Legal

Privacy Policy

Last updated: 2026-10-05 · Contact: [email protected]

This policy covers proofkit.org, the dashboard, the Telegram bot and Mini App, and the VPN service behind them. It explains what we store, what we don’t, what the operators of the VPN nodes and other services can see, how long we keep things and how to get your data deleted. ProofKit is run pseudonymously; see the Imprint.

01 /The short version

  • We store your account (an email address or a Telegram ID, and the TON wallet you link), a record of each VPN session (which nodes, when, how many bytes, what it cost) and your payments.
  • Our platform doesn’t log the sites you visit, the content of your traffic, your DNS queries or your IP address, and the node software we ship keeps no log of the sites you visit or of your IP address.
  • The node you connect to sees your IP address. The network is open, so the operator of that node can be ProofKit or a third party. On a direct route one node sees both your IP address and where your traffic goes; on a 2-hop route the entry node sees your IP address and the exit node sees where it goes.
  • Payments are public. Deposits and withdrawals are transactions on the TON blockchain that anyone can look up.
  • Some other services see some of your data: Cloudflare in front of the site, Google Fonts on every page, Telegram if you use it, Brevo for email and, with olcRTC, a video-call service. Details are below.

02 /What we store

Your account

  • Email sign-up: your email address, a bcrypt hash of your password, whether the address is verified, and an optional display name.
  • Telegram sign-up: your Telegram user ID and the first name on your Telegram profile, which becomes your display name. The account gets an internal placeholder address (tg_…@proofkit.org) in place of an email address.
  • Optional: a linked Telegram ID (for sign-in, codes and notifications), a secret for authenticator-app 2FA, and the TON wallet address you link to deposit and withdraw.
  • Settings: your subscription token (the secret part of your subscription URL), which transports your subscription lists, and whether olcRTC is on.
  • Extra links: the name you give each extra subscription link, its own subscription token, and its sessions and usage, kept under your account.
  • Referrals and partners: your referral code, who referred you (if anyone), and the partner app you signed up through (if any).

Your VPN use

  • Sessions: for each connection, the node or nodes used, the transport, start and end time, bytes up and down, the price locked in at connect, and how the session ended.
  • Usage timeline: about once a minute while a session is active, the bytes moved in that interval and what they cost. Your bill is built from these records.
  • Keys: the random credentials your VPN app uses to connect, including a personal olcRTC key if you use olcRTC.
  • Speed tests: results of tests you run while signed in (speed, latency, jitter and the route tested).

Money

  • A ledger of your deposits, charges, withdrawals, referral commissions and (for operators) earnings and stakes, with the TON transaction hashes and the wallet addresses your deposits came from.

What you send us

  • Support tickets: your messages and any images you attach.
  • Node reviews: your rating and comment.
  • Encrypted notes (the Notes page): encrypted in your browser before upload; we store only the encrypted text, never the key.

Security records

  • An audit log of sign-ups, sign-ins and every connect (with the nodes and price), disconnect and route switch, with timestamps and without IP addresses.
  • Six-digit codes sent by email or Telegram. They stop working after 5–15 minutes.

If you run a node

  • Your nodes’ addresses, countries, prices and settings; their health, speed and traffic statistics (much of this is public in the Marketplace); stakes, earnings and payouts; and your notification settings.
  • If you connect a video-call account for olcRTC, its token is held only by a separate internal service, never in our database, and is deleted when you disconnect the account or your ProofKit account is deleted.

03 /What we don’t store

  • What you do online. We don’t record the sites or addresses you connect to, the content of your traffic or your DNS queries. Your VPN traffic never passes through the platform’s servers (the website, API and database): it goes from your device to the nodes and out to the internet.
  • Your IP address. Our web servers log requests without IP addresses. The platform uses your IP address only for a rate-limit counter that deletes itself after one minute (one hour on the endpoint that imports partner links), and never writes it to our database or logs.
  • Anything from the nodes about you beyond byte counts. For each session, nodes report only how many bytes moved, labelled with a random session ID.

