Privacy Policy

1. Scope

This policy explains how YourVPN ("we", "our", or "us") handles information on this website and in any account, payment, support, VPN, or proxy features that are made available. Describing a feature here does not mean that the feature is currently available.

3. Information We Handle

Website and Analytics

Our minimized first-party telemetry route can retain an allowlisted page path without query strings or fragments, coarse device and browser categories, bounded campaign fields, and a two-letter country code only when supplied by a configured trusted upstream. If a strong key is configured, it may also retain a keyed pseudonym that rotates each UTC day; without that key, it stores no visitor identifier.

Raw IP addresses and full user-agent strings may be used transiently to produce those minimized values but are not stored by that route. Ahrefs Analytics and the Tracker Lite/TownRanker service are also present on public pages and may process page events, click interactions with pages and controls, and ordinary technical request metadata under their own configurations. Click telemetry does not include values typed into form fields.

Leads, Accounts, and Service Records

• Lead email: If lead collection is enabled and you request a guide, we store the normalized email needed to deliver it. Inactive lead routes reject the request before its body is parsed or stored.
• Lead context: We retain only an allowlisted source-page path, an allowlisted guide or campaign category, optional daily pseudonym, trusted country code, and coarse device and browser categories.
• Account and authentication data: If account features are enabled, this can include email, account status, authentication records, plan, subscription identifiers, and security events.
• Provisioning and usage data: If service features are enabled, this can include provider identifiers, access credentials or URLs, entitlement state, capacity, and aggregate usage needed to operate or revoke service.

Payments, Email, and Support

• Payments: Stripe processes card details. We may receive customer, subscription, invoice, price, payment status, date, and amount information, but not full card numbers.
• Email: We and our configured mail provider process recipient, subject, message content, delivery status, and related operational data. Signed, expiring open or click events may be recorded only when email engagement tracking is configured.
• Support: If you contact us, we and our mailbox provider process the sender, message, attachments, and other information you choose to provide. The current application support-intake component stores mailbox checkpoint metadata rather than message bodies.

4. How We Use Information

• Operate, secure, diagnose, and measure the website and available services
• Authenticate users and manage accounts, entitlements, subscriptions, and cancellations
• Process payments and reconcile payment and provider state
• Deliver requested guides and service-related communications
• Respond to support, privacy, abuse, and legal requests
• Prevent fraud, abuse, duplicate processing, and unauthorized access

5. Cookies and Authentication

Available account or administrative features may use cookies, one-time challenges, and server-side session records for authentication, security, and request integrity. Browser and infrastructure controls may also use limited technical state for rate limiting and abuse prevention.

6. Security

We use safeguards including TLS for website and API traffic, access controls, input validation, bounded logging, and application-level authenticated encryption for specific protected records where that protection is implemented and configured.

We do not claim that every database field, log, archive, or backup is encrypted at rest. Some records, including legacy records and data required for provider operations, may not have application-level encryption. No security method can guarantee absolute protection.

7. Retention and Deletion

We retain information according to the purpose for which it is used, operational and security needs, provider requirements, backup cycles, and legal or financial obligations. Different record types can therefore have different retention periods.

There is not currently one verified, automatically enforced 30-day deletion rule across the primary database, logs, email records, exports, provider systems, and backups. Retention and backup-expiration schedules are still being formalized and verified. A deletion request may not remove data that must be kept for legal, fraud-prevention, security, or financial reasons, and deletion from backups may occur on a later backup-expiration cycle.

We will update this notice when exact end-to-end retention periods have been implemented and verified. This policy does not itself delete or migrate historical records.

8. Service Providers and Disclosures

Depending on which features are configured or used, information may be processed by these provider categories:

• Stripe: Checkout, payment, subscription, invoice, and billing-portal processing
• Outline (Jigsaw/Google): VPN client and, when enabled, VPN access provisioning
• IPRoyal: Proxy account provisioning and usage management when that service is enabled
• Ahrefs Analytics: Public website analytics
• Tracker Lite/TownRanker: Public website event and performance analytics served through the /t/ routes
• Email and mailbox providers: Delivery of account, guide, and support email and receipt of support messages; the configured provider may change
• Hosting, infrastructure, and backup providers: Delivery, security, operation, and recovery of the website and available services

We may also disclose information when required by valid legal process, to protect users or systems, or as part of a business transaction subject to appropriate safeguards.

9. Your Privacy Choices and Rights

Depending on where you live and subject to verification and legal exceptions, you may have rights to request access, correction, deletion, restriction, objection, or portability. You may also choose not to submit a lead or support message and may use browser controls for cookies or third-party content.

Send requests to [email protected]. We will respond within the period required by applicable law. We may need information to verify your identity and authority before acting.

10. International Processing

YourVPN is operated from the United States. Our providers may process information in the United States and other countries where they operate. Those locations may have different data-protection laws from your home jurisdiction.

11. Children's Privacy

YourVPN is not directed to children under 13, and available paid service features may impose a higher minimum age. We do not knowingly collect personal information from children. Contact us if you believe a child has provided personal information.

12. Changes to This Policy

We may update this policy as systems, providers, laws, and retention practices change. The "Last updated" date identifies the current version. Where required by law, we will provide additional notice of material changes.

13. Contact Us

If you have questions about this policy or our data practices: