Privacy
What we know about you.
A list, not a promise. Where the answer is “nothing”, the reason is that there is no place to put it — and where there is a limit, that is on this page too.
Who sees what
| Fact | Your deviceThe app and the service | Nemean VPNSign-in, billing, and the servers that carry traffic | Site you visitThe other end |
|---|---|---|---|
| Your email address | Yes | PartlySign-in knows it — it is your username. The servers that carry your traffic are never told it; there is no field for it in what the app presents. | No |
| Your home IP address | Yes | PartlySeen when you sign in, as any website sees it, and while you are connected, because that is where the packets come from. Nowhere to record it against your account. | NoSees one of our addresses, shared with everyone else on it. |
| What you visit | Yes | PartlyForwards each packet to its destination and keeps no record of it. The counters have no field for one. | YesSees the visit, from our address. |
| That you have an account | Yes | YesSign-in, yes. The servers that carry your traffic see a valid credential — a tier and an expiry — and not whose. | No |
| What is inside your traffic | Yes | PartlyUnwraps the tunnel layer. What is inside — HTTPS, for most things — stays encrypted to the site. | YesAs it always has. |
What the servers that carry your traffic keep
These are the counters. They are the whole of it: the structure that holds them has no field for a peer identity, a source address or a destination, so one cannot be added by changing a setting.
Printed to the server’s own log every five seconds, when something has changed. Nothing about your account is consulted on the connection path, so there is no request to log on that side either.
What sign-in and billing keep
This is the part that knows who you are. It never sees a packet.
| Data | Why | How long |
|---|---|---|
| Email address | It is your username and how an account is recovered. | Until you delete the account. |
| Password | Stored as an Argon2id hash. We cannot read it. | Until changed or the account is deleted. |
| Sign-in sessions | A random token, stored hashed. The portal holds it as a cookie JavaScript cannot read. | 30 days, or until you sign out. |
| Devices | A name you give it and the device’s public key, so it can be revoked on its own. | Until you revoke it. |
| Subscription | Tier, status, the current period, and whether it renews. | While the account exists. |
| Payment method | Card brand, last four digits, expiry — for display on the billing page. The number never reaches us. | Until replaced. |
| Second factor | The authenticator secret, encrypted at rest; recovery codes, hashed. | Until disabled. |
| Invoices | Issued by the payment processor; we keep the reference. | As long as tax law requires. |
The portal also shows you the address your browser is coming from, on the overview page. That is echoed straight back to you and not written down.
What we cannot produce
A connection history
Which account connected to which server, when. The server does not know the account; sign-in does not know about connections.
Your browsing
Destinations, DNS names, the contents of anything. Sign-in never sees traffic; the servers forward it without recording it.
Bandwidth per account
Servers count bytes in total, not per session and not per anyone. There is no usage meter on your account because there is nothing to feed one.
Timestamps per account
Beyond sign-in sessions and billing dates, nothing on the account is stamped with when you used the tunnel.
Worth knowing
Listed here rather than left for you to find.
- DNS goes through the tunnel, and no third party logs it. While connected, names are resolved on the gateway, from the root — not forwarded to a public DNS provider — so neither the network you are on nor any one resolver operator sees the sites you visit.
- The payment processor knows you paid. They hold your card and your email for the subscription, under their own policy. Paying with cryptocurrency, which does not need that, is planned.
- A traffic server sees your source address for as long as you are connected. It has to, to send packets back. It has nowhere to write it, and it is gone when you disconnect.
The formal version
Built so the promise is hard to break
Most of this page would stay true if everyone who wrote it left tomorrow. That is the point of doing it in the architecture.