Logging Policy
This page explains what 4Anox keeps, what we do not keep, and why. We prefer transparent, limited logging over vague “zero logs” slogans.
[PRIVACY_REVIEW_REQUIRED] Owner-confirmed alignment with architecture/15_security_privacy_model.md (no destination logging). Counsel must still sign with Privacy Policy before Play — see legal/26_counsel_review_gl_p06_04.md.
Short version
| We do not keep | We may keep (minimized) |
|---|---|
| Browsing history / destinations through the VPN | Account identifiers you create |
| DNS query names from tunneled traffic for analytics | Device registration needed for limits |
| Connection timestamps tied to your identity for marketing | Aggregate capacity / health metrics |
| Packet payloads | Short-lived auth and entitlement state |
| VPN private keys | Support tickets you send us |
| VPN destinations typed into chat as “sites visited” (agents must not ask) | Chat transcripts for up to 90 days (support/admin only) |
Product analytics
Product analytics (when enabled and consented where required) may include:
- App version, OS version
- Screen / funnel events (e.g. connect tapped, connect succeeded/failed class)
- Crash-free session signals
Product analytics must not include VPN destination hostnames, URLs, or DNS names from your tunnel.
VPN infrastructure signals
To keep servers healthy and fair, operators may see:
- Aggregate concurrent sessions / bandwidth per region
- Node health and WireGuard handshake success rates
- Abuse signals (e.g. volume anomalies) without building a browsing profile
Exact retention windows for operational logs will be published here once production runbooks are finalized.
Account & billing
We store what is needed to authenticate you, enforce device limits, and reconcile Google Play entitlements (transaction ids, plan state). Store receipts are also held by Google under Play’s policies.
Support
If you email or open a ticket, we keep the content you send until the issue is resolved and for a limited period afterward for quality and dispute handling.
Live chat / AI assistant: Chat may start with an automated assistant grounded in our Help and Trust content; humans join only during published staffed hours. Transcripts are retained up to 90 days, then deleted or anonymized. Same minimization rules as tickets: no destination logging, no private keys, no full VPN configs.
Law enforcement
We respond to valid legal process. Because we do not maintain destination logs, we typically cannot produce browsing history. Account existence and billing metadata may still be in scope depending on the request and jurisdiction.
[LEGAL_REVIEW_REQUIRED] Transparency report cadence is a post-MVP commitment, not a Wave A guarantee.