Our VPN logging policy is a list of what we keep, and for how long.
Every record Morke keeps about an account is listed here with how long it lives, and none of them holds what your traffic contained or which sites it reached.
Two of the records we keep cost us something. Both leave the live database within hours.
The first is written each time somebody tries to sign in or create an account, and it includes a keyed digest of the address the attempt came from. The digest is not the address, and it is still derived from the address: two attempts from one address match, which lets the rate limit count that address's attempts. The window is 15 minutes for signing in and 1 hour for creating an account, and a job deletes attempts past their window every hour, so one can exist for up to about 2 hours.
The second is a presence record: that an account had traffic on a given exit node during a 10-minute window. It holds nothing about what that traffic was. Kept long enough, these records would show roughly which exit node an account used and when, so a timer prunes them every 30 minutes against a 2-hour window, and none stays longer than about 2.5 hours.
Every record, and how long it lives. Shortest first.
1.0Traffic content and destinations
- 1.1Holds
- No row exists, in any table
2.0Signup replays
- 2.1Holds
- A digest of the signup's retry key, and the reply, sealed under that key
- 2.2Kept for
- Void after 15 minutes, deleted by the hourly job
3.0Sign-in and signup attempts
- 3.1Holds
- The action, the key's prefix, a keyed digest of the address, the result, the time
- 3.2Kept for
- Up to about 2 hours
4.0Node presence
- 4.1Holds
- That an account had traffic on an exit node in a 10-minute window
- 4.2Kept for
- Up to about 2.5 hours
5.0Backups and the archive
- 5.1Holds
- An encrypted copy of each database every night, and an encrypted archive of every change to the main database with the time it was made; the key that opens them is held off the server
- 5.2Kept for
- The newest 14 nightly copies on the server; every copy sent off it deleted within 40 days; the archive, about the last 36 days
6.0Operational metrics
- 6.1Holds
- Counts per host, node and route, never per account
- 6.2Kept for
- 40 days
7.0Device sessions
- 7.1Holds
- A credential prefix and hash, the platform, your label, the status, the day it was last used, the last app version reported, a link to its exit-node user, and whether its credential was switched off, for a lapsed subscription or a suspension; the exact time of last use is kept apart and left out of the backups
- 7.2Kept for
- Until 60 days idle; 30 for a browser session
8.0Exit-node users
- 8.1Holds
- One per device set up to connect: a name built from the Account ID and the device, that device's credential, a running traffic count, and when it last carried traffic
- 8.2Kept for
- Until that device's session ends
9.0App Attest keys, on iPhone
- 9.1Holds
- A key ID, a public key, a counter and when it was last used, with no reference to any account
- 9.2Kept for
- While in use; retired after 60 days unused, and deleted 30 days later
10.0Changes we make to an account
- 10.1Holds
- A log line for each change we make by hand: the Account ID, what changed and when; for a check of the account's purchases with Apple, also Apple's reference for each and the result
- 10.2Kept for
- Up to 90 days
11.0Account
- 11.1Holds
- The Account ID, the key's prefix, a hash of the key, an opaque purchase reference handed to the App Store, whether it is suspended, and the day a removed device was last used
- 11.2Kept for
- Until it is deleted, by you or after 92 days unused, never while a subscription is live; a deleted account keeps the ID, its dates and the purchase reference
12.0Subscriptions
- 12.1Holds
- The plan, whether it renews, when it runs out, its status, and Apple's reference for the purchase, which only Apple can link to an Apple Account
- 12.2Kept for
- No end date, and kept after the account is deleted
Backups keep what the database deletes. Every copy is gone within 40 days.
Each night every database is encrypted as it is copied, and the copy holds it as it stood at that moment. The server keeps the newest 14 copies of each, and every copy sent off it is deleted within 40 days. The main database is also archived as it changes, encrypted the same way. The archive holds every version of every row and the time each was written, and covers about the last 36 days. The copies made after 23 October 2026 leave out the sign-in attempts, the presence records and the exact times of last use. A copy made on or before that day can still hold them, and the last of those is deleted by 2 December 2026.
The rest of it is on other pages. Why each record may be kept is a legal question.
The same records are on the privacy page, with the reason each one is allowed. What an account is made of is on the home page, and why the product was built this way is in the manifesto.