Documents
Privacy
Contents
This document describes the data Exitru needs for accounts, network access and support. Connection metadata and browsing history are different kinds of information, discussed separately below.
Accounts and sign-in
The Exitru network uses an account. It links your email or connected sign-in method, subscription, devices and security settings.
A password is processed as a strong hash rather than stored as plain text. Two-step verification needs a TOTP secret; the service provides encryption for that secret. Sessions and service tokens enable sign-in and termination of access.
Operational connection data
The service processes connection times, transferred data volumes, error codes, and account, device and server identifiers. This information supports access issuance, troubleshooting, limits and network operations.
Subscriptions are charged for a period of time, rather than per megabyte. Accounting for transferred data does not itself mean traffic-based billing.
The code provides separate cleanup periods for different operational records. This edition does not set a single retention period for all data: the actual infrastructure settings must be verified before publication.
Browsing history
The adopted technical design excludes destination addresses and domains, DNS queries, URLs and traffic contents from operational logs. The repository contains logging-field restrictions and configuration checks.
This describes engineering rules, rather than an independent audit of the running network. Server settings and all connected monitoring systems need to be verified before the final edition.
Subscriptions and payment
Providing access requires the selected plan, its validity period, order status and payment confirmation. Payment methods shown to a customer must match providers that are actually connected.
The data received by a particular payment provider will be described once that provider is connected. This local version prepares the payment flow for interface review; real providers are integrated separately.
The app and your own server
You do not need an Exitru account to configure a VPN on your Linux server. You choose the hosting provider and pay for the VPS. The app needs SSH connection details to carry out the installation you select.
Your server and its keys require care. Do not send a password, private key or access link in an ordinary support request. Information you share through a file, link or messenger reaches the recipient you choose.
Local split-tunneling rule sets and cloud rule sets have different storage models. A local set does not automatically become public; review its contents before sharing it.
App installations and notifications
On first launch, an app can register its installation independently of an account. The record contains a service identifier, platform, app version and activity timestamps. Signing in links the installation to the account; after sign-out or account deletion that link is removed, while the installation may remain anonymous.
On supported platforms, push delivery uses a delivery token, language and the setting for hiding message text. A system push provider delivers the notification. This information is not browsing history. Notification permission is managed in the app and device settings.
The website also saves your theme and language choices in the browser and uses session cookies for sign-in. These have a different purpose from VPN operational logs.
Support conversations
Support receives your message, attachments and the information you decide to provide. Conversations in your account are associated with that account; email support does not require an account.
A diagnostic report helps identify an error, but you should review it before sending it. The support service includes cleanup of closed conversations; the actual period and exceptions must be confirmed in the final edition.
Deletion and access controls
Account settings let you end sessions and manage devices. An account-deletion request starts a separate job: access and related connections are terminated as that job is processed.
That mechanism is not a promise that every record in every system disappears instantly. Treatment of payment records, backups and required exceptions still needs to be agreed and described before publication.
Questions about data
For questions about data and access, contact support@exitru.net. Do not include your account password, recovery codes or private keys in the message.
The responsible operator, applicable jurisdiction, request procedures and final retention periods remain outstanding review items in this edition.
Before publication, the team must verify the configuration of the running infrastructure and complete the outstanding terms. This draft makes no claim of legal review or compliance with the rules of a particular country.