No-logs VPN: what is recorded, and where

Stored, because billing and payouts need it:

• Your account: the email address or Telegram ID you sign in with, a password hash, an optional name, the TON wallet you link and your two-factor settings.
• Each session: the entry and exit node, the transport, when it started and ended, when traffic last moved, bytes up and down, and the price locked in when you connected.
• Usage lines, about one for each minute of traffic, with the bytes and the cost. They make up your bill.
• A ledger of your deposits, charges and withdrawals.

Not stored:

• Your IP address. It is not in the database, the web servers log requests without it, and the account audit log leaves it empty. Rate limiting counts requests per address in counters that expire within an hour at most.
• What you do online. Your traffic goes from your app to the nodes and never passes through ProofKit’s servers.

Cloudflare sits in front of the website and the API and processes your IP address under its own policy. Google Analytics runs only if you accept analytics cookies. Old records are not yet deleted automatically; how to ask for deletion is in the privacy policy.

• Deposits and withdrawals are TON transactions between your wallet and the escrow contract. Anyone can see the wallet address, the amounts and the times.
• Operators are paid through batch claims on the same contract. Each claim lists the wallet addresses whose deposits pay that operator and how much each one pays, so the operator, and anyone reading the chain, can see which wallets paid which operator, though not for what.
• ProofKit knows which account a wallet belongs to. Operators get wallet addresses, never your email or account.

If you want your VPN spending kept apart from the rest of your crypto activity, top up from a wallet you use only for this.

• Whoever runs a node controls that server. The network is open, so anyone can run a node. The node software keeps logging off as described above, and each node reports every hour whether its Xray and nginx settings still do; that report is the config-verified badge in the marketplace. But the report comes from software on the operator’s own server: someone with root access can change it, or capture traffic some other way. ProofKit cannot see or prove what happens on a node.
• 2-hop splits what each node knows only if different people run the two nodes. The entry knows your address but not your destinations; the exit knows your destinations but not your address. The network allows one operator to run both, and that operator could match the two ends by timing.
• A VPN hides your traffic from your network, not from the sites you use. Signing in to a site identifies you to that site, with or without a VPN.

• Top up from a wallet you use only for this, and sign up with an email address you use only here.
• Pick exits without the WARP badge if you do not want Cloudflare to see your destinations.
• Read the privacy policy for the legal side: who processes what, and your rights.