Transparency report.

What governments and other parties have asked of us, and what we were able to give them. Spoiler: by design, there is very little to give.

Requests received

If we ever receive a legally binding request, we will handle it exactly as described in our law-enforcement guidelines: validity review, minimum lawful disclosure — which can never include browsing activity, because it is never recorded — and user notification unless prohibited. This page will be updated accordingly.

What we could produce, at most

For a given account, the complete universe of data that exists is: the email address, the dates of registration and last sign-in, the subscription state and payment references held by our payment processors, the list of signed-in device labels, WireGuard public keys, and up to 12 months of authentication-event metadata (IP and country at sign-in). Nothing else exists. No browsing history, no DNS logs, no traffic content, no VPN connection source IPs.

Our standing commitments

• We have never built, and will never build, a backdoor or interception capability.
• We have never been asked to log a specific user's traffic. If we were legally compelled to and could not defeat the order through legal remedies, we would withdraw the Service from that jurisdiction rather than silently comply.
• We publish material changes to this page and to our policies before they take effect.

Verify, don't trust

Claims are cheap. Where you can, verify: the apps run on WireGuard and IKEv2 — open, publicly reviewed protocols; the account dashboard shows you every device and session we know about, which is also everything there is; and our privacy policy lists every data category we hold, so a subject-access request under GDPR/KVKK will show you exactly what your record contains.

Contact

Questions, or legal process to serve: support@crispyvpn.com.