No account.
No card.
Connect.
Open the app and press connect. There is no sign-up screen — and not as an offer we could withdraw. The credential that opens your tunnel carries a tier and nothing else.
- Email address
- not asked for
- Password
- not asked for
- Phone number
- not asked for
- Card
- not asked for
- Name
- not asked for
Why there is nothing to sign up for
Every VPN’s no-logs line is a promise about what it chooses to write down. This one is a property of how the thing is built, in three steps.
- 1
Your device asks for a ticket
It comes back signed but unread. The signature is made over a value we never see — an RFC 9474 blind signature — so the ticket cannot be recognised later as the one issued to you.
- 2
You connect with the ticket
It proves one thing: some device on your tier was allowed one, this fortnight. Not which device. The tier is encoded in which key signed, not in a field anyone can read.
- 3
The service that opens tunnels holds no handle to the account database
It is not “must not”. It cannot: the connect service ships with no database binding at all, and a build job named the privacy seam holds fails if anyone adds one.
Issues tickets
Knows your subscription, your device row and your purchase. Never learns a location, an exit, a session, or whether a tunnel came up.
binds: accounts database
Opens tunnels
Sees your address, your chosen exit and a session key that exists for one connection. Has no way to reach an account, because it holds no handle to one.
binds: nothing that identifies you
We store nothing that links an account to a session or an exit.
Stated that way on purpose. Not “we cannot link them” — the exit and the control plane each see the session key, so parties who were compelled together could rejoin a session end to end. What we do is store nothing that would do it. The privacy policy says exactly what survives.
It tells you when it isn’t working
“Connection failed” throws away everything the client already measured. The app reports one of eight named states instead, and each one carries the layer the fault was observed at and how strong the evidence is.
| State | What it means |
|---|---|
| Working | Data is flowing both ways. |
| Idle | Nothing to send right now. The tunnel is up and no app is using the network — the state most often misreported as a fault. |
| Degraded | Carrying traffic, measurably worse than it should be. |
| BlockedAtHandshake | Initiations are going out and the far end is not answering. |
| BlockedAfterHandshake | The session established and then carried nothing. |
| MtuBlackhole | Large packets are dropped while small ones pass. The tunnel MTU drops to 1280 and traffic resumes — the benign cause of the state above, and far more common. |
| ExitUnreachable | The path to the exit works and the exit cannot reach the internet. The exit says so itself, in a ledger that reached us over the path in question. |
| UnderlayDown | The local network is down. Nothing can be concluded about anything further out. |
- Layer
- Where the fault is: local network, ISP, entry, relay, exit — or unknown. When the evidence does not name a layer the app says Unknown rather than guessing, because naming one without evidence is how an app moves you to a different server for a problem in your own kitchen.
- Confidence
- How much the verdict may be acted on: local is this end only, corroborated means the far end’s ledger agrees, confirmed means a probe or a cohort agrees too. The bar rises with the cost of being wrong.
The rest of it
- It comes back
- The tunnel re-establishes itself across a network change, a lock, a lid close or a long idle period. Twenty sleep/wake cycles cost one ticket, not twenty.
- One tap off
- Disconnect is on the first screen, and it disconnects.
- You pick the exit
- A searchable list of locations with the tier each one needs shown on it. You choose; nothing chooses for you. The list itself is a signed file anyone can fetch, with no server in the read path — so what we actually run is checkable rather than claimed.
- The tunnel
- A WireGuard-family Noise protocol — X25519, ChaCha20-Poly1305, BLAKE2s — with a fresh session key every connect, held in memory and discarded on disconnect. While the tunnel is up the routes it claims stay authoritative, so traffic meant for the tunnel is not quietly handed back to the plain network.
- Traffic shape
- Packets are padded to a size that varies rather than a fixed one, and the client can move across a range of UDP ports rather than sitting on one.
- Apple TV
- Pairs with a short code shown on the TV. It never asks you to type a password with a remote, because there is no password.
One paid plan
Premium. Same features on every rung; the only difference is how often you are billed.
- Free tier
- 2 GB per connection, five connections a day, two devices. No card, no trial to start, nothing to cancel.
- Trial
- Three days free on the yearly rung only. Apple decides who is eligible, not us.
- Paying
- Through Apple. We receive a signed receipt and a token derived from your device — never your name, your email or your card number.
- Cancelling
- Through Apple, from your Apple Account. Cancelling returns you to the free tier rather than locking you out.
- Other devices
- An optional account number — 32 hex characters, no email and no password — puts a subscription on your other devices. Linking a device to an account is permanent, and the app says so before you do it.
What it does not do
The same readout, pointed at us.
- No per-app routing on iOS
- Apple offers it only to managed devices. Either everything goes through the tunnel or nothing does.
- No promise to stop every packet
- iOS gives no app a way to do that, so we do not claim one. When the tunnel drops, the app tells you which state it is in instead of pretending.
- Linking is permanent
- Once a device is attached to an account there is no route that undoes it. The app warns you first.
- No blocking of ads, trackers or domains
- No filtering, no blocklists, no “threat protection”.
- No independent audit yet
- Nobody outside the company has reviewed this. When that changes we will link the report here rather than describe it.
- Apple platforms only
- iPhone, iPad, Mac and Apple TV. There is no Android, Windows or Linux client to download.
- Most of the location list is not carrying traffic
- The app shows each location’s real status, and most are provisioned rather than live. We would rather show you that than a map with pins on it.