Privacy

What we collect

CoastVPN is built to collect as little as possible. When you create an account we store your email address, your name (if you provide one), and a password hash if you sign up with email. Session records include the timestamps of your sign-ins and, for sign-in security, the IP address and user agent your browser reports. We store the VPN devices you provision: a device name, its generated public key, and the internal IP address assigned to it. If you join the Android waitlist, we store the email address you submit and when you joined. If you subscribe, our payment processor (Stripe) or Apple stores your payment details; we store only the subscription status needed to grant access. On this website, PostHog records anonymous, cookieless page views, the page path, referring site, and basic browser and device information. We do not send URL query strings, email addresses, account identifiers, form input, or VPN activity to PostHog.

What we do not collect

• We do not log the websites you visit, DNS queries, traffic content, or connection durations through the VPN tunnels.
• We do not sell or share your personal information with advertisers or data brokers. There are no trackers in the apps, and the site has no advertising trackers. Its limited PostHog analytics do not use cookies, identify users, or record sessions.
• VPN tunnel traffic is encrypted between your device and our servers; we cannot read it, and we do not retain it.

How your information is used

• Your email is used for authentication and service notices.
• Device records let our servers authenticate your tunnel and route it to the right account.
• Subscription status is used to decide whether your account has VPN access.
• Session IP addresses and user agents are used to secure sign-ins and are not used to profile you.

What the VPN servers see

Our gateways must route your encrypted traffic, so they technically process the destination of each connection. We do not write destinations or traffic content to disk. We retain daily upload and download byte totals associated with your account to measure bandwidth usage. Authorized administrators can view daily, weekly, monthly, and cumulative totals. Device counter checkpoints support this accounting. Usage records are deleted when your account is deleted; they do not contain browsing destinations, DNS queries, or traffic content.

Third-party services

• Stripe processes web payments. Its handling of your payment data is governed by Stripe's privacy policy.
• Apple processes in-app subscriptions and, if you use it, Sign in with Apple.
• Google is offered as a sign-in option; if you use it, Google shares your name and email with us.
• Resend delivers our transactional email (for example, address verification).
• PostHog processes anonymous website page-view analytics. Session replay, form and click autocapture, and person profiles are disabled. PostHog discards client IP addresses.

Data retention and deletion

You can delete your devices from the app at any time, which also removes them from our gateways. Deleting your account removes your profile, sessions, devices, and billing records from our database; we keep a minimal record of past email sends to prevent abuse of the mailer. If you want your data removed sooner or have a deletion question, contact us at admin@ren.technology and we will action it.

Security

Passwords are hashed, sessions are HttpOnly cookies, and tunnel keys are generated on your device — only public keys ever reach our servers. Traffic between your device and the VPN gateways is protected with modern, industry-standard cryptography.

Changes to this policy

If this policy changes materially, we will note the change here with a new "last updated" date.

Questions? Visit the support page or email admin@ren.technology.