Partner Terms

These terms are for partners: services that create subscribers through the ProofKit Partner API or the Partner dashboard and give them VPN access under their own brand. The Terms of Service, Acceptable Use Policy, Privacy Policy and Refund & Withdrawal Policy apply to partners too; where these terms say something different, these terms apply. How the API works is on the Partners page.

01 /Your partner account

There is no self-serve sign-up: ProofKit sets up each partner and agrees its terms.

• The API key is how your backend creates subscribers and connects them. Keep it secret: whoever holds it can create subscribers and spend your balance. The first key comes from us, or from your owner account in the Partner dashboard if the partner has none yet. The owner account can also rotate the key there, at most 5 times an hour. After a rotation the replaced key keeps working for 24 hours so you can switch over. Only one replaced key is kept, so a second rotation within those 24 hours ends the earlier replaced key at once. A key we issue ends every older key at once, and revoking the key ends all of them. A partner without a backend adds subscribers in the Partner dashboard and needs no key.
• If a key leaks, one rotation is not enough: the leaked key keeps working for 24 hours. Rotate twice, which ends it at once, or ask us to issue a new key or revoke the old one.
• The owner account handles money and the key: a ProofKit account that signs in with an email address, which we attach to your partner. One account runs one partner, and a partner’s subscriber or billing account can’t be an owner. Attaching the account signs it out everywhere, and from then on it can’t sign in through any partner’s Telegram Mini App. It must have two-factor sign-in turned on (an authenticator app or codes from Telegram). Without it the Partner dashboard does not open at all (403 TWO_FACTOR_REQUIRED): the balance can’t be seen, and no wallet, withdrawal or key action works.

02 /Acceptable use

The Acceptable Use Policy applies to your subscribers’ traffic exactly as it applies to anyone else’s. Using ProofKit to get around censorship and protect privacy is welcome; attacks, spam, fraud, CSAM and the other uses that policy prohibits are not.

• Bind your subscribers to rules at least as strict as that policy, for example in your own terms of service.
• Cut off a subscriber who breaks them: Disable in the Partner dashboard, or DELETE /api/v1/partner/subscribers/{external_id} from your backend, ends its sessions and switches off its subscription URL.
• Our records identify a subscriber only by the external ID you give it. Use an ID that means nothing outside your system, not a phone number, email address or name.

03 /Torrent Guard

Torrent Guard is set per exit node. The Marketplace marks the nodes that run it No P2P; the Partner API catalogue does not show it. At the time of writing, every exit node on the network runs it. On such a node:

• BitTorrent is blocked on VLESS Reality and XHTTP. On those transports the node recognises BitTorrent traffic and drops it, together with connections to ports 6881–6889 and 6969, to known tracker domains, and to any domain name that contains “torrent”, or “tracker” followed by a dot. On Hysteria2 only the port and domain-name rules apply: BitTorrent traffic itself is not recognised there. olcRTC traffic leaves the node through the olcRTC server, not through Xray, so none of these rules apply to it. The upload check below applies on every transport.
• Sessions that upload too much are ended. Each time the node reports traffic, about once a minute, we compare every session’s total upload with its total download. Once a session has uploaded more than 30 GB, it is ended if it has uploaded more than the node’s limit allows: more than one and a half times what it downloaded, by default. A session that has uploaded less than 30 GB is not ended by this check, whatever it sends. The check counts bytes only, so past 30 GB of upload it ends any session over that limit, whatever the traffic is, very large backups included. An operator can also set a data limit per session, and a session that passes it is ended too, whatever its upload.
• What happens then. The node drops the session’s Xray credentials at once. For one hour the subscriber can’t start a new session through that exit node: a connect answers TORRENT_GUARD_COOLDOWN, and your subscribers’ subscription (hosted on proofkit.org or fetched by your server through the API) leaves that node’s routes out until the hour has passed. Its routes through other exit nodes are not affected. Traffic up to the end of the session is charged as usual. We don’t send you a notice when this happens, and the Partner API does not show why a session ended.

