Privacy policy.

We built Crispy VPN so that we know as little about you as technically possible — and this policy tells you, in plain language and then in full legal detail, exactly what that means. No hidden clauses, no vague wording: what we collect is listed below, item by item, and nothing else.

1. Who we are & scope

This policy covers the Crispy VPN applications (iOS, Android, macOS, Apple TV), the Crispy VPN browser extensions (Chrome, Edge, Firefox), and the crispyvpn.com website (together, the "Service"), operated by Crispy VPN ("we", "us"). It explains what personal data we process, why, for how long, and the rights you have over it. Where this policy and any marketing statement differ, this policy controls.

2. What we do not collect

• No logs of the websites you visit, the apps you use through the tunnel, or the content of your traffic.
• No DNS query logs.
• No connection timestamps tied to your identity, and no logs of the source IP addresses you connect to the VPN from.
• No per-user bandwidth accounting.
• No sale, rental, or sharing of personal data for advertising — we do not "sell" or "share" personal information as those terms are defined in the California Consumer Privacy Act.

3. What we collect, why, and on what legal basis

• Account data. Email address, a salted PBKDF2 hash of your password (we cannot read the password itself), the date you registered, and the platform you signed up from (for example "Chrome extension" or "Website"). Basis: performance of our contract with you.
• Signed-in devices. For each active session: a device label (such as "Chrome · macOS" or a name your app provides), the client platform, and first/last activity times. You can see and revoke every device on your account page; removing a device deletes its record and ends its session immediately. Basis: contract and our legitimate interest in securing accounts.
• Security log. Sign-in, sign-out, registration, password-change, device and billing events, together with the IP address and country they came from. We keep these for at most 12 months, then delete them automatically. Basis: legitimate interest in preventing fraud and abuse. Transient rate-limiting counters (IP-based) expire automatically within one hour.
• WireGuard keys. If a device connects over WireGuard, we store its public key, the internal tunnel address we assigned, and which node it registered on. The private key never leaves your device. Removing the device deletes its keys. Basis: contract.
• Payment records. Card and PayPal payments are processed by Whop / Stripe and PayPal; we receive and store only subscription identifiers and plan status — never card numbers. Cryptocurrency payments are processed by a payment processor; we store the payment identifier, chosen currency, amount, deposit address, and status. In-app purchases are handled entirely by Apple and Google. Basis: contract and legal obligations (tax, accounting).
• Mobile app service data. The iOS and Android store apps work without an account. They register an app-instance push token (Firebase Cloud Messaging) so we can deliver service messages, together with a premium flag and a last-activation date. This record is not linked to a name or email. Basis: contract.
• Advertising in the free apps. The free tier of the mobile apps shows ads served by Google AdMob. AdMob may process device identifiers under Google's privacy policy; consult your device settings to limit ad personalization. Our paid tiers, the browser extensions, and this website contain no advertising at all.
• Newsletter. If you subscribe to Crispy Weekly, we store that email address solely to send the newsletter, until you unsubscribe. Basis: consent.
• Website statistics. crispyvpn.com keeps an aggregate daily page-view counter — no fingerprinting, no per-visitor records. Google Ads conversion measurement runs on the site outside the EEA and the UK; it is the only third-party tag we use.
• Support. If you email us, we keep the correspondence for as long as needed to help you and to keep a record of the resolution. Basis: legitimate interest.
• Server health. VPN nodes report transient, aggregate metrics (total load, liveness) that contain no per-user data.

4. Retention

Account data is kept while your account exists and deleted when your account is deleted. Security logs are deleted automatically after at most 12 months. Device and WireGuard records are deleted the moment the device is removed. Payment records are kept for as long as tax and accounting laws require. Newsletter addresses are kept until you unsubscribe.

