Privacy
What we know about you.
A list, not a promise. Where the answer is “nothing”, the reason is that there is no place to put it — and where the design is weaker than we would like, that is on this page too.
Who sees what
| Fact | Your deviceThe app and the service | NemeanSign-in, billing, and the servers that carry traffic | Site you visitThe other end |
|---|---|---|---|
| Your email address | Yes | PartlySign-in knows it — it is your username. The servers that carry your traffic are never told it; there is no field for it in what the app presents. | No |
| Your home IP address | Yes | PartlySeen when you sign in, as any website sees it, and while you are connected, because that is where the packets come from. Nowhere to record it against your account. | NoSees one of our addresses, shared with everyone else on it. |
| What you visit | Yes | PartlyForwards each packet to its destination and keeps no record of it. The counters have no field for one. | YesSees the visit, from our address. |
| That you have an account | Yes | YesSign-in, yes. The servers that carry your traffic see a valid credential — a tier and an expiry — and not whose. | No |
| What is inside your traffic | Yes | PartlyUnwraps the tunnel layer. What is inside — HTTPS, for most things — stays encrypted to the site. | YesAs it always has. |
What the servers that carry your traffic keep
These are the counters. They are the whole of it: the structure that holds them has no field for a peer identity, a source address or a destination, so one cannot be added by changing a setting.
Printed to the server’s own log every five seconds, when something has changed. Nothing about your account is consulted on the connection path, so there is no request to log on that side either.
What sign-in and billing keep
This is the part that knows who you are. It never sees a packet.
| Data | Why | How long |
|---|---|---|
| Email address | It is your username and how an account is recovered. | Until you delete the account. |
| Password | Stored as an Argon2id hash. We cannot read it. | Until changed or the account is deleted. |
| Sign-in sessions | A random token, stored hashed. The portal holds it as a cookie JavaScript cannot read. | 30 days, or until you sign out. |
| Devices | A name you give it and the device’s public key, so it can be revoked on its own. | Until you revoke it. |
| Subscription | Tier, status, the current period, and whether it renews. | While the account exists. |
| Payment method | Card brand, last four digits, expiry — for display on the billing page. The number never reaches us. | Until replaced. |
| Second factor | The authenticator secret, encrypted at rest; recovery codes, hashed. | Until disabled. |
| Invoices | Issued by the payment processor; we keep the reference. | As long as tax law requires. |
The portal also shows you the address your browser is coming from, on the overview page. That is echoed straight back to you and not written down.
What we cannot produce
A connection history
Which account connected to which server, when. The server does not know the account; sign-in does not know about connections.
Your browsing
Destinations, DNS names, the contents of anything. Sign-in never sees traffic; the servers forward it without recording it.
Bandwidth per account
Servers count bytes in total, not per session and not per anyone. There is no usage meter on your account because there is nothing to feed one.
Timestamps per account
Beyond sign-in sessions and billing dates, nothing on the account is stamped with when you used the tunnel.
What is still open
Listed here rather than left for you to find.
- DNS is not in the tunnel yet. Your resolver — usually your ISP’s, or whatever you have set — sees the names you look up. This is the biggest open item and it is planned.
- Sign-in knows when a credential was issued to you. It does not learn what you did with it, but an adversary who controlled both sign-in and a traffic server could, in principle, correlate the two by timing. Blind-signed tokens would close this and are the reserved next version of the credential.
- The payment processor knows you paid. They hold your card and your email for the subscription, under their own policy. Paying without that is planned and not built.
- A traffic server sees your source address for as long as you are connected. It has to, to send packets back. It has nowhere to write it, but it is in memory.
- Nobody independent has checked any of this. Yet.
The formal version
Built so the promise is hard to break
Most of this page would stay true if everyone who wrote it left tomorrow. That is the point of doing it in the architecture.