AetherVPN is architected around mathematical least-privilege. Our service operates strictly without logging user network activity.
1.1 What We Never Collect, Store, or Log
Browsing Traffic: We do not monitor, record, or store the websites you visit, the domains you resolve, or the IP addresses you communicate with.
DNS Queries: All DNS lookups resolved through our internal relays (`10.64.0.1`) run in volatile memory without disk write operations.
Connection Timestamps: We do not maintain logs recording incoming client IP addresses or session start/end timestamps.
Cryptographic Secrets: Your private WireGuard Curve25519 keys are generated on your local device and protected by Windows DPAPI. We never receive or store private keys.
1.2 Information Required for Operation
Account Token: A randomly generated 16-digit hexadecimal identifier (e.g. `7391-4288-1952`) used to authenticate subscription status.
Subscription Status: Current active tier (Free, Plus) and subscription expiration date provided by our payment processor.
Active Device Slots: Curve25519 public keys and human-readable device nicknames (e.g. "Work Laptop") to enforce the maximum 5-device limit.
Payment Processing: Transactions are handled by Stripe. AetherVPN never sees or stores full credit card numbers.
2. Terms of Service & Acceptable Use
By using AetherVPN, you agree not to use the service for activities that interfere with network operations, compromise systems, or transmit malicious code.
Fair Use: High-bandwidth relays are shared among active subscribers. Automated denial-of-service or port scanning attacks will result in immediate device revocation.
30-Day Money-Back Guarantee: If you are not completely satisfied with AetherVPN within the first 30 days of subscription, contact support for a full refund.
3. Warrant Canary
-----BEGIN AETHERVPN WARRANT CANARY-----
As of September 11, 2026:
1. AetherVPN has received ZERO National Security Letters (NSLs).
2. AetherVPN has received ZERO court gag orders regarding user data.
3. AetherVPN has received ZERO warrants demanding backdoors or private keys.
4. No user private keys have been compromised or disclosed.
Next scheduled verification: December 11, 2026.
-----END AETHERVPN WARRANT CANARY-----
4. Threat Model & Realistic Security
AetherVPN encrypts your connection between your device and our edge relays, preventing ISP surveillance and local Wi-Fi packet sniffing. However, a VPN does not neutralize malware on a compromised machine, cannot stop you from voluntarily identifying yourself by logging into third-party accounts, and cannot prevent browser fingerprinting.
5. Security Policy & Vulnerability Disclosure
AetherVPN uses WireGuard with ChaCha20-Poly1305 encryption, Curve25519 key exchange (RFC 7748), and Windows DPAPI for local private key storage. Our kill switch enforces Windows Firewall rules to block all non-tunnel traffic.
5.1 Responsible Disclosure
If you discover a security vulnerability in AetherVPN, please report it responsibly to security@aethervpn.network. We commit to acknowledging receipt within 48 hours and providing an initial assessment within 5 business days. Valid vulnerability reports may be eligible for a bounty.
Key Exchange: Curve25519 with RFC 7748 Montgomery ladder clamping
Local Key Storage: Windows DPAPI (Data Protection API, CurrentUser scope)
Control Plane Auth: HMAC-SHA256 signed JWTs (7-day client, 4-hour admin)
Admin Password Hashing: PBKDF2-HMAC-SHA512, 600,000 iterations, 256-bit salt
6. Refund Policy
AetherVPN offers a 30-day money-back guarantee on all paid subscriptions. If you are not satisfied with the service for any reason, contact support@aethervpn.network within 30 days of your purchase date to request a full refund.
Refunds are processed back to the original payment method within 5-10 business days.
Founder Plan purchases are eligible for the same 30-day guarantee.
Accounts terminated for acceptable use policy violations are not eligible for refunds.
7. DMCA / Copyright Notice
AetherVPN respects intellectual property rights. If you believe that content transmitted through our network infringes your copyright, please send a notice to dmca@aethervpn.network including:
Identification of the copyrighted work claimed to have been infringed.
The IP address, timestamp, and sufficient information to identify the alleged infringement.
Your contact information, including name, address, and email.
A statement that you have a good faith belief that the use is not authorized by the copyright owner.
A statement under penalty of perjury that the information is accurate and you are authorized to act on behalf of the owner.
Note: AetherVPN does not log browsing history or connection timestamps. We may not be able to identify specific users without valid legal process. We forward valid DMCA notices to our edge relay operators for network-level action where technically feasible.