04 /Prices

Each node has its own price per GB. A GB through a node costs you that price plus a 20% network fee. If we agree a different price with you for a node, that price replaces the node’s own for your subscribers and does not move when the node’s price changes; the fee is added to it the same way.

olcRTC has a price of its own. From 00:00 UTC on 20 November 2026, olcRTC traffic is charged at one network-wide price per GB, the same for every exit and route (a route priced at 0 stays free, its olcRTC traffic too) and for partners and people who use ProofKit directly, with the 20% network fee included; until then it is charged at the route’s price like other traffic. The olcRTC price is read at every charge and is never locked into a session. olcRTC never passes an entry node, so a route through one adds nothing to it. We announce a rise at least 30 days before it starts, in olcrtc_pricing on GET /api/v1/partner/account and by a support ticket; a cut can start at once. A free trial covers olcRTC traffic: nothing is charged inside it. The price in force and the steps announced are in olcrtc_pricing on GET /api/v1/partner/account; the Partner API documentation explains them.

• The catalogue shows both numbers. In GET /api/v1/partner/catalogue, price_per_gb_nano is the node’s price for you, before the fee; total_price_per_gb_nano is what a GB through that node costs you, fee included; and fee_bps is the fee in basis points (2000 = 20%). For example, a node priced 10,000,000 nanoTON (0.01 TON) per GB costs you 12,000,000 nanoTON (0.012 TON) per GB.
• 2-hop routes enter through one node (an entry node in Russia is marked entry_region: "RU") and leave through another. They cost both nodes’ prices plus the fee: the two totals added together, give or take one nanoTON.
• How traffic is counted. A GB is 1,073,741,824 bytes, and upload and download both count. Charges are taken from your balance as the nodes report traffic, about once a minute.
• The price is locked when a session starts. If the node’s price later drops, the session follows it down; if it rises, the session keeps the lower price until it ends. New sessions take the current price. olcRTC traffic is the exception described above.
• Node prices can change without notice to you. A priced node’s settings allow one change a day and a rise to at most three times the current price; a node that is set up again can start from any price. The catalogue always shows the current prices.
• An unused session is closed. A session you open through the API (connect or olcrtc) that has carried no traffic an hour after it started is closed; open it again when it is needed. Active sessions in your subscribers’ subscription (hosted or fetched through the API) are not closed this way.
• Nothing else is charged. There is no monthly fee and no minimum spend. Amounts are whole numbers of nanoTON (1 TON = 1,000,000,000 nanoTON). TON’s own network fees for deposits and withdrawals are paid by your wallet.

05 /Paying in advance in TON

Partners pay in advance, in TON. Your partner wallet deposits into the ProofKit escrow contract on the TON blockchain, and your subscribers’ traffic is charged to your partner balance. There is no credit, and TON is the only way to pay.

• Link the partner wallet first. Your owner account links one TON wallet to the partner in the Partner dashboard on proofkit.org, by signing a TonConnect proof in that wallet. The wallet must be on TON mainnet and must not be linked to any other ProofKit account, your own personal account included. A wallet that has never sent a transaction may have to send one before it can be linked. Deposits count only from the linked wallet.
• Then deposit from it: with the dashboard’s top-up, which takes 0.1 TON or more, or from any app that holds the linked wallet, as a transfer to the escrow carrying the text comment deposit. Once a wallet is linked, GET /api/v1/partner/account gives that transfer as a ready-made link in deposit_link.
• The contract rejects any deposit under 0.05 TON, and every deposit while it is paused. A bounceable transfer (the dashboard’s top-up always is) comes back minus network fees; a non-bounceable one stays in the contract, credited to no one, and can only be put right by hand.
• Your balance rises when our payment checker sees the deposit on-chain. It checks every 30 seconds, so this normally takes about a minute.
• Changing the linked wallet is possible only once the old wallet holds none of your balance in the escrow and operators have claimed all traffic already charged to it: withdraw first. That withdrawal empties your balance, so your subscribers’ sessions close (see Withdrawing below).

06 /When the balance runs out

When your balance reaches zero outside a free trial:

• New sessions for your subscribers are refused with INSUFFICIENT_BALANCE, and every session they are running on a paid node is closed within about 15 seconds.
• Charges are booked as traffic is reported, so the balance can end a little below zero. The next deposit covers that first.
• Nothing restarts by itself after a top-up. Connect your subscribers again through the API; your subscribers’ subscription (hosted on proofkit.org or fetched by your server through the API) sets its routes up again the next time it is fetched.
• Watch balance_nano in GET /api/v1/partner/account. We don’t send balance alerts.

