Privacy policy

Last updated 8 October 2026

isotunnel is a VPN. The point of it is that your browsing stays yours, so we keep as little as we can and say exactly what that is. This policy covers the isotunnel app, the VPN servers and this website. It's run by [your name or business name, ABN] in New South Wales, Australia ("we").

The short version

• We don't record the websites you visit, the apps you use, your DNS lookups or the contents of your traffic.
• We don't keep logs of your IP address.
• We don't need your name. Your account is a random access key.
• To run your account we keep your plan, its expiry date and how much data you've used.

What we keep

Your account

A random account name, your access key, your plan's expiry date and data allowance, and whether the account is active.

Data used

How much data your account has used, recorded in 10-minute totals, plus the last time it was online. This is a number of bytes, never what the data was. We use it to apply your data allowance and show usage in the app.

Payments

The payment provider's reference for each payment, kept on your account so a payment is never applied twice. For card subscriptions, the provider's customer reference, so you can manage or cancel the subscription.

What we don't keep

The VPN server doesn't write a log of the connections it carries, so there is no record of the sites you visit. While you're connected, the server necessarily knows your current IP address in order to send traffic back to you. It isn't written to a log or stored with your account.

Our server software is set to log only warnings and errors, not individual requests. Its logs are limited in size and rotate automatically, so older entries are overwritten.

Payments

Payments are handled by the payment providers, under their own privacy policies. We never see your card number.

• Crypto is processed by OxaPay. They see the payment's details on the blockchain, which is public by nature.
• Cards are processed by Stripe, who collect the card details and an email address for receipts.

The app

The app keeps your access key in your operating system's secure store (Windows Credential Manager, or the keyring on Linux), and your settings on your own computer. It contains no analytics or tracking. It contacts our servers to check your account, to connect, and to check for app updates. Those requests are not logged per request.

This website

The site uses no cookies, analytics or trackers. It remembers your light or dark theme, and your most recent order link, in your own browser. Our hosting provider, Render, keeps standard request logs, including IP addresses, under its own policy.

Who else is involved

• DigitalOcean runs our VPN servers (Sydney, Australia).
• Render hosts this website and the checkout service (United States).
• Cloudflare provides our domain's DNS.
• OxaPay and Stripe process payments.

We don't sell or share your information with anyone else, and we don't use it for advertising.

How long we keep it

Account details stay while your account exists. We delete accounts [90] days after they expire, or sooner if you ask. Payment references are kept as long as the law requires for tax records.

Requests from authorities

If we receive a lawful request for information, we can only hand over what we have, which is described above. We have no record of what you did online.

Your choices

You can ask to see the information we hold about your account, or ask us to delete it, by emailing [contact email] from any address and including your access key. Deleting your account ends the service.

Changes

If we change what we keep, we'll update this page and the date at the top before the change takes effect.