| Email address | You sign in with an email code, or Sign in with Apple or Sign in with Google shares it | Identifies your account; sign-in codes and account notices | Until you delete your account |
| Name from Apple or Google | Only on your first Sign in with Apple, if Apple provides it, or when you sign in with Google, from your Google profile | Initial display name of your account; also kept as the label of that sign-in method | Until you change it or delete your account; the sign-in method's label until you delete your account |
| Account ID | Created with your account | Links your devices, purchases and usage; also sent to Apple as the purchase "appAccountToken" | Life of the account; afterwards only on the records listed below |
| Device code and device details | When the app signs in or connects | Device code (a one-way hash of the iOS vendor identifier), device name as reported by iOS, model identifier, iOS version, app version and language. Used for the online-device limit and compatibility | Life of the account. A device with no activity for 30 days is unbound automatically and no longer counts toward your devices. When you delete your account, the device name, model identifier, iOS and app versions and language are erased and only the device code, platform and usage times stay (see Deleting your account) |
| Connection-session metadata | Each time you connect, refresh or disconnect | Connect and disconnect times, the IP address your connection came from (and the country derived from it), the exit you selected, app and iOS version. Used to deliver the configuration, enforce the online-device limit and stop abuse | Connection-request records: 180 days |
| Traffic byte totals | Reported by our exit servers and by the app while connected | Upload and download byte counts per session window, plus the number of active connections. Used to meter your data allowance | Server reports: 400 days; app reports: 90 days |
| Purchases | When you buy service time in the app (the iPhone and iPad app does not sell data top-ups) | Apple transaction identifiers, product, date and the time or data credited. Used to credit your account and handle refunds | As long as required for accounting and tax records |
| Feedback | Only when you send the feedback form | Your message, the optional contact email you enter, and the diagnostic summary described below | Until the matter is closed, then as support history; deleted on request |
| Push token | If you allow notifications | Apple Push Notification service token, used to deliver account and service notices | Until you delete your account. Once notifications are turned off or the token stops working, it is disabled and nothing more is sent to it |
| Sign-in security log | Each sign-in attempt, including failed and blocked ones | The time, sign-in method, result and failure reason, source IP address, country or region, user agent, client platform and version, device identifier, and the email address entered or provided by Apple or Google. Used to detect account takeover and abuse | 12 months; deleted on request where the law allows |
| API request records | Each request the app sends to our servers | Source IP address, country or region, user agent, referring page, language, client platform and version, request path and time, response status, and the account and device identifier involved; when diagnostic logging is turned on, also the content of requests to endpoints that carry no credentials. Sign-in codes and other credentials are never recorded. Used to troubleshoot connection and configuration-delivery failures, measure activity, attribute referral channels and prevent abuse | Until no longer needed for troubleshooting, referral settlement and abuse prevention, then deleted |
| Sign-in codes | When you request a code | The code itself, so it can be checked | 1 day |
