Last updated 9 November 2026.
We do not record your activity
Our exit nodes and control plane are configured so that none of the following is written to disk, sent to us, or retained:
- the websites, services or IP addresses you connect to through the VPN;
- DNS queries (our resolvers run with query logging disabled);
- your real (source) IP address;
- connection, disconnection or handshake timestamps;
- session duration or the amount of data you transfer;
- your private keys, which are generated in your browser and never sent to us.
What we do store
| Data | Why | Kept until |
|---|---|---|
| Email address | Sign-in, receipts, essential service notices | You delete your account |
| Password hash (bcrypt) | Sign-in | You delete your account |
| Subscription record: plan, status, renewal date, amount, Stripe customer and subscription IDs | Billing | You delete your account (Stripe keeps its own payment records, see the privacy policy) |
| For each device: the name you give it, its public key, its assigned private tunnel address, its region and the date it was added | So the exit node accepts your device | You revoke the device or delete your account |
| Account event log: sign-up, payment, device added or revoked, with dates. No IP addresses. | Support and fraud prevention | 12 months, or account deletion |
What exists briefly in memory
To route packets at all, the tunnel software on an exit node holds, in RAM only, the current internet address your device is connecting from, the time of its most recent handshake and running byte counters. The node’s network-address translation table holds active flows in the same way. These are not written to disk, not collected by our control plane and disappear when the tunnel goes quiet or the server restarts. Our management software on each node can only add and remove public keys; it has no function to read these values.
Our website
The web server is configured without access logs, and we use no analytics, advertising or tracking scripts. The only cookie is the session cookie that keeps you signed in. Application error logs exist for debugging but do not include IP addresses.
Payments
Card payments are processed by Stripe. Stripe receives your card details, billing information and the IP address of the device you pay from, under its own privacy policy. We receive only a customer reference, the subscription status and the last four digits and brand of your card as shown in Stripe’s dashboard. Payment information is never linked to tunnel traffic, because we hold no tunnel traffic records to link it to.
Our hosting provider
Exit nodes run on servers rented from Hetzner Online GmbH. Like any network operator, Hetzner can observe encrypted traffic arriving at and leaving its data centres. It has no access to our tunnel keys or to the inside of the tunnel. We choose and configure the operating system ourselves.
Requests from authorities
If we receive a valid legal order we must respond to it. Because we do not have activity or connection records, we cannot say which customer used a given IP address at a given time. We can disclose only the account data listed above. See the abuse & legal page.
What we do not claim
EliteVPN has not yet undergone an independent no-logs audit. When it does, we will publish the report here. A VPN changes who can see your traffic; it does not make you anonymous to sites you sign in to or protect you from malware.
Questions: privacy@elitevpn.cloud.