Privacy policy

The short version

We never ask for your name, email, address or phone number. An account is a random number and a recovery code, and we cannot tell whose it is. We hold what is needed to run your plan and to keep the tax records the law requires, and nothing about what you do with the connection.

We do not record which websites or services you reach, your DNS lookups, the pairing of your address with a destination, which servers your account used, or a log of your connections. Our servers are built and tested not to collect these things, so there is no such record to read, sell or hand over.

Because we hold no email address, we send no newsletters or marketing, and we cannot contact you. We do not sell data and show no advertising.

Accounts and payments

The account service keeps your account number, subscription status, payment references and entitlement expiry to provide your plan. It keeps the account number and recovery-code hash until you delete the account. A recovery code sent to restore or move an account is checked and not retained.

Subscription status and entitlement expiry are kept until you delete the account. Backups are kept 35 days; a backup carries a payment join (the link between an account and its payment reference) only until the earlier of 35 days after creation and the join's detachment date.

A web card purchase leaves a Stripe subscription reference until account deletion. Stripe does not receive the account number. Your billing country goes to Stripe for VAT and is not stored by the account service. Stripe keeps its own record of your card and payment under its own policy; your account page shows that record through a link that expires within an hour.

A crypto purchase creates an invoice for the euro price with an order reference that is not your account number. The invoice service receives no account number, email, address or IP address from us. The hosted invoice page and the blockchain can still reveal who paid, independently of Aphanon; a crypto payment is not an anonymous payment.

A settled crypto receipt keeps its date, coin and amount, euro price, term and declared country, with no account number, for 5 years for the accounts and 10 years for the EU OSS VAT records, and goes to our bookkeeper. A refund address is kept as long as its receipt.

A web checkout operation records its plan, state, payment and customer references, step times, and recovery claim and retry details. It stays until your next checkout replaces it or you delete the account. A pending cancellation left after deletion names no account and stays until the subscriptions are confirmed cancelled. Backups age out separately.

Traffic and operational metrics

The entry sees your connecting IP address to carry the connection and limit abuse. The rate limiter that admits connections keeps the address only in memory and for no more than eight seconds after its last use. The address is not written to disk, used to label a metric or sent to our management systems.

Traffic and DNS queries cross the tunnel to an exit, where destinations are readable while they are being forwarded, and are not recorded. Our policy forbids storing destinations, DNS history or per-account packet counters in the account database, and forbids per-packet logging on the servers that carry traffic.

Operational metrics cover bytes, packets, utilisation, CPU, memory, packet loss, error rates, transport and region totals, active sessions and software version. Traffic-derived metrics are aggregated on each server over at least 60 seconds, with small event counts suppressed and counters rounded, so that one person's session is not visible in them. Central telemetry must not link accounts or client addresses to destinations, servers or exits, or contain full session flow or DNS query logs. Per-node metrics are kept for at most 2 days, and no per-node rollup is kept after that.

Our servers run on rented hosting. Each hosting company sees the traffic of the servers it hosts, with times and sizes, and keeps its own records under its own policies and the law. Because Aphanon splits every connection, the company hosting an entry server sees that your address uses Aphanon, never where you go, and the company hosting an exit server sees Aphanon reach a website, never for whom.

Data on your device and adding devices

Apps keep account credentials, configuration and preferences locally to run the service. Local data stays until you remove it in the app or uninstall it. A saved crash summary lasts at most 24 hours, the saved set of entry hosting providers expires after 30 to 60 days, and the pairing relay holds data for at most 10 minutes. Local failure diagnostics are not uploaded automatically. The iOS app has no production local account-deletion or reset path.

Where the app blocks ads and trackers, it does so in its own resolver on your device, before a request reaches the tunnel, so no server learns what was blocked. The browser extension carries no traffic and stores no account data.

Camera frames used to read a pairing code are processed on the device and discarded after reading. The pairing relay holds a random id and an encrypted account message until collection, for at most ten minutes. Collection deletes them.

The saved set of entry hosting providers expires 30 to 60 days after it was chosen and is dropped when read after that. The device also keeps the version number of the latest signed server directory it accepted, so that an older directory is refused after a restart; this contains no account, address or usage data and is never sent.

If you choose to save or share credentials with a password manager or another destination, that destination can read them.

