Privacy Policy
Last updated:
1. Summary
Jacaf VPN is built to know as little about you as possible. In short:
- We do not log what you do on the VPN: no browsing history, no traffic destinations, no connection times and no session lengths.
- You sign up with a randomly generated account number. But an email address is not optional for resetting password reasons.
- Your real IP address is only held in our VPN server's memory while you are connected. It is never written to disk and is removed automatically within 30 minutes after you disconnect.
- Our website has basic analytics on how many users and from what country they come from, no advertising trackers and no tracking cookies.
- We only keep the data we need to run the service, and we delete it on a fixed schedule (see section 10).
This policy explains exactly what we process, why, for how long, and who else is involved. It applies to the Jacaf VPN service, our apps and configuration files, and our website.
3. What we do not collect
When you use the VPN, we do not collect or store:
- the websites you visit, the content of your traffic, or the IP addresses and services you connect to;
- when you connect or disconnect, how long you stay connected, or which VPN server address you were using at a given time;
- your real IP address on disk;
- your name, postal address or phone number (we never ask for them).
We do not sell, rent or share your data for advertising, and we do not treat devices, protocols or applications differently.
4. Data we process when you use the VPN
Your devices
Each device you add gets its own WireGuard configuration. In our account database we store the name you give the device, a random device ID, the private tunnel address we assign to it (for example 10.xx.x.x) and the date it was added. The device name stays in our account database and is never sent to the VPN server. The VPN server stores the device's ID, tunnel address, WireGuard public key and preshared key, your account number, the date the device was added and the end date of your plan, so that it can enable or pause your devices according to your plan. It also stores the time of the device's most recent connection handshake, which we show to you as “last seen” on your devices page.
Your device's private key
When you add a device, the VPN server generates its WireGuard key pair and builds your configuration file. The private key is held in memory only long enough to deliver the file to you. It is never written to disk, to our database or to our logs, and we keep only the public key. Your configuration file also contains a preshared key, an additional shared secret that adds a second layer of encryption; the server needs to keep this to recognise your device, so it is stored alongside the public key, but on its own it cannot be used to connect as your device. The file reaches you over an encrypted connection through our hosting and security provider, Cloudflare, and the page that delivers it is marked so that it is not cached. Because we do not keep your private key, we cannot send you the same configuration file again. If you lose it, revoke the device in your account and add a new one.
Your IP address while connected
To send traffic back to your device, the VPN server needs to know your current IP address and port while you are connected. This is held only in the server's working memory (RAM). It is never written to disk or to any log. When your device has been inactive for 20 minutes, the server removes it automatically, together with the time of your device's last key exchange (handshake). In every case this happens within 20 minutes of disconnecting. Your configuration file keeps working, and the server learns your address again the next time you connect.
Data usage totals
To show you how much data you have used and to apply data limits, we count the total amount of data (in bytes) each account sends and receives per calendar month. We also keep hourly totals for each server as a whole; these contain no account information and cannot be linked to you. We do not record when you were connected or how your usage was spread over time.
5. Your account
When you create an account, we generate a random account number. For each account we store:
- the account number;
- your password, only as a secure salted hash;
- whether the account is enabled, and your current plan and its end date;
- the date the account was created;
- the date and time of your most recent login to the website, which we show to you so you can spot a login that wasn't yours (it is overwritten each time you log in);
- the number of recent failed login attempts and, if needed, a temporary lock, to protect your account against password guessing;
- your email address;
- if we give you a complimentary plan: the plan, its end date and which administrator granted it.
6. Our website
Cloudflare
Our website is delivered and protected by Cloudflare. All requests to the site pass through Cloudflare's network, so Cloudflare necessarily processes your IP address, browser information and the content of your requests, including anything you type into forms such as your account number and password. Cloudflare uses this to deliver the site and protect it against attacks.
Bot protection on the login page
Our login page uses Cloudflare Turnstile to check that a real person is logging in. The check runs in your browser and communicates directly with Cloudflare. When our server verifies the result with Cloudflare, it does not send your IP address.
Rate limiting
To slow down password guessing and spam, our server counts how many requests come from each IP address. These counters are kept only in the server's memory, are never written to disk, and expire after at most one hour.
Server logs
Our web server does not keep access logs. Technical system logs on our servers are stored in memory only and deleted after at most four days. They are configured not to contain the IP addresses of website visitors or VPN users. They can contain an account number in technical error messages or in records of actions taken by an administrator.
Cookies
We only use cookies that are strictly necessary for the site to work. We do not use advertising cookies.
| Cookie | Purpose | Duration |
|---|---|---|
session |
Keeps you logged in and holds a security token that protects our forms against cross-site request forgery. | Until you log out or the session expires |
lang |
Remembers the language you chose. | 1 year |
Cloudflare security cookies (for example __cf_bm or cf_clearance) |
May be set by Cloudflare when it needs to check that a visitor is not an automated bot. | Short-lived, set by Cloudflare |
7. Payments
Card payments (Stripe)
Card payments are handled by Stripe on a checkout page hosted by Stripe. Stripe collects the payment details you enter, such as your card details, name, email address and billing country, and may ask for a VAT number if you are buying as a business. We never see or store your full card number. We send Stripe an order reference instead of your account number. If you have added an email address to your account, we pre-fill it on Stripe's checkout page.
