Privacy
Most privacy pages describe a promise. This one describes a database, because the promise here is structural: the columns that would hold your identity do not exist, so no policy change and no future decision can start filling them. Below is what those tables actually contain.
Who is responsible
The controller of the data described here is cloudinfrastack, s.r.o., IČO 03350860, Tachovské náměstí 290/5, Žižkov, 130 00 Praha 3, Czech Republic. Contact: info@vpn.free. The full registered particulars are on the contact page.
What a purchase records
An order row, and nothing attached to a person. In full, it holds:
- a random order identifier;
- which plan was bought, the amount and the currency;
- which payment provider was used, and that provider's own reference for the invoice;
- the status of the order, and the times it changed;
- a SHA-256 digest of your recovery code, and a count of how many times it has been used.
When the certificate is issued, a second row records the certificate's own serial number, its fingerprint, its validity dates, its status, which platform asked for it, and a SHA-256 digest of your renewal secret.
That is the complete list for a purchase. There is no column for an email address, a name, an address, a country, a card fingerprint or an IP address, in any table, and no code path that could write one. Your recovery code and your renewal secret are stored only as digests, which is why we cannot send either back to you: we do not have them, we only have enough to recognise the right one when you present it.
If you make an account
An account is optional, and everything above stays true whether you have one or not. If you do sign in, three more rows can exist, and this is all of them.
- The account itself: a random identifier of ours, the name of the identity provider (our community forum), the opaque id that forum issued you, the date you first signed in, and a trust level between 0 and 4 that the forum publishes about its own members. There is no column for your email address, your forum name or your password, and the sign-in never gives us your password at all.
- Which purchases are yours: a row joining the account to a subscription. Two identifiers and a date.
- What you have earned: if you take part, a row per award with the kind, the number of days, a short reason, and a reference to what earned it: a report's tracking code, or the id of the forum topic you introduced yourself in.
- Which onboarding steps you have finished: one row per completed step, holding the step's name, when it completed, and the forum topic id where that is what proved it. Not the text of anything you wrote, which stays on the forum where you posted it.
The forum is a separate system with a separate privacy notice. It holds your email address and your password because it has to; we do not, and the identifier it gives us is meaningless anywhere else. What the forum holds is governed by its own terms, not by this page.
One further honest note, because it is the kind of thing that is easy to leave out: the form on the account page is the only place in this system where text you typed about yourself is stored. It is attached to your account and to nothing else, and it is never joined to a certificate or to any browsing.
That form now asks which sites you use VPN.free for, by address, and whether each one works. Those answers are stored against your account, which means that unlike everything else described on this page, they can be connected back to you: your account is your forum account, and the forum holds your email address. We are spelling that out rather than burying it, because a list of sites somebody visits can say a great deal about them, and for adult sites it is the kind of information the GDPR treats as a special category.
So: every question on that form is optional except giving us one site, you are free to name only the sites you do not mind naming, and you can ask us to delete the whole answer sheet at any time without losing anything you have earned or bought. We use the answers to decide which sites to fix first, where to put servers, and what to build. They are not sold, not shared, and not used for advertising.
To check that you have introduced yourself, we read the public list of topics in the forum's Introductions category and look for one you started. That is a page anyone on the internet can already load, we send no credential to fetch it, and we keep only the topic's number.
If you link a Discord account, we ask Discord one question: are you in the VPN.free server. We store the answer and your Discord user id, which is a number, and nothing else: not your Discord name, not your email, not the other servers you are in. We never ask Discord for permission to read any of those. The permission we do ask for lets us check membership of our own server and nothing more, and the access token Discord gives us is used once in that single request and never stored.
Linking is optional and you can decline it. What it costs you is that Discord learns you use VPN.free, because you authorise us on their consent screen. That is their record, not ours, and it is governed by Discord's own privacy policy rather than by this page. One Discord account can be linked to one VPN.free account, which is how we stop one person collecting the free subscription many times over.
What is in the certificate
A random credential identifier as its subject, an expiry date, and our signature. No name, no email address, no order number, no purchase date. It is deliberately the least informative document that can still prove somebody paid.
What we cannot avoid seeing
Being honest about this is the point of the page, so here is the part that is not zero.
- Your IP address, at the moment you connect. A connection cannot arrive without one. It is used to rate limit the purchase and enrollment endpoints, so that a leaked recovery code cannot be farmed for certificates. For that purpose it is hashed before it is stored, held in memory only, in a fixed window of one minute, and never written to the database or joined to an order or a certificate.
