Privacy Policy

Last updated: [DATE — fill in when you publish this]

This policy explains exactly what Nullwire collects, why, and what we deliberately don't collect. We built our infrastructure specifically to avoid logging VPN activity — this document describes that design, not just a promise.

What we collect

• Account information: the email and username you register with, and your hashed password (we never store your password in plain text).
• Billing information: handled entirely by Stripe, our payment processor. We never see or store your full card number — Stripe shares with us only your subscription status and the minimum billing metadata needed to run your account (e.g. whether your subscription is active).
• Device information: when you add a device, we generate and store a WireGuard public key and an assigned internal tunnel IP address for that device. This is required for the VPN to function — it is not traffic or usage data.
• Session cookies: a functional cookie that keeps you logged in, and a CSRF-protection cookie. Neither is used for tracking or advertising.

What we do not collect

• Which websites, servers, or services you connect to while using the VPN
• Your browsing history, DNS queries, or traffic content of any kind
• Connection timestamps, session duration, or session history
• Your real originating IP address tied to your VPN activity
• Bandwidth or data usage per session

How this is actually enforced, technically

This isn't just policy — it's how the infrastructure is built:

• Our VPN nodes run WireGuard, which by design keeps no connection history — only live, in-memory state about currently active connections, never written to disk.
• Our web server and reverse proxy are explicitly configured not to log requests or visitor IP addresses.
• Our database does not log queries, connections, or disconnections.

Third parties we share data with

• Stripe (payment processing) — receives your billing details directly; see Stripe's privacy policy.
• Resend (transactional email) — used only to deliver password reset emails; receives your email address and the content of that specific email.

We do not sell your data to anyone, for any reason.

How long we keep data

Account and device information is kept for as long as your account exists. If you delete your account, your devices are immediately revoked from our VPN nodes, and your account data is deleted from our database. Stripe retains billing/invoice records independently of us, for as long as required for their own accounting and legal obligations — this is outside our control and standard for any payment processor.

Your rights

You can view, download a config for, or delete any of your devices at any time from your dashboard. You can delete your entire account at any time from the Billing page — this immediately revokes all devices and removes your account data. If you have questions about your data that aren't covered here, contact us at [PRIVACY CONTACT EMAIL].

Children's privacy

Nullwire is not directed at children, and we do not knowingly collect information from anyone under 13 (or the relevant minimum age in your jurisdiction).

Changes to this policy

If we make material changes to this policy, we'll update the date at the top of this page.

Contact

Questions about this policy or your data: [PRIVACY CONTACT EMAIL]