How to Read a VPN Privacy Policy in 5 Minutes

Every VPN homepage says "we protect your privacy". The privacy policy is the one place where a provider has to say exactly what it keeps, for how long, and who else sees it. You do not need a law degree to read one. Open the policy, use your browser's "Find on page", and answer these five questions.

1. What does it keep while you are connected? (1 minute)

Search for "connection", "session" and "log". You are looking for two different things:

Activity: the websites you visit and what you do on them. A VPN should keep none of this, and the policy should say so in plain words.

Connection records: when you connected, to which server, and how much data you used. Many VPNs keep some of this, for example to count data on a free plan. That can be normal, but the policy should list exactly which fields it keeps and say whether your IP address is one of them.

Warning sign: a single sentence that says "we keep no logs" and nothing else. A policy that names each field is more honest than one that names none.

2. For how long? (1 minute)

Search for "days", "months" and "retention". Look for a number next to each kind of data. "As long as necessary" is not a number.

3. What does the app send back? (1 minute)

Search for "crash", "diagnostic" and "analytics". Most apps send crash reports so the developer can fix bugs. The policy should say what is in them (for example the device model, the app version or a picture of the screen), whether they are linked to your account, and who runs the server that receives them. Advertising or tracking tools inside a VPN app are a warning sign.

4. Who else gets your data? (1 minute)

Search for "third part", "share", "processor" and "DNS". Every company uses some outside services: payments, email, hosting. A good policy names them and says what each one receives. Pay attention to DNS, the lookups that turn a website name into an address: the policy should say which DNS service answers them and whether the lookups travel inside the VPN tunnel.

5. Where is the company, and what happens when the policy changes? (1 minute)

Search for "governing law", "jurisdiction" and "changes". The country a company is registered in decides which authorities can ask it for data. Also check whether the provider promises to tell you before the policy changes, and whether the policy shows a version number and a date.

Three warning signs

Words without numbers: "minimal", "temporary", "as needed", with no list of fields and no days.

The homepage and the policy disagree. The policy is the document that counts. If the homepage promises more than the policy, believe the policy.

No date and no version number. You cannot tell what changed, or when.

How CasperVPN answers these questions

We try to pass our own test. Our privacy policy carries a version number and a date, lists each kind of data we keep with the number of days we keep it, and names the payment and DNS services we use. It also says that crash reports from the iPhone and iPad app go to an error-tracking server we run ourselves and are linked to your account, so we can fix the problem and reply to you. When a sentence in it turned out to be wrong, we corrected it and said so in the policy itself. If anything in it is unclear, write to [email protected].

A privacy policy is a promise, not proof. Read it next to our guide No-Log VPN: What the Claim Actually Means, and check that your VPN is really on with Is Your VPN Really On? A 3-Minute Check.

---

CasperVPN encrypts your internet connection with WireGuard, OpenVPN, IKEv2 and CasperCloak, our own protocol, on iPhone and iPad (Mac app coming). Download CasperVPN →