- Ordinary web server request logs. Serving a page produces them. They are operational, they are not joined to any order, and no recovery code or renewal secret ever appears in one: secrets travel in a request header or a body, never in a URL, precisely so that a log line cannot capture them.
- What your payment provider knows. We do not control this and we do not receive it. A cryptocurrency processor sees the wallet that paid; a card processor knows the cardholder. The payment step tells you which is which before you choose, and we never receive a name from any of them. Their own privacy terms apply to what they hold.
What we count
We count how many visits reach each step of this site (the offer, choosing
a plan, the payment page, paid, the certificate set up, the free-month
steps) and how each step ended. With each count we keep only: the step,
the plan and payment method you picked, the language your browser is set
to, whether it is a phone, the width of the window, the campaign tag in the
link that brought you here (for example utm_source=discord)
and the name of the site you came from, without its path.
We do not keep your IP address, your browser's identity string, a cookie or anything you typed with these counts, and nothing is stored in your browser for them. To see how far one visit got, the page makes a random number when it opens and sends it with that visit's counts. It lives only in the open tab: it is never saved, it is gone when you close the tab, and the next visit gets a new one, so it cannot recognise you when you come back. We use these counts to see where people give up, so we can fix that step.
We also count, on our server, how many people leave this site to sign in on the forum and how many come back signed in. We count how many forum accounts are created and activated, too, as totals only.
What this site does not do
No advertising or advertising identifiers. No third party scripts of any kind. No tracking cookies. The purchase state lives in your own browser's local storage, on your device, where we cannot read it.
There is exactly one cookie, and only if you sign in. It holds your
account identifier, an expiry date and your forum username, signed so it
cannot be edited. The username is there only so the account page can show
you which account you are signed in to; it is not written to our database
or our logs. It is
marked HttpOnly, so no script on the page can read it,
Secure, so it never travels unencrypted, and
SameSite=Lax. It is strictly necessary to keep you signed in,
which is why this site still has no consent banner: there is nothing here to
consent to. Signing out deletes it.
The premium pages are also deliberately outside the session replay and interaction logging that the free service runs. The screen that shows your recovery code is not a screen we are willing to be able to see.
How long it is kept
An order row is kept while it can still be collected or refunded, and then for as long as accounting and tax law requires us to keep a record of a sale, which in the Czech Republic is up to ten years. What is kept is the row described above: an amount, a date and an opaque identifier. There is nothing in it to anonymise, because there was never anything in it to identify.
Certificate records are kept until the certificate expires and then for as long as the revocation list has to remain accurate, so that a revoked certificate cannot quietly become valid again.
Who else gets it
The payment provider you chose, which receives the amount, the currency and the order identifier so it can tell us the invoice was paid. Our own hosting and infrastructure suppliers, who process data on our instructions. Nobody else. We do not sell data and we have nothing to sell.
Your rights, and the awkward truth about them
Under the GDPR you have the right of access, rectification, erasure, restriction, portability and objection, and the right to complain to a supervisory authority. In the Czech Republic that is the Office for Personal Data Protection, uoou.gov.cz.
Here is the awkward part, and we would rather state it than let you discover it: for an anonymous purchase we cannot identify you, so we usually cannot act on a request. Article 11 of the GDPR covers exactly this case. If you send us an order id we can tell you what that row contains and we can delete it where the law lets us. If you send us anything else, including an email address, we have nothing to match it against, because we never had it.
If you have an account this is easier, and you can do most of it yourself. Signed in, you can see every subscription and device we hold against you and remove any of them. Ask us through the forum, or quote your account identifier, and we will export or delete the account rows described above. Deleting the account does not delete the order rows we must keep for accounting, and it does not revoke a certificate: those are separate things and we will say which one you have asked for before we do it.
Deleting an order row before its certificate expires does not switch off the certificate, and deleting the certificate record revokes it. Ask for whichever you actually want and we will say which one you have asked for before we do it.
Legal basis
Performance of the contract, for the order and certificate records (Article 6(1)(b)), and for the account and session cookie where you have asked for an account. Our legitimate interest in keeping the service from being abused, for the rate limiting, the device limits, the forum trust level and the request logs (Article 6(1)(f)). A legal obligation, for the accounting retention (Article 6(1)(c)). We do not rely on consent for anything, which is why this site has no consent banner.
Changes
If this page changes, the date at the top changes with it. We have no email address for you even if you have an account, because we never receive one, so this page is the only notice we can give and we will not pretend otherwise.