Privacy Policy

TurboTunnel VPN is run by TurboTunnel Limited, a company registered in England and Wales (company number 17391634), whose registered office is Office 1757, 60 Tottenham Court Road, London, W1T 2EW. We are the controller of the personal data described in this policy. You can contact us about anything in it at support@turbotunnelvpn.com.

We collect as little as we can. This policy sets out exactly what we hold, why, how long we keep it, and who else handles it.

• We keep no record of the websites you visit, your DNS lookups, when you connect or for how long, how much data you use, or your IP address. The little our servers need while you are connected is held in memory only and never saved.
• Your connection's private key is created in your browser and is never sent to us or anyone else.
• Your account needs only a username and password. An email address is optional.
• Payments are handled by Stripe. We never see your card details.
• We use no advertising, analytics or tracking of any kind, and we never sell your data.

When you create an account, we hold:

• Your username, which you need to sign in.
• Your password, stored only as a one-way hash (bcrypt). We cannot see or recover it.
• Your email address, if you give one. We use it to confirm it is yours, to send password reset links, and to tell you when your password changes. If you ask to change it, we note when you asked, for 24 hours, to limit how many changes can be requested. If you change it, we keep a record of the old and new address and when you changed it, to limit how often it can be changed and to protect your account from takeover.
• Two-factor authentication, if you turn it on: the secret your authenticator app uses, stored encrypted, and your recovery codes, stored only as hashes.
• Your subscription: which plan you have (monthly or one-off), its status, its start, renewal and expiry dates, and Stripe's reference numbers for your customer record, subscription and each checkout you complete.
• Sign-in sessions: a random token, stored only as a hash, with when it was created, last used and expires. We do not record your IP address or device.
• Account details we need to run it: when you created your account, whether your email address is confirmed, a new address waiting to be confirmed, and a count of recent failed two-factor codes with any temporary lock this causes.

We use this to provide your account and the service you have paid for (performing our contract with you) and to keep accounts secure (our legitimate interest in protecting the service and its users).

For each connection you create, we hold:

• the name you give it and the server location you choose;
• its public key;
• the private address assigned to it inside our network (for example 10.0.1.5), which our servers need in order to route its traffic;
• whether it is switched on, and when you created it.

The connection's private key is generated in your browser and goes only into the configuration file and QR code you are given. It is never sent to us, so we cannot recover a lost file: you would delete the connection and create a new one.

We keep these details until you delete the connection or your account. We keep no record of when or how a connection is used.

We do not record the websites you visit or the content of your traffic, your DNS lookups, when you connect or disconnect or for how long, how much data you use, or your IP address.

A few things necessarily exist while you are connected, and only in memory:

• The VPN server you are connected to knows your device's current IP address so that it can send your traffic back to you, along with the counters WireGuard keeps for each connection. Our VPN servers have no disk: this is held in memory only, never logged, and lost whenever the server restarts.
• The connection limit and the "Connected" status. To enforce the limit on how many devices an account can have connected at once, and to show which of your connections are connected on your Connections page, our VPN servers report every few seconds which connections are active. Our central service holds this in memory only: a running count of bytes received for each connection and, while it is connected, when that connection began and last carried traffic. It is never written to disk or to our database, is forgotten about 40 seconds after you disconnect, and is used for nothing else.
• DNS. Our VPN servers answer your DNS lookups by passing them to public DNS resolvers, which see the lookups coming from our server, not from you. We do not log them.

We may watch overall figures such as a server's CPU load or total number of connections to keep the service running. These are not linked to anyone.

Payments are made on Stripe's own checkout page. Your card details, and the email and billing details you enter there, go directly to Stripe; we never see them. When you start a payment, we give Stripe your account number and the plan you chose, so the payment can be matched to your account. Stripe tells us that the payment succeeded, or later that it was refunded or disputed, and gives us the subscription details listed under "Your account". We use these to activate and manage your subscription (performing our contract) and to keep financial records (a legal obligation). If a payment is refunded in full, we use this to end the access it paid for; if a payment is disputed, to end your access; and in either case to cancel any subscription (performing our contract, and our legitimate interest in preventing fraud).

To protect against payment fraud, we limit how many checkout pages an account can open. For this we note, for each checkout page you open, Stripe's reference for it, the plan and when you opened it, and delete this after one day.

