Privacy

What we know about you.

A list, not a promise. Where the answer is “nothing”, the reason is that there is no place to put it — and where the design is weaker than we would like, that is on this page too.

Who sees what

What each party can see. “No” means there is no mechanism for it, not that there is a rule against it.
FactYour deviceThe app and the serviceNemeanSign-in, billing, and the servers that carry trafficSite you visitThe other end
Your email addressYesPartlySign-in knows it — it is your username. The servers that carry your traffic are never told it; there is no field for it in what the app presents.No
Your home IP addressYesPartlySeen when you sign in, as any website sees it, and while you are connected, because that is where the packets come from. Nowhere to record it against your account.NoSees one of our addresses, shared with everyone else on it.
What you visitYesPartlyForwards each packet to its destination and keeps no record of it. The counters have no field for one.YesSees the visit, from our address.
That you have an accountYesYesSign-in, yes. The servers that carry your traffic see a valid credential — a tier and an expiry — and not whose.No
What is inside your trafficYesPartlyUnwraps the tunnel layer. What is inside — HTTPS, for most things — stays encrypted to the site.YesAs it always has.

What the servers that carry your traffic keep

These are the counters. They are the whole of it: the structure that holds them has no field for a peer identity, a source address or a destination, so one cannot be added by changing a setting.

packets, bytesReceived and sent, in total
handshakesCompleted, and failed
auth failuresCredentials rejected
isolatedPackets dropped for aiming at another client
filteredPackets dropped for a bad source address
cookies issuedUnder load
active sessionsA number, reported every 30 seconds so the app can pick a quiet server

Printed to the server’s own log every five seconds, when something has changed. Nothing about your account is consulted on the connection path, so there is no request to log on that side either.

What sign-in and billing keep

This is the part that knows who you are. It never sees a packet.

DataWhyHow long
Email addressIt is your username and how an account is recovered.Until you delete the account.
PasswordStored as an Argon2id hash. We cannot read it.Until changed or the account is deleted.
Sign-in sessionsA random token, stored hashed. The portal holds it as a cookie JavaScript cannot read.30 days, or until you sign out.
DevicesA name you give it and the device’s public key, so it can be revoked on its own.Until you revoke it.
SubscriptionTier, status, the current period, and whether it renews.While the account exists.
Payment methodCard brand, last four digits, expiry — for display on the billing page. The number never reaches us.Until replaced.
Second factorThe authenticator secret, encrypted at rest; recovery codes, hashed.Until disabled.
InvoicesIssued by the payment processor; we keep the reference.As long as tax law requires.

The portal also shows you the address your browser is coming from, on the overview page. That is echoed straight back to you and not written down.

What we cannot produce

  • A connection history

    Which account connected to which server, when. The server does not know the account; sign-in does not know about connections.

  • Your browsing

    Destinations, DNS names, the contents of anything. Sign-in never sees traffic; the servers forward it without recording it.

  • Bandwidth per account

    Servers count bytes in total, not per session and not per anyone. There is no usage meter on your account because there is nothing to feed one.

  • Timestamps per account

    Beyond sign-in sessions and billing dates, nothing on the account is stamped with when you used the tunnel.

What is still open

Listed here rather than left for you to find.

  • DNS is not in the tunnel yet. Your resolver — usually your ISP’s, or whatever you have set — sees the names you look up. This is the biggest open item and it is planned.
  • Sign-in knows when a credential was issued to you. It does not learn what you did with it, but an adversary who controlled both sign-in and a traffic server could, in principle, correlate the two by timing. Blind-signed tokens would close this and are the reserved next version of the credential.
  • The payment processor knows you paid. They hold your card and your email for the subscription, under their own policy. Paying without that is planned and not built.
  • A traffic server sees your source address for as long as you are connected. It has to, to send packets back. It has nowhere to write it, but it is in memory.
  • Nobody independent has checked any of this. Yet.

The formal version

This page is the plain account. The privacy policy is the same facts in the shape the law asks for. If the two ever disagree, tell us — one of them has a bug.

Built so the promise is hard to break

Most of this page would stay true if everyone who wrote it left tomorrow. That is the point of doing it in the architecture.