Privacy Policy

Last updated: September 9, 2026

This policy explains exactly what Nullwire collects, why, and what we deliberately don't collect. We built our infrastructure specifically to avoid logging VPN activity — this document describes that design, not just a promise.

What we collect

• Account information: the email and username you register with, and your hashed password (we never store your password in plain text).
• Billing information: handled entirely by Stripe, our payment processor. We never see or store your full card number — Stripe shares with us only your subscription status and the minimum billing metadata needed to run your account (e.g. whether your subscription is active).
• Device information: when you add a device, we generate and store a WireGuard public key for it, along with the name you give it (e.g. "Home-Laptop") so you can tell your devices apart on your own dashboard — nothing more than a label you chose yourself. When it connects to a server, that device is leased an internal tunnel IP address for as long as it stays connected — the address is not fixed to the device permanently, and is released back to the pool once it disconnects (or automatically, after 30 days of inactivity, if it disconnects without telling us). This is required for the VPN to function — it is not traffic or usage data.
• Last-connected timestamp: we record when a device last connected to a given server, so we can tell the difference between "actively in use" and "abandoned" (see above) — nothing about what you did while connected, just that a connection happened. This is deleted along with the rest of that device's lease once it's inactive for 30 days.
• Trial/beta abuse prevention: if you use a free trial, we keep a record of the email and payment-method fingerprint used, specifically so the same person can't repeatedly claim new trials. Unlike other account data, this record is deliberately kept even if you later delete your account — it exists to prevent abuse of the trial system, not to identify you.
• Session cookies: a functional cookie that keeps you logged in, and a CSRF-protection cookie. Neither is used for tracking or advertising.

What we do not collect

• Which websites, servers, or services you connect to while using the VPN
• Your browsing history, DNS queries, or traffic content of any kind
• Session duration, bandwidth, or data usage — we know a device connected, never for how long or how much data moved
• Your real originating IP address tied to your VPN activity

How this is actually enforced, technically

This isn't just policy — it's how the infrastructure is built:

• Our VPN nodes run WireGuard, which by design keeps no connection history — only live, in-memory state about currently active connections, never written to disk.
• Our web server and reverse proxy are explicitly configured not to log requests or visitor IP addresses.
• Our database does not log queries — the one exception is the last-connected timestamp described above, kept only as long as a device's lease is active.
• Split-tunnel routing preferences ("tunnel profiles") are stored only on your own device, never on our servers.
• Error logs (used only to catch and fix bugs) occasionally include a username and device name when something fails — never traffic content, never your originating IP.

Third parties we share data with

• Stripe (payment processing) — receives your billing details directly; see Stripe's privacy policy.
• Resend (transactional email) — used only to deliver password reset emails; receives your email address and the content of that specific email.

We do not sell your data to anyone, for any reason.

How long we keep data

Account and device information is kept for as long as your account exists. If you delete your account, your devices are immediately revoked from our VPN nodes, and your account data is deleted from our database — with one exception: the trial/beta abuse-prevention record described above (email + payment fingerprint) is kept regardless, since its whole purpose is to survive an account being deleted and recreated. Stripe retains billing/invoice records independently of us, for as long as required for their own accounting and legal obligations — this is outside our control and standard for any payment processor.

We also keep daily backups of our database, retained for up to 90 days, so we can recover from a genuine failure (a lost server, a bad deploy). A backup taken before you deleted your account or a device may still contain that data until it ages out of this 90-day window — we don't selectively edit past backups, only let them expire.

Your rights

You can view or delete any of your devices at any time from your dashboard. You can delete your entire account at any time from the Billing page — this immediately revokes all devices and removes your account data. If you have questions about your data that aren't covered here, contact us at support@nullwire.app.

Children's privacy

Nullwire is not directed at children, and we do not knowingly collect information from anyone under 13 (or the relevant minimum age in your jurisdiction).

Changes to this policy

If we make material changes to this policy, we'll update the date at the top of this page.

Contact

Questions about this policy or your data: support@nullwire.app