Stripe processes your payment details under its own privacy policy, including for fraud prevention and to meet its legal obligations. Card payments are not anonymous: Stripe and the card networks keep records that identify you.

• Cloudflare sits in front of turbotunnelvpn.com to protect it from attacks and deliver it quickly. Every visit passes through Cloudflare, which handles your IP address and the contents of your requests (it decrypts them to do this, so this includes what you type into forms). Cloudflare processes this on our behalf; see its privacy policy.
• Our web server keeps no access logs. To protect sign-in from password guessing and payments from fraud, it counts recent requests from each IP address in memory, and stores nothing. Its error log can record the IP address of a request that fails or is turned away by that limit; error logs are deleted after 14 days.
• Our application logs errors so that we can fix them. An error message can include your account number or, if an email to you fails, your email address, but never your password, keys or payment details.

We set only two cookies of our own, and both are strictly necessary:

• session – keeps you signed in. It expires after 30 minutes of inactivity, and after 12 hours at most.
• mfa_challenge – set only while you complete two-factor sign-in. It expires after 5 minutes.

Both contain a random token, not personal information. They are sent only to our website over an encrypted connection and cannot be read by scripts on the page.

Cloudflare, which protects our website, adds a small script to our pages that checks your browser is a real one rather than an automated bot. It may set two security cookies of its own: __cf_bm, which helps it tell people from bots and expires after 30 minutes of inactivity, and cf_clearance, which remembers that your browser passed the check so you are not checked again. These are strictly necessary to protect the site, and Cloudflare uses them only for security.

We also save two small settings in your browser's local storage: your light or dark theme choice, and a note that you have dismissed our cookie notice. These stay on your device, are never sent to us, and can be cleared at any time in your browser settings.

We do not use analytics, advertising or tracking cookies. Apart from Cloudflare's security check, we load no third-party scripts.

If you give us an email address, we send you only account emails: a link to confirm the address, password reset links, and a notice when your password changes. We do not send marketing.

If you contact support, we use what you send us only to help you, and delete the correspondence once it is no longer needed.

We use these providers, each only for the purpose listed:

• Hosting providers – the servers that run our website, account database and VPN service. VPN servers keep nothing on disk.
• Cloudflare – protecting and delivering our website.
• Stripe – taking payments.
• An email provider – sending account emails and running our support mailbox.
• Public DNS resolvers – answering DNS lookups made through the VPN.

We never sell your data or share it for advertising. Apart from these providers, we disclose personal data only when the law requires it. Because we keep no activity logs, we cannot hand over records of your VPN use: we do not have them.

Our website and account database are in the EU, which the UK recognises as providing adequate protection. Some of our providers may process data in the United States and other countries. Where they do, the transfer is protected by UK adequacy regulations (such as the UK Extension to the EU–US Data Privacy Framework) or by the UK's approved contract terms for international transfers. You can ask us for details of these safeguards.

When you connect to a VPN server in another country, your traffic goes there because you chose that location.

• Your account and connections – until you delete them. Cancelling a subscription does not delete your account. An account whose email address is never confirmed is deleted after 24 hours.
• When you delete your account, it and everything linked to it (connections, sessions, two-factor data and email history) are removed from our database immediately, and any subscription is cancelled. Our nightly database backups are kept for 14 days, so the data is gone from every backup within 14 days.
• Sign-in sessions stop working after 30 minutes of inactivity or 12 hours. Password reset links expire after 1 hour, and email confirmation links after 24 hours.
• Payment records are kept by Stripe, which we rely on for the financial records UK law requires businesses to keep for six years. We keep Stripe's reference numbers only while your account exists.
• Web server error logs – 14 days.
• Records of email-change requests and of checkout pages you open – 24 hours.
• Connection status – in memory only, for about 40 seconds after you disconnect.

Under UK data protection law you have the right to:

• get a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased (you can also delete your account yourself from your dashboard);
• restrict or object to how we use it;
• receive your data in a portable format.

To use any of these, email support@turbotunnelvpn.com. We will reply within one month. Because we collect so little, there may be little to provide: we cannot give you logs of your VPN use, because none exist.

You can also complain to the Information Commissioner's Office (ico.org.uk), though we would appreciate the chance to put things right first.

TurboTunnel VPN is not for anyone under 18, and we do not knowingly hold their data.

If we change how we handle your data, we will update this page and the date at the top. If a change significantly affects you and we have your email address, we will also email you.