Problem reports

Problem reports are optional, and the app works fully without them. A report describes one failure in the app, with facts about the app and the platform, and never an account, address, destination or token. You see the exact bytes before choosing Send. You can also save a copy or discard the report. Nothing is sent by a timer or at start: a report leaves your device only when you choose Send for it.

Send carries the report through Aphanon's own servers to our report collector, which never learns your address. The collector keeps a report for 14 days. Its encrypted backups expire 14 days after each snapshot, so a report is fully erased within 28 days.

A report you do not send never leaves your device; the app holds it until you discard it or it expires. macOS holds reports in memory only. Windows, Linux and Android can keep a summary of a crash for your next start, saying only which kind of failure ended the app; it stays on your device for at most 24 hours, with its time reduced to the hour.

Operating-system and store diagnostics

The apps contain no third-party analytics or automatic crash-upload code. Operating systems and stores have separate diagnostic controls.

Android may keep native crash records, including stack, register and memory data. If you share usage and diagnostics with Android or Google, Google Play may collect crash and stability information for Android vitals. Google controls its collection and retention.

Aphanon does not enable Windows LocalDumps, but an administrator can. Windows or administrator policies can produce records outside Aphanon's controls. Microsoft Store health analytics may show Windows crash and failure data according to system diagnostic settings; Aphanon cannot enforce its retention.

Aphanon disables kernel core dumps and process dumpability in its Linux clients. The operating system may still record process termination metadata. Distribution reporters such as apport, user-approved sharing and their retention are outside Aphanon's control.

Aphanon runs no automatic crash or analytics collector on macOS or iOS. If you share analytics with developers, Apple may give the developer crash and diagnostic information. Apple controls collection and retention. TestFlight automatically shares crashes with developers and keeps them available for 120 days. If you share analytics with Apple, it may receive crash, freeze and usage information, and share relevant parts with developers if you also agree to that. Apple says a Mac keeps this information for one month before deletion. We know of no published retention period for App Store customer crash reports or iOS analytics.

Why we hold data, and who processes it

We rely on contract performance for account and payment data and on legal obligation for tax records. Processors: Stripe (card payments), the hosting providers that run our servers, and Cloudflare (this site). Where a processor handles data outside the European Economic Area, the transfer is covered by the EU Standard Contractual Clauses.

Email you send to contact@aphanon.io contains whatever you put in it, including your sending address. Say only what is needed; your account number is enough for us to act. Our email provider holds support email for us. We keep it for 12 months and then delete it.

Deletion and your rights

We do not track you across other apps or sites and do not sell data. Account deletion needs the account number. It removes the recovery-code hash, the subscription record and the payment reference; it cannot be undone or restored, because we do not know who you are. Deletion settles web checkout and cancels a web subscription before removing account data, and is confirmed only once the deletion has been recorded off the server. Access passes already issued to your devices can remain valid for at most two hours. Backups age out rather than being purged immediately; an unresolved web cancellation can remain as described above.

You have the GDPR rights of access, erasure, correction and objection, answered within one month. Requests go to contact@aphanon.io with your account number; there is no traffic record to produce, and without the account number we cannot find anything that is yours. You may complain to Datatilsynet, the Danish Data Protection Authority.

We collect no age or identity data, so the service cannot tell a child from an adult. The terms require users to be 18 or to have a guardian's consent.

Requests from authorities and abuse complaints

Like any hosting customer, we can receive a court order or a lawful request. What exists to produce is the account-side record: an account number, its subscription status and a payment processor reference. There is no record of what any account did with its connection, so a request for browsing history, DNS lookups or the link between an address and a destination is answered with the fact that no such record exists. The recovery code is held only by you; we store a hash of it.

Every request is read, answered and recorded by the AI agents that run Aphanon's operations. A reply to a request for information about a user is sent only after a person at Aphanon has approved it, with one click, and every reply says it was written by AI. An abuse complaint about an exit address names no user: we answer it about that address, and no user is identified. Once the service is public we intend to publish a regular transparency report with the number and kind of requests received.

This website and cookies

These information pages use no cookies, analytics, scripts or third-party requests. Fonts and styles are served from the same site. These pages are served from Cloudflare Workers with no access logs, log push or observability, and Aphanon keeps no request data. Cloudflare may process connection data itself.

The checkout and account pages load Stripe's payment form, which runs under Stripe's own privacy policy and may set Stripe's cookies. Your card details are entered in that form and never pass through our servers.

Changes to this policy

We post changes on this page with a new "Last updated" date. We hold no email address for you, so this page is where notice is given.