5. Processors & third parties

We share personal data only with the processors needed to run the Service, each bound by its own privacy commitments: Cloudflare (website and API hosting), Whop / Stripe and PayPal (payments), a cryptocurrency payment processor (crypto payments), Apple and Google (app distribution, in-app purchases, push delivery, AdMob in the free apps, web fonts), and the infrastructure providers that host our VPN nodes — which, by design, hold no user database at all. Standard request metadata (such as your IP address) is technically visible to a host while it delivers content to you. We never give any third party access to personal data for its own marketing.

Affiliate tracking (Awin). Some partners link to crispyvpn.com through the Awin network. When you arrive through such a link, the URL carries a click reference (awc) that we store in a first-party cookie (awc, 1 year, HttpOnly) together with a short "last click" marker (crispy_lc, 60 days), and we keep the same reference on your account if you sign up or sign in. If you later buy your first subscription on the website, we tell Awin the order reference, amount, plan type and that click reference — not your name or email — so the partner can be paid; Awin's own tag (loaded from dwin1.com) runs on our pages for the same purpose. Renewals and app-store purchases are never reported. Legal basis: our legitimate interest in paying partners for sales they refer; in the EEA and the UK, Awin's tag is told whether you accepted cookies in our banner. Awin AG's privacy notice is at awin.com/gb/privacy.

6. International transfers

Our infrastructure spans multiple countries. Where personal data is transferred out of the EEA, the UK, or other jurisdictions with transfer rules, we rely on recognized safeguards such as the European Commission's Standard Contractual Clauses or our processors' equivalent certified frameworks.

7. Your rights

Depending on where you live — including under the EU/UK GDPR, the California CCPA/CPRA, and Türkiye's KVKK — you may have the right to access, correct, export, restrict, object to the processing of, or delete your personal data, and the right to complain to your local supervisory authority. To exercise any of these rights, email support@crispyvpn.com from your account address; we respond within 30 days and will verify the request belongs to the account holder. Deleting your account removes your email, password hash, devices, and keys; records we must keep by law (such as payment records) are retained only as long as that law requires. We never discriminate against you for exercising a privacy right.

8. Security

All traffic between you and the Service is encrypted in transit. Passwords are stored only as salted PBKDF2 hashes. VPN tunnels use modern protocols (WireGuard, IKEv2) with per-device keys. Internal access to production systems is restricted and credentialed. No system is perfectly secure — if we ever learn of a breach affecting your personal data, we will notify you and the relevant authorities as applicable law requires.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

10. Legal requests — our law-enforcement guidelines

This section is our binding internal policy for handling requests from any government, court, or authority, published so that both users and authorities know it in advance:

• There are no activity logs to produce. Browsing history, DNS queries, traffic content, connection source IPs, and per-user bandwidth are never recorded — by architecture, not by promise. No legal order can compel the production of data that does not exist.
• Only valid, binding process is honored. We act only on legally binding orders that are valid in the jurisdiction where the data controller operates. Informal requests, emails, or foreign orders without effect in that jurisdiction (for example, lacking an applicable MLAT/letters-rogatory basis) are declined and the requester is directed to the proper legal channel.
• Every request is reviewed and narrowed. We review each order for legal basis, scope, and proportionality, challenge overbroad or unlawful requests through available legal remedies, and disclose the minimum the order lawfully compels — which can never exceed the short list in Section 3.
• Users are notified where lawful. Unless we are legally prohibited from doing so, we notify the affected account before disclosure so they can seek their own remedies.
• No backdoors, ever. We do not build interception capabilities, weaken encryption, or grant any authority direct access to our systems, and we would exhaust legal remedies against — or withdraw service from a jurisdiction rather than comply with — any order to do so.
• Public accountability. Statistics about legal requests are published on our transparency page.

11. Changes to this policy

We may update this policy as the Service evolves. The current version always lives at this address with its "last updated" date. If a change materially reduces your rights, we will give notice on the website or in the apps before it takes effect.

12. Contact

Privacy questions and requests: support@crispyvpn.com.