07 /Withdrawing the unspent deposit

Your deposit stays yours until traffic uses it. What your balance does not owe can be withdrawn at any time, to the linked partner wallet only.

• How. Your owner account asks for a withdrawal in the Partner dashboard. ProofKit signs an approval automatically, valid for 5 minutes; your partner wallet sends it to the contract, which pays the TON to that wallet. Your wallet attaches about 0.05 TON to pay for the transaction, and the contract sends back the part it does not use.
• How much. Up to your balance, and never more than your deposit in the escrow minus what is still owed from it: traffic charged but not yet claimed by operators, claims signed but not yet on-chain, and withdrawals approved in the last 10 minutes (in the last hour while the escrow’s figure for your wallet cannot be read).
• Withdrawing everything is the same as running out. A withdrawal comes off your balance when our payment checker sees it on-chain. If it takes the balance to zero outside a free trial, new sessions for your subscribers are refused and running ones close within about 15 seconds. Changing the linked wallet needs exactly that withdrawal, so it means a break for your subscribers.
• Large amounts. The platform signs at most 100 TON in one withdrawal and a limited total per day across the whole platform, so a large withdrawal can take several transactions and more than one day.
• If ProofKit pauses the contract. Once the contract has been paused for 30 days, every depositor, your partner wallet included, can withdraw its whole remaining deposit straight from the contract, without ProofKit’s signature. Lifting the pause and pausing again does not restart the count; days the contract runs unpaused count it back down. The payout is everything the contract holds for that wallet, traffic charged but not yet claimed by operators included. If ProofKit only stops signing and does not pause the contract, this way out does not open.

The Partner API never moves money: deposits and withdrawals are made only by your owner account and your wallet.

08 /The free trial

We can start a free trial for a new partner before it pays. A trial has three limits, set for each partner: an end date, a traffic allowance and a number of subscribers. The usual trial is 7 days, 50 GB and 10 subscribers.

• Inside every limit, your subscribers’ traffic is free: nothing is charged to your balance, subscribers can connect while the balance is empty, and their sessions are not closed for lack of money.
• The subscriber limit counts every subscriber you have created, disabled ones included. While the trial runs, creating one more answers 403 TRIAL_LIMIT; the subscribers you already have are never refused.
• Past any limit, the trial is over and you pay in advance like any partner, from the next traffic report on, without a restart. The report that crosses the traffic allowance is the last free one. If your balance is empty at that moment, your subscribers’ sessions are closed within about 15 seconds and new ones are refused, so top up before the trial ends.
• Your trial usage is under trial in GET /api/v1/partner/account: the end date, the limits, what has been used, and active, which says whether traffic is free right now.
• We start, extend and end trials: ask us. An extension adds days and can change the limits; the traffic already used still counts.

09 /Logs and privacy

Our Privacy Policy covers your subscribers like any other user. This is what is recorded about them, and where:

