Privacy

What we keep

• Connection and disconnection times
• The volume of traffic passed — for billing
• Error codes — so failures can be fixed
• Subscription data: plan, term, payments

What we do not keep

• The addresses and domains you connect to
• DNS queries
• Traffic contents

Account

The app works without one: your own servers, split tunnelling, the proxy and the settings all behave the same for a guest. On first launch an installation identifier is created — a random number used to deliver notifications. Until you sign in it is tied to nothing.

On registration we receive an email address. We do not ask for a name and do not store one. Signing in creates an account with its own identifier; the installation is linked to it on sign-in and unlinked on sign-out.

What the app sends

The app sends only what it cannot work without. No addresses and no browsing history are here, and cannot be: traffic does not pass through our service, and the nodes keep no such journal.

• The installation identifier and the notification token — to deliver subscription messages and support replies
• The device name the system provides (on an iPhone that is the model name), the OS version and the app version — to tell devices apart in the list and to know where a failure reproduces
• The kind of network — Wi-Fi or cellular, and whether IPv6 and UDP are available: the connection protocol is chosen from these

Support requests

The text of a conversation and the files attached to it are kept while the request exists: without them an operator cannot return to your question. A screenshot arrives exactly as you sent it, while capture data — time, the coordinates of the place, the camera model — is stripped on the device, before sending.

Credentials

A password is stored only as an Argon2id hash. The password itself is written neither to the database nor to the logs and lives inside a single request; it cannot be recovered from the database — which is why “forgot my password” here means a reset, not a reminder.

The second-factor secret and the recovery codes are encrypted with a key the database does not hold. A database dump is not enough to generate a code.

Why this is more than words

Destination logging is switched off in the configuration of the servers themselves — they physically keep no such journal. On top of that our service strips those fields from logs before writing them, and the log collector accepts only a pre-approved set of fields.

Three independent layers mean a leak has to break all three rather than one. The price is that troubleshooting rests on error codes and metrics instead of tracing traffic.

Payment

Card details are handled by the payment system; we neither receive nor store them. What stays with us is the fact of a payment: amount, currency, time and the provider's identifier.

Disclosure to third parties

We do not sell your data, do not rent it out and do not hand it to anyone for advertising, analytics or profiling. There is not a single ad network, analytics system or crash collector in the app.

Data leaves our perimeter in three cases and no others. The payment system receives what a payment requires — we never see the card itself. Apple and Google receive a notification token in order to deliver it to the device. The law may oblige us to answer an official request — but we can only answer with what we keep, and we do not keep addresses or traffic contents.

Deletion

An account is deleted in the app itself: Settings → Account → Delete. Devices, connection history and the support conversation go with it. No email to us is required, and the action cannot be undone.

Questions

Anything about data goes to support@exitru.net. A person answers.