Help · Security

What Is Logged (and What Isn't)

ProofKit's servers keep your account, your routes and their traffic and cost, and no IP addresses. Nodes run Xray and the entry proxy with logging off, but a node sees what any VPN server sees, and operator payouts are public on TON.

Open in the app All help topics
example
Kept:      account · routes · traffic per minute · payments
Not kept:  your IP address · the sites you visit (on ProofKit's servers)
Public:    payout transactions list payer wallets and amounts

This is the exact record, part by part, rather than a "zero logs" promise.

ProofKit's servers

  • Account: email (or Telegram ID), password hash, linked TON wallet, 2FA settings.
  • The sign-up code: the six-digit code mailed when you sign up opens the account; without it the account stays closed, and a sign-in with the right password before it asks for the code again.
  • Accounts nobody used: an account whose address was never confirmed and that was never used (no sign-in after the first two days, no connection, no payment, no wallet) is deleted 48 hours after sign-up; the address is free to sign up again.
  • Routes: which exit and entry nodes each route uses, its locked price, when it started and ended, and its status.
  • Traffic: bytes up and down per route, about once a minute, with the cost. No destinations.
  • Payments: deposits, charges, earnings and withdrawals, with their on-chain transaction hashes.
  • No IP addresses: sessions have no IP field and the audit log records none. Rate limits count requests per IP address, and each counter deletes itself after a minute (an hour on one endpoint); the sign-up doors keep a keyed hash of the address, not the address, for up to one day.
  • Web server logs, kept 10 days: the address requested (for your app's list fetches that includes your subscription token), the status, the referrer and the browser. No IP address.
  • Cloudflare sits in front of the website and processes request data under its own policy.

The nodes

  • A node learns no account details: your route appears to it as a random ID and a label like [email protected].
  • The node you connect to sees your IP address: the exit on a direct route, the entry on a 2-hop route. The exit sees the sites you connect to.
  • Xray (Reality, Hysteria2, XHTTP, WebTunnel) logs warnings only and writes no connection log or DNS log. It reads site names from connections to route them (Torrent Guard needs that) but does not write them down. On an exit that runs Torrent Guard's connection watch, the node's agent also reads each connection's destination in memory to count how many different ones a session reached in a minute. It never writes, logs or sends a destination: ProofKit receives counts only.
  • Entry nodes: nginx has its access log off and logs critical errors only.
  • olcRTC: the olcRTC server is a separate program. It writes a line to the node's system log when a session opens and when it closes, with a random session ID and a random ID your app picks for your device, so that faults can be traced. It does not write down where your connections go, and it never sees your IP address: the video service does. The log rotates and is not sent to ProofKit.
  • An operator has root on their own server and could change any of this. The config-verified badge reports on the Xray and nginx settings only, and it is a self-report.

On-chain

Operator payouts are TON transactions to the escrow contract. Each one lists the wallet addresses of the users whose charges it claims and the amount per wallet, and TON transactions are public.