04 /What the nodes see

Each node is run by its operator. The network is open to anyone who registers a node and stakes TON, so the operator of the node you connect to can be ProofKit or a third party. Your traffic is encrypted between your device and the node that decrypts it; after that node it travels to the website like any other internet traffic.

  • Direct route (one node): that node sees your IP address and where your traffic goes — the names and addresses of sites, and the content only of connections that are not themselves encrypted (HTTPS is).
  • 2-hop route: the entry node, often in your own country, sees your IP address, when you connect and how much data moves, but not where it goes. The exit node sees where it goes, but only the entry node’s address, not yours.
  • olcRTC: your app reaches the node through a room on a third-party video-conferencing service. That service sees your IP address and an encrypted call; the node sees where your traffic goes but not your IP address.
  • Nodes marked WARP send your outgoing TCP connections (most web traffic, but not olcRTC) through Cloudflare WARP, so websites see a Cloudflare address and Cloudflare carries that traffic.

The node software never receives your email, wallet or account ID. A node knows your session only by a random label such as [email protected] and a random key.

What the node software does. In the software we ship, Xray and nginx keep no connection log: Xray has no access log and records only warnings and errors, and nginx on entry nodes has access logging off and records only critical errors. The olcRTC server does record when a session opens and when it closes, with a random session ID and a random ID your app picks for your device, so that faults can be traced; it never records your IP address, which it does not see, or where your traffic goes. These lines stay in the node’s system log, which rotates, and are not sent to us. To route a connection the node reads the destination’s name, and on nodes marked No P2P it also recognises and blocks BitTorrent; this is not written to a connection log. Nodes report whether their configuration still matches what we ship, but that is a self-check, not proof: whoever runs a server controls it and could change it. A 2-hop route splits what each node sees, so no single node has both your IP address and your destinations; if the same operator runs both nodes, that operator could still put the two halves together.

05 /Other services that handle your data

  • Hetzner rents us the servers that run the site and the database, in Falkenstein and Nuremberg, Germany.
  • Cloudflare sits in front of proofkit.org, including the subscription URLs your VPN app fetches, for protection and load balancing. It processes every request, including your IP address, under its own privacy policy. It also forwards email sent to @proofkit.org addresses to us.
  • Brevo sends our emails: verification and password-reset codes, and operator notifications you switch on. It receives your email address and the message.
  • Telegram carries everything that goes through the bot or Mini App if you use them: sign-in data, 2FA codes, notifications, support alerts and occasional service announcements that the bot sends to every account linked to Telegram. Telegram can see these messages.
  • Google Fonts serves the site’s fonts on every page, so Google receives your IP address and browser details when a page loads.
  • Google Analytics runs only if you choose “Accept analytics” in the cookie banner. See the Cookie Policy.
  • jsDelivr serves a chart library to the home page and the dashboard, and Swagger UI to the Partner API explorer (/partner-api).
  • TON wallet connection. In the web dashboard (and in the Mini App when you tap Deposit) the TonConnect library fetches a list of wallets from config.ton.org and, while connecting to your wallet, contacts the wallets’ relay servers and sends usage events (for example, that a connection started or failed and, on some errors, your wallet address) to analytics.ton.org.
  • TON blockchain. Deposits, withdrawals and operator payouts are public, permanent transactions showing wallet addresses and amounts. We read the chain through tonapi.io.
  • Video-call services carry olcRTC connections (see above) under their own terms.
  • Partners. Some Telegram bots and apps offer ProofKit to their users. If you signed up in a partner’s Mini App, we record which partner. If a partner created your account and pays for your traffic, it can see your sessions and usage (nodes, times, bytes, cost), receives the connection settings for your sessions, and can switch your access off; it never sees what you visited.
  • Your VPN app. Happ, Hiddify, v2rayNG, Streisand, Ghostlane and other clients have their own privacy policies.

We don’t sell your data and we don’t use advertising networks.

