Help
The questions people ask.
Written once and used wherever the question comes up, so the answer on the download page and the answer here are the same answer.
Getting started
What do I need to get started?
An account and the desktop app. Sign up, choose a plan, install the app for your platform, sign in, press the dial. Every step after sign-up can be skipped and come back to.
How does signing in to the app work?
Press Sign in and the app opens your browser on the account site. Sign in there as usual — with your second factor if you have one — and approve the connection; the page shows the app’s name and the platform it says it is on. The app then receives a session of its own. It never sees your password, and only continue if you opened that page from the app yourself.
Why does the desktop installer need administrator rights?
The tunnel needs a virtual network adapter and a change to the routing table, and only a privileged process can create either. The installer registers a small background service that does exactly that and nothing else — the window you interact with runs unprivileged and cannot touch the network stack itself.
When will there be a phone app?
They are planned but not written. The desktop apps share a core with a window around it; a phone cannot use that shape, because iOS and Android each require the tunnel to run inside their own VPN extension. That is a separate build rather than a port, which is why they are listed as planned rather than coming soon.
Is Linux supported?
The background service runs on Linux and the AppImage bundles it with the same interface as the other desktop builds. It gets less testing than Windows and macOS, which is what the beta label means.
Can I connect without installing anything?
No. Connecting means creating a network interface on your device, which a web page cannot do. Manual configuration for routers and other devices is not offered yet.
The connection
Which location should I pick?
“Fastest available” picks the least-loaded server. Pick a specific city when you want to come out of the internet in a particular place — New Jersey, Silicon Valley, London, Frankfurt or Singapore today. The load meter next to each is live; the list is fetched when you sign in.
What does “Route all traffic” do?
On, which is the default, every application on the device goes through the tunnel. Off, only traffic addressed to the tunnel network goes through it and everything else uses your normal connection. Per-application split tunnelling is not built.
Is there a kill switch?
Partly, and this matters. Under a full tunnel, IPv6 is blocked system-wide whenever the gateway cannot carry it, so it cannot slip around the tunnel. But if the tunnel itself drops, routing is restored and your traffic resumes over your normal connection. A general kill switch that blocks everything until the tunnel is back is not built yet.
Where do my DNS queries go?
To whatever resolver your device already uses. Gateways do not run a resolver yet, so name lookups take their usual route rather than the tunnel. This is the largest open privacy item and it is listed on the features page as planned.
Does it carry IPv6?
Not yet. Gateways currently block IPv6 rather than carry it, so IPv6-only destinations will not load while connected — and also will not see you. Carrying it is designed and waits on gateway address space.
If I close the window, does the tunnel stop?
No. The window is a remote control; the background service owns the tunnel. Closing the window leaves it running, and the quit item says so: “Quit (tunnel keeps running)”. Disconnect from the dial, or sign out.
What happens to my connection if your servers go down?
An established tunnel does not depend on our sign-in systems. You stay connected. What you could not do during an outage is sign in or start a new session, because that needs a fresh credential.
Account and devices
How many devices can I use?
All of them. Each app you sign in gets its own session, which you end by signing that app out. There is no cap.
Can I add two-factor authentication?
Yes, from the portal: codes from any authenticator app, plus ten single-use recovery codes. No SMS, no email codes. Because the app signs in through your browser, the second factor works there too.
What are the password rules?
At least twelve characters. That is the only rule. Passwords are stored as Argon2id hashes.
Can I delete my account?
Yes — contact support and it is removed along with its devices and subscription record. Invoices are kept for as long as tax law requires.
Plans and billing
What is the difference between Standard and Premium?
Locations. Standard includes every standard location; Premium includes every location. Everything else — features, devices, apps — is the same on both.
Can I switch plans?
Yes, from the billing page in the portal. A change takes effect at the next renewal.
How do I cancel?
From the billing page in the portal, in one click. The plan runs to the end of what you have paid for and does not renew.
Does the price go up after the first term?
No. The price on the pricing page is the price on renewal. There is no introductory rate.
How can I pay?
Card, Apple Pay or Google Pay, through our payment processor; your card number never reaches us. Paying with cryptocurrency is planned and not built.
Where are my invoices?
On the billing page in the portal, as PDFs from the payment processor.
Privacy
Do you keep logs?
The servers that carry your traffic keep aggregate counters — packets, bytes, handshakes, failures — and have no field for a source address, a peer or a destination. Sign-in and billing keep what they need to run your account: email, a password hash, device keys, subscription status, the last four digits of your card. The privacy page lists it all.
What would you do with a legal request?
Answer it with what exists, which is the table on the privacy page. There is no connection history to produce, because there is no place one is written.
Do I need to give you an email address?
Yes, today. It is how you sign in and how you recover an account. Accounts without an email are not offered.
Has anybody independent reviewed this?
Not yet. When an independent review exists, it will be linked from the technology page.
Not answered here?
Write to [email protected]. Include the platform, the app version from the account menu, and what you expected to happen. A person reads it.