• The platform’s servers (the API and the website) don’t log the sites or addresses your subscribers connect to, the content of their traffic, their DNS queries or their IP addresses. Their VPN traffic goes from their devices to the nodes (on olcRTC, through a video-call service) and out to the internet; it never passes through the platform’s servers.
• What the nodes write to their own logs. Xray, which carries VLESS Reality, Hysteria2 and XHTTP, has no access log and records only warnings and errors, and nginx on entry nodes has access logging off. The olcRTC server writes a line when a session opens and when it closes, with a random session ID and an ID the subscriber’s app picks for the device; it also records errors, the state of its room and how many clients are connected. It does not write destinations, and it does not see the subscriber’s IP address; the video-call service does. These lines stay in the node’s own log, which rotates; the platform does not collect them.
• What the platform records for each subscriber: the external ID you gave it, its sessions (nodes, transport, start and end, bytes up and down, the locked price and how the session ended), its usage and cost about once a minute, its olcRTC room keys, and a notice with the upload and download figures when Torrent Guard ends one of its sessions. Our web servers also log each fetch of a subscription URL we host: the time, the URL (which carries the subscriber’s token) and the app’s user agent, but not the IP address. These records show which subscriber was connected through a given node at a given time and how much data it moved, not what it visited.
• Through the Partner API you see each subscriber’s running sessions (nodes, start time, bytes, locked price) and its usage and cost over any time window. Ended sessions, and why a session ended, are not shown.
• The node a subscriber connects to sees its IP address. On a direct route that node also sees where the traffic goes; on a 2-hop route the entry node sees the IP address and the exit node sees where the traffic goes. Whoever runs a server controls it. ProofKit runs the exit nodes and the public entry nodes today; an entry node can also be run by an operator, including a partner (see Nodes run by others).
• On olcRTC lines the subscriber’s app connects to the video-call service that carries the room (Yandex Telemost, WB Stream, SaluteJazz or VK Calls), which sees its IP address under its own terms, and the exit node looks up destinations through Google Public DNS (8.8.8.8).
• Subscription URLs hosted on proofkit.org are served through Cloudflare, like the rest of the site, and Cloudflare sees the IP address of whoever fetches them. A subscription your server fetches through the API with your key and serves from your own domain reaches us from your server’s address only. Opened in a browser, a hosted subscription URL shows a setup page with your title and support link, unless you switch it off.

10 /Best-effort availability

• Nodes can go offline, fill up or be blocked, and nodes can leave the catalogue.
• Censorship changes, and no transport is guaranteed to get through, including on mobile networks in Russia.
• Uptime figures in the Marketplace describe the past; they are not a promise.
• You pay per GB, so traffic that does not move costs nothing. There are no service credits for downtime.

The warranty and liability sections of the Terms of Service apply.

11 /Suspension for abuse

If your subscribers’ traffic breaks the Acceptable Use Policy, or you misuse the API or the platform, we may end the sessions involved, ask you to cut off a subscriber, or suspend your partner. We aim to act proportionately.

• While your partner is suspended, your API key is refused and your subscribers can’t start new sessions.
• Sessions already running are not ended by the suspension. They keep carrying traffic until they end or we end them, and that traffic is charged to your balance at each session’s price, even during a free trial; they close when the balance runs out. A subscription we host for you keeps listing them, without your branding.
• A suspension doesn’t take your deposit. It stays in the escrow under your partner wallet, and what your balance does not owe is still yours, though sessions still running keep spending it. The Partner dashboard is closed while the partner is suspended, so open a support ticket, signed in as your owner account, to withdraw it.
• Repeated or serious abuse can end the partnership.

To report abuse, email [email protected] with the IP address involved, the date and time (with time zone) and what happened.

12 /Nodes run by others

A node on the network can be run by an operator other than ProofKit. Such a node is private: it is offered only to the subscribers of the partners it is granted to, never to anyone else’s, and it links to a ProofKit exit node only with our permission, which we can withdraw at any time.

• If you are a partner whose subscribers use such a node, its operator sees what any entry node sees (section 9): your subscribers’ IP addresses, when they connect and how much data they move — not the content of their traffic, which stays encrypted from their devices to the exit node, and not where it goes. Sections 9 and 10 describe ProofKit’s own servers; they make no statement about a node someone else runs.
• If you run such a node, you run it: you are responsible for the server, its logs and the law where it stands. Keep it to what the node agent installs — a pass-through that terminates no encryption — and record nothing about the subscribers that pass through it beyond what section 9 says the agent records; access logging stays off. Sessions through your node are billed at the exit node’s price plus your node’s price and the network fee (section 4), and your node earns its price like any operator’s (see the operator terms). ProofKit promises nothing about the connection between your node and the exit node, may cap or block your node’s traffic on abuse, and may unlink or remove it at any time; you may remove it at any time too, and its subscribers then keep the routes the catalogue still offers them.

13 /Changes to these terms

We may update these terms; the “Last updated” date above will change. We tell partners about material changes, such as a change to the network fee, before they take effect. Using the service after a change takes effect means you accept it. Node prices change separately and without notice (see Prices); the catalogue always shows the current ones.

14 /Contact

[email protected] for these terms and abuse reports. For billing questions and any other help, open a support ticket, signed in as your owner account. See also the Partners page and the Imprint.