Transparency
Checked: 26 October 2026
A VPN means trusting someone with your traffic, so we publish what we can: what we can see, what we cannot, how long anything is kept, and how you can check it yourself.
What we can see
- Your sign-in e-mail and customer number.
- Your plan, expiry date, data allowance and data used.
- Data-usage totals per account, per node and per hour (the hourly breakdown is kept for at most 90 days), and when you were last online.
- How many different IP addresses are connected to your account at the same time: only the number is kept (a daily maximum), to understand usage; the IP addresses themselves are never written to disk, logs or a database.
- Orders and payments: amount, date, payment method and the reference used to reconcile it.
- A coarse network hint for signed-in sessions (the first three parts of the IP, e.g. 203.0.113.x) for the "signed-in devices" list, deleted at sign-out or after at most 7 days.
What we cannot see and never store
- Which websites, domains or IP addresses you visit - no node keeps an access log.
- Your DNS queries or the content you send.
- Who fetches your subscription or from which IP - the subscription service reads the client type only to pick a format and logs no requests.
- Your full IP address, in any database.
Open-source clients and protocols
Aurel does not make its own app. The clients we recommend - v2rayN, v2rayNG, Clash Verge Rev, Hiddify, NekoBox and sing-box - are open source on GitHub for anyone to inspect, and the installers we mirror match the official release files byte for byte (check the hashes yourself).
Connections use VLESS + REALITY, Hysteria2 and Trojan (TLS), encrypted end to end between your device and the node. Nodes run the open-source Xray-core and sing-box.
Sign-up and payment
Signing up needs only an e-mail address - no phone number, real name or ID.
USDT (TRC20) is accepted, as are cards and Alipay online payments through Stripe (we never see card numbers) and Alipay red packets.
Logs and retention
- Nodes: Xray records only its own warnings and writes no access log; sing-box and Hysteria2 logging is switched off.
- Server system logs (firewall drops of unsolicited packets, SSH sign-ins) are kept for at most 7 days.
- Anti-guessing counters store only hashes and are cleared within 1 day.
- The per-account hourly usage breakdown is kept for at most 90 days and trimmed daily; the account's running total is kept with the account.
- Encrypted database backups rotate and are kept for at most 60 days.
- The website is hosted on Cloudflare, whose network sees visitor IPs; we have not enabled Workers logs.
Published files
- canary.txtWarrant canary (dated)
- data-inventory.jsonData inventory: what, where, how long, why
- xray-node.sample.jsonNode Xray configuration (sanitised)
- sing-box-node.sample.jsonNode sing-box / Hysteria2 configuration (sanitised)
- subscription-formatter.excerpt.txtSubscription service source excerpt
- verify.txtCheck it yourself, step by step
- SHA256SUMSHashes of the files above
Delete your account completely
Signed in, open Settings and delete your account at any time: after an e-mail code and a typed confirmation we delete your sign-in details, VPN account and subscription, membership and remaining data, check-in/invitation/reward records, Telegram link, setup progress and support tickets. Orders and payments keep only the amount, date and payment method, unlinked from your e-mail; to enforce one free trial per address we keep only a keyed hash of the e-mail. Encrypted backups stop containing your account after at most 60 days.
Warrant canary
As of 2026-10-26 we have received no legal demand for customer data and have not been asked to log or hand over customer traffic. The statement is dated and renewed regularly; full text in canary.txt.