Privacy policy
Effective and last updated: September 9, 2026
Privacy-first, with no activity logs
HushTunnel does not monitor or retain browsing activity, traffic destinations, DNS queries, or VPN payloads. We keep only the minimum account, subscription, aggregate quota, and payment records needed to operate the service.
This policy applies to the HushTunnel website, account service, iOS app, Android app, and the VPN tunnel service they provide.
How the VPN tunnel processes traffic
HushTunnel uses Android VpnService and Apple Network Extension only to create the secure device-level tunnel you request. VLESS, REALITY, and XTLS are used to provide modern transport that can resist common DPI-based classification; they do not require us to retain your activity. While connected, network packets, destination addresses and ports, DNS requests, and content pass through memory on your device and the selected HushTunnel endpoint only as needed to route the connection. The tunnel is encrypted from your device to that endpoint. Protection beyond the endpoint depends on the destination protocol, such as HTTPS. We do not record or retain browsing history, DNS requests, traffic destinations, or payload contents.
Data we keep
We store your email address, a bcrypt password hash, internal user and role identifiers, subscription and service-credit status, selected plan/server and credential status, aggregate bytes used for quota enforcement, and payment/order records such as product, amount, currency, transaction identifier, status, and refund state.
Technical and security data
Our infrastructure may temporarily process IP address, request time, app or operating-system version, and error details to deliver requests, prevent abuse, and diagnose failures. We do not combine this operational data with tunnel destinations or content to build an activity profile. Operational logs are kept on a short rolling basis and longer only when needed to investigate a specific security incident or satisfy law.
How we use it
This limited information is used only to authenticate your account, provision service, enforce the plan you chose, process purchases and support requests, secure the platform, and meet accounting or legal obligations.
Legal bases
Where data-protection law requires a legal basis, we process account, subscription, usage, and purchase data to perform our contract with you; security and limited operational data for our legitimate interests in reliability and abuse prevention; records when required by law; and optional processing only with consent. You may withdraw consent at any time, without affecting earlier lawful processing.
No traffic monetization
Other than transient processing needed to provide the VPN connection you request, HushTunnel does not sell, use, or disclose data from VPN traffic to third parties for any purpose. We never redirect or manipulate traffic for advertising or monetization.
Processors and disclosure
Hosting and edge providers process encrypted connections and limited operational data to run the service. Apple, Google, RevenueCat, and payment providers process account or purchase information—not VPN activity data—only to complete purchases, prevent fraud, and maintain entitlements. Support providers process information you choose to send. We require providers to protect data to the same or an equivalent standard and disclose information only when legally required.
Payments and service providers
Apple, Google, RevenueCat, and the payment provider you choose process payment details under their own policies. HushTunnel receives transaction identifiers and purchase status, but does not store full card numbers, bank credentials, or private cryptocurrency keys.
Retention and deletion
Account settings let you permanently delete your account immediately. VPN credentials and identifying account data are removed; limited financial records may be retained in anonymized form when required for accounting, refunds, fraud prevention, or law. Deleting the account does not cancel an Apple or Google subscription.
International processing
HushTunnel and its service providers may process limited account and operational information in countries other than yours. Where required, we use contractual, technical, and organizational safeguards appropriate to the transfer. VPN traffic may exit through the endpoint you select, which can be in another country.
Website cookies
The website uses essential cookies for authentication, security, and your language preference. We do not use advertising cookies or build cross-site profiles. Blocking essential cookies may prevent sign-in or account features from working.
Your choices and consent
You can decline the VPN disclosure and use no tunnel, disconnect at any time, remove the VPN permission or configuration in device settings, and permanently delete your account in Account Settings. Contact us to request access or correction. Withdrawal does not affect processing already lawfully completed.
Your privacy rights
Depending on your location, you may have rights to access, correct, delete, restrict, or object to processing, receive a portable copy, or complain to a data-protection authority. Email support@hushtunnel.com to exercise a right. We may verify account ownership and may retain information when a legal exception applies.
Security
We use access controls, encrypted transport, password hashing, and isolated service credentials. No system is risk-free, so we minimize the data we hold and restrict operational access.
Children
HushTunnel is not directed to children under 13, or under 16 where local law requires that age. Contact us if you believe a child provided personal information.
Policy changes
If a material change affects VPN traffic processing or personal data, we will revise the date, provide notice in the app or service, and request renewed consent when required.
Questions or privacy requests
Contact support@hushtunnel.com. Material policy changes will be posted here with a revised date.
support@hushtunnel.com