A privacy-first WireGuard VPN that minimizes what it knows about you. No email required for free tier. Zero activity logs. Radically transparent architecture.
ChaCha20-Poly1305 encryption with Curve25519 key exchange. Every session gets Perfect Forward Secrecy.
If the VPN tunnel drops for any reason, all traffic is blocked. Your real IP never leaks — guaranteed.
We can't log what we can't see. Your traffic is encrypted end-to-end and routed through privacy-preserving relays.
What we know, what we don't, and what we physically cannot.
| Data Point | Collected? | Why / Why Not |
|---|---|---|
| Your browsing history | ✕ Never | Traffic is encrypted end-to-end. We only see the encrypted WireGuard packets. |
| Your real IP address | ✕ Never stored | Used only for the live tunnel session. Never written to disk or logs. |
| DNS queries | ✕ Never | DNS is tunneled through the VPN. Your ISP and we cannot see your DNS requests. |
| Connection timestamps | ✕ Never | We do not log when you connect or disconnect. Bandwidth is not tracked. |
| Account email (paid) | ✓ Yes (paid only) | Required for billing and account recovery. Free tier needs no email at all. |
| WireGuard public key | ✓ Yes | Required to route your encrypted traffic. Rotated on every new session. |
Every claim is backed by architecture, not marketing.
All DNS queries are forced through the encrypted WireGuard tunnel. Your ISP sees nothing.
IPv6 traffic is blocked at the firewall level when the VPN is active. No dual-stack leaks.
Route specific apps around the VPN without leaking your real IP to the rest of your system.
WireGuard keys are rotated with atomic DPAPI-protected vault writes. No partial states, no corruption.
Every admin action — key generation, node management, password changes — is audit-logged and tamper-evident.
Production runs on PostgreSQL with ACID transactions. SQLite is development-only. No data is ever lost.