Cryptocurrency payments (Cryptopay)
We are preparing to accept cryptocurrency payments through Cryptopay. When this is available, Cryptopay will process the payment and the wallet information involved. We will store the invoice reference, the price, and the cryptocurrency and amount you paid.
What we store about payments
For each order we store: the order reference, your account number, the plan, number of devices and data allowance, the price and currency, the order status, the date of the order and of payment, the period it covers, and the payment provider's references for the payment (needed for refunds).
Stripe and Cryptopay also process some of your data as independent controllers, for example for fraud prevention and to meet their own legal obligations such as anti-money-laundering checks. Their own privacy policies apply to that processing: Stripe privacy policy and Cryptopay privacy policy.
8. Email and support
Optional email address
If you add an email address, we use it only to let you reset your password and to send you security messages about your account, such as confirmation that your password was changed. We do not send marketing emails. Password reset codes are stored only as a hash, expire after a short time, and are deleted once used or expired. Emails are sent through [email protected].
Support
If you email us, we process your email address and whatever you write, so we can answer you. Please do not send us more personal information than needed.
9. Why we process your data (purposes and legal bases)
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Providing the VPN service and applying your plan's limits | Account number, device data, IP address while connected, monthly usage totals | Performance of our contract with you (Art. 6(1)(b)) |
| Logging in and protecting accounts | Account number, password hash, last login time, failed login attempts, rate-limiting counters | Contract (Art. 6(1)(b)) and our legitimate interest in protecting accounts against attacks (Art. 6(1)(f)) |
| Password reset and security emails | Email address, password reset codes | Contract, as a feature you choose to switch on (Art. 6(1)(b)) |
| Taking payments | Order data, payment provider references | Contract (Art. 6(1)(b)) |
| Bookkeeping | Records of paid and refunded orders | Legal obligation (Art. 6(1)(c)) |
| Keeping the website secure and available | IP address, request data, browser signals (via Cloudflare and Turnstile), system logs | Legitimate interest in protecting our service and users (Art. 6(1)(f)) |
| Answering support requests | Email address, message contents | Legitimate interest in helping you (Art. 6(1)(f)), or contract where it concerns your subscription |
| Remembering your language | Language cookie | Legitimate interest in showing the site in the language you chose (Art. 6(1)(f)) |
Where we rely on legitimate interest, you can object at any time (see section 16).
10. How long we keep your data
| Data | How long |
|---|---|
| Your IP address while connected to the VPN | Memory only. Removed within 15 minutes after you disconnect |
| Rate-limiting counters on the website | Memory only. At most 1 hour |
| Server system logs | Memory only. At most 2 days |
| Device data (name, public key, tunnel address) | Until you remove the device or your account is deleted |
| Monthly usage totals | Current and previous calendar month |
| Account data | Until you delete your account, or until it is deleted automatically (see below) |
| Email address | Until you remove it or your account is deleted |
| Password reset codes | Until used or expired. Expired codes are deleted within 24 hours |
| Complimentary plan records | Deleted within 24 hours after the complimentary period ends |
| Unpaid or abandoned checkouts | 30 days |
| Failed payment attempts | 25 minutes |
| Paid and refunded orders | For the period required by Irish accounting and tax law: 6 years (see the Companies Act 2014) |
| Support emails | 70 days after the conversation ends |
Automatic deletion of inactive accounts
To avoid keeping accounts nobody uses:
- accounts without an email address are deleted after 6 months without an active plan;
- accounts with an email address that have never had an active plan are deleted 2 years after they were created.
When an account is deleted, its devices are removed from our VPN servers and its account data, email address and usage totals are deleted. Records of paid orders are kept until the end of the bookkeeping period above, as the law requires.
12. Transfers outside the EU/EEA
Some of our providers are based in, or transfer data to, the United States. For these transfers we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework (for providers certified under it) and on the European Commission's Standard Contractual Clauses. Transfers to Canada rely on the European Commission's adequacy decision for Canada. You can ask us for more information about these safeguards using the contact details in section 2.
Cloudflare's privacy policy is available here: Cloudflare privacy policy.
14. How we protect your data
Passwords are stored only as secure hashes. Connections to our website and to the VPN are encrypted. Access to our servers is restricted to administrators. We design the service to store as little as possible, so that there is little to protect in the first place.
15. Automated decision-making
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Some technical measures happen automatically according to fixed rules described in this policy, such as temporarily locking an account after repeated failed logins, or deleting inactive accounts.
16. Your rights
To use these rights, email us at the address in section 2 and include your account number. We may ask you to confirm that the account is yours, for example by logging in. We will answer within one month.
Our service is designed not to identify users. We can only answer requests about data linked to an account number or email address that you give us. We cannot identify you from other information, and we are not required to collect extra data just to do so (Article 11 GDPR).
Some requests can limit what we can do for you. For example, if you ask us to delete your email address, we can no longer help you recover a lost account. We may also have to refuse a request where the law requires us to keep the data, such as payment records.
You also have the right to lodge a complaint with a data protection authority. In Belgium this is the Data Protection Authority Dublin Office: 6 Pembroke Row, Dublin 2, D02 X963, Ireland https://www.dataprotection.ie. You can also complain to the authority in the EU country where you live or work.
17. Changes to this policy
We may update this policy when our service or the law changes. The latest version is always published on our website with the date it was last updated. If you have added an email address and a change significantly affects your data, we may also notify you by email.