← Back to blog

What we collect, what we don't, and how to verify

A specific list, not a marketing claim — and the reasoning behind each line.

Every VPN says "no logs". The phrase has been laundered into uselessness. A more honest framing: what is the smallest piece of identifying data the system holds, and where does that data live?

For QPOL the smallest unit is the voucher. The voucher is a bearer code; it's how the system knows you have access. Beyond that, the architecture intentionally has no place to remember who went where. There's no per-user analytics ledger — not because we promise not to look, but because the table to look at doesn't exist.

We do hold short-lived operational metadata: how many sessions are active right now, which nodes are healthy, which voucher activated when, how much balance is left on it. This is rotated frequently and not retained for analytics. It is the minimum needed to make the service operate.

We do not hold: browsing history, DNS queries, traffic contents, IP addresses linked to your identity. Voucher purchase channels are not crossed with traffic data. There is no cross-session profile.

Support communications — when you write to us — are kept long enough to resolve the issue, then deleted on request. If you'd rather not have the email at all, the same questions are usually answerable through the in-app status panel or the FAQ.

How do you verify any of this? You can't, fully, from the outside. No VPN provider can prove a negative on their own. What you can verify: the public footprint of the service. There's no email collection at signup. There's no card processor receipt linking you to QPOL. There's no analytics SDK loaded by the apps. The cabinet exposes the keys it stores in browser local storage. These are observable from your side, today.

For the things that aren't externally verifiable — what's actually in our database, what we'd do under pressure — the only real signal is consistency over time. We try to be specific in writing about what the system holds, and structurally absent in places where data would otherwise accumulate. An independent security review is on the roadmap and will land here when it's done.