.
- One-time codes: up to 10 minutes.
- Rate-limit counters: up to one hour.
- Account, device and support records: until you ask us to delete them.
- Payment records: for as long as tax and accounting law requires.
Your choices and rights
Your account page shows your devices, subscription and payments, and lets you rotate keys or remove devices at any time.
To get a copy of your data, correct it or delete your account, write to support from your account. Depending on where you live, including California and other US states, you may have further rights under local law. We will not treat you differently for using them.
Legal requests
We respond to valid legal process, and we can only hand over what is listed above: there are no traffic or connection logs to give. The transparency page at elsewherevpn.net/transparency describes how we handle requests.
Security
Traffic to our site and API is encrypted with TLS. Session tokens are stored only as hashes, and access to production systems is restricted. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.
Children
The service is not directed at children under 13, and we do not knowingly collect their information.
Changes
We will publish any change here and update the date above. If a change materially affects how we handle your data, we will also say so on the site or in your account.
Contact
ElseWhere Labs Inc. Write to us from the support form in your account.