Privacy Policy

Last updated: 08 Dec 2025

Policy overview

We do not store activity logs of any kind. We believe in minimal data retention: we want you to remain anonymous.

However, to operate the service (manage subscriptions, limit simultaneous connections), we must process some data. This policy explains exactly what we store, why, and when it is deleted, using a “Technical Evidence” approach.

1. Our anonymous, code-based accounts

We do not ask for any personal information – no username, no password, no email address. Instead, a random 16-digit code (user_code) is generated.

Important for Support:

• Never share your 16-digit Account Code (user_code) publicly or even with our support team unless explicitly asked in a secure channel.
• For all support inquiries, use the Support Code generated in the app (Menu -> Support Code). This is a temporary, 8-character code (e.g. ABCD-1234) valid only for one day, which allows us to find your account without exposing your master credentials.

2. Device Data (What we store and why)

To enforce the 5-device limit and help with troubleshooting, we store the following metadata when you authorize a device:

Retention: This data is stored until you Sign Out that device or remove it via the “My Devices” menu.

3. What we don’t log

We log nothing that can be connected to an account’s activity:

• No logging of traffic contents or destinations.
• No logging of DNS requests.
• No logging of original IP addresses.
• No logging of connection history (start/stop times).

Technical Evidence

To prove this, here are the actual configuration snippets from our production servers:

Nginx (Web & Proxy):

# No access logs (no-logs policy)
access_log off;
error_log /dev/null crit;

OpenVPN:

verb 0
status /dev/null
ifconfig-pool-persist /dev/null

Xray (VLESS / Shadowsocks):

"log": {
  "loglevel": "warning",
  "access": "/dev/null",
  "error": "/dev/null",
  "maskAddress": "full"
}

4. Active Session State (How we limit connections)

Question: How do you limit the maximum number of simultaneous connections (5 devices) if you don’t log activity?

Answer: We maintain a real-time state of currently active sessions in our central database. This is not a history log; it is a list of “who is connected right now”.

Important: If a server is seized, this “active state” might theoretically show which devices are connected at that exact moment, but it contains no history of past connections or traffic data.

5. Server Metrics

We monitor the health of our servers to ensure speed and stability. We collect aggregated system metrics only.

6. Payments

We support two payment methods. Data handling differs by provider:

A. Telegram Stars (In-App)

Payments are processed by Telegram. We receive only confirmation metadata.

B. Cryptocurrency (NowPayments)

We use NowPayments as a processor.

7. Support

If you contact support (Email or Telegram Bot):

• Email: We keep correspondence to resolve your issue. Deleted after 1 year or upon request.
• Telegram Support Bot: Messages are stored in the chat history. You can delete the chat at any time.

Contact

• Privacy/Legal: [email protected]
• Support: [email protected]
• Support bot: @glitch_vpn_support_bot