06 /What other people can see

  • Node reviews are public, with your display name. For a Telegram sign-up, that is your Telegram first name.
  • An operator you message through support sees your message, any images you attach and a label such as “User 1a2b3c4d” — not your email.
  • Whoever referred you sees how many people joined with their code and their total commission, not your account details.
  • Anyone can see the deposits and withdrawals of your wallet address on the TON blockchain.

07 /How we use it

To run your account and sign you in; to connect you to nodes and bill the traffic you use; to pay operators; to detect fraud and abuse (for example, by cross-checking nodes’ byte counts and making our own test connections through them); to answer support requests; and to send the codes, alerts and announcements described above. If you allow Google Analytics, we use it to see how the site is used.

08 /Legal bases (GDPR/UK GDPR)

Where the GDPR applies, we rely on: performance of a contract (creating your account, providing and billing the service), legitimate interests (security, fraud prevention, keeping the network healthy), and consent (analytics cookies and optional notifications, which you can withdraw at any time).

09 /How long we keep it

  • Account, sessions, usage timeline, payments, support messages, reviews and the audit log: as long as your account exists. Old records are not deleted automatically.
  • Verification codes: unusable after 5–15 minutes, but not deleted automatically.
  • Encrypted notes: deleted when opened. Unopened notes expire after 1 hour to 7 days (the sender chooses), can no longer be opened, and are cleared out periodically.
  • Rate-limit counters with your IP address: one minute (one hour on one endpoint).
  • Web server request logs (the address requested, status, referrer and browser; no IP address): 10 days.
  • Application logs (these can include your account ID, your Telegram ID or the address an email was sent to): kept in server memory and overwritten within days.
  • Backups: we back up the database every day and keep each daily backup for 30 days. A full copy is also saved before each software update; those copies are currently not deleted on a schedule.
  • Blockchain transactions: public and permanent; nobody can delete them.
  • Your browser: see the Cookie Policy.

10 /What our records can and cannot show

Because we record which nodes each session used and when, our records can show which accounts were connected through a given node at a given time and how much data they moved. They cannot show which sites anyone visited or what they sent: the platform never receives that information and the node software does not record it.

11 /Your rights and deleting your account

Subject to applicable law you may ask for access to, a copy of, correction of or deletion of your personal data, and you may object to or restrict certain processing and withdraw consent. Much of your data is visible in your dashboard (profile, sessions, payments).

Deleting your account. There is no self-service delete button. Withdraw your balance first — an account that still holds a balance can’t be deleted — then open a support ticket while signed in and ask for the account to be deleted. Deletion removes your personal details (email address, display name, Telegram ID, wallet link and 2FA secret) and your sessions, speed tests, reviews, notifications and codes. What remains: transactions on the TON blockchain (public and permanent), payment records we need to keep the books straight, an internal note that the account was deleted (with its email address), and copies in backups until those backups are deleted.

12 /Security

Passwords are stored only as bcrypt hashes. You can turn on two-factor sign-in with an authenticator app or Telegram. The key that signs withdrawals and operator payouts sits in a separate internal signing service, not in the web servers. Nodes’ byte counts are cross-checked between the two nodes of a 2-hop route, against kernel counters and against our own test connections. No system is perfectly secure.

13 /Where your data is

Our website and database servers are in Germany (Hetzner, in Falkenstein and Nuremberg). The database has a live copy on a second server, which also keeps the daily backups; the copies taken before software updates stay on the database server. Nodes are in many countries — the Marketplace lists them — and your traffic is subject to the laws of the countries it passes through. The services listed above process data in their own locations under their own policies.

14 /Children

ProofKit is not directed to children under 16 (or the age of digital consent in your country). Do not use the service if you are under that age.

15 /Changes to this policy

We may update this policy; the “Last updated” date above will change. Material changes will be highlighted on the site.

16 /Contact

Data requests and privacy questions: [email protected], or a support ticket from your dashboard while signed in. See also the Imprint.