Culvert VPNVPN logs explained: what "logs" can mean and what to ask
Connection logs, usage logs and aggregate counters are three different things with different risks. How to tell them apart and what to ask a provider.
"Logs" in VPN marketing is one word doing three jobs. A connection log records who connected, when, and from which IP address. A usage log records what they did once connected: the sites, the DNS lookups, the destinations. Aggregate counters record totals with no per-user detail at all, such as bytes carried by a server today. These carry very different risks, and a provider's policy only means something once you know which one it is talking about.
Connection logs
A connection log is the record a service keeps of a session's existence: an account or device identifier, the time the tunnel came up and went down, the client's IP address at the time, the server it was assigned, and often the bytes transferred.
What it can reveal. That a particular account or IP address was connected to a particular server at a particular time. Joined with a complaint about something the server's exit address did, it can point back to the client that was connected then. On its own it says nothing about which sites were visited.
Why providers keep it. Abuse handling, mostly. A VPN server's exit address is shared by everyone using it, and when one of those people does something that draws a complaint, the complaint arrives at the provider naming the exit IP and a time. Without a connection record there is no way to respond, and the usual consequence is that the whole server's address ends up on blocklists for everyone. Billing and device limits are the other reasons.
What to ask. How long it is kept, whether it lives on the VPN server itself or only in a separate system, and whether it can be joined to anything about your browsing.
Usage logs
A usage log records what happened inside the tunnel: the DNS queries your phone made, the site names in TLS handshakes, the destination addresses and ports, sometimes the contents of unencrypted traffic. It is exactly the view your ISP or the Wi-Fi owner had before you turned the VPN on, transferred to the provider.
What it can reveal. Your browsing history, at whatever resolution was recorded. This is the log that makes a VPN worse than no VPN, because it concentrates in one place what was previously spread across several networks.
Why some providers keep it. To sell it, to target ads, to profile users, or through carelessness, because most resolver software logs queries unless someone turns that off. The post on how free VPNs make money covers the first three. The last one is more common than it sounds.
What to ask. Does the provider record DNS queries, destinations or contents, in any form, for any period. The only acceptable answer is no, stated plainly, with the DNS resolver mentioned specifically.
Aggregate counters
Counters are totals: bytes in and out per server per day, number of concurrent sessions, error rates, how often each connection method was needed. They have no per-user column, and once the per-session rows that fed them are deleted, nothing about an individual can be recovered from them.
What they can reveal. How busy the service is. Nothing about you.
Why providers keep them. They are how capacity is planned and how a broken server gets noticed. A service with no counters at all cannot be run well, so a policy that admits to keeping them is being straight with you.
The three side by side
| Connection log | Usage log | Aggregate counters | |
|---|---|---|---|
| Records | Who connected, when, from which IP, to which server | Sites, DNS queries, destinations, sometimes contents | Totals per server or per day |
| Per-user? | Yes | Yes | No |
| Can show your browsing? | No | Yes | No |
| Legitimate reason to keep | Abuse handling, billing, device limits | None that serves the user | Running the service |
| The question to ask | How long, and where is it stored? | Is any of it kept, at all? | Are per-user rows deleted first? |
Why a blanket claim of keeping nothing is rarely true
A provider that says it retains nothing whatsoever is usually simplifying. Its servers must know which connections are authorised, so some record of active sessions exists at least in memory while a tunnel is up. It receives abuse complaints about its own exit addresses and has to respond to them somehow. If it sells a subscription, a payment record exists, even if only at the app store. The honest version of the claim is a short list of what is kept, for how long and where, and the privacy policy reading guide shows how to find that list quickly.
Where the record lives matters as much as what it contains. A connection record held on the VPN server itself is on the machine most exposed to seizure or compromise; one held only in a separate control system, with the server seeing an opaque identifier, is a different design. The seized server post works through the difference, and the VPN server post describes what a server needs to know to do its job.
Where Culvert VPN stands
Stated in the same three categories. Usage logs: Culvert VPN does not log the websites you visit, your DNS queries or the contents of your traffic, and the resolver on its servers has query logging compiled out. Connection logs: the servers themselves see only an opaque connection id, never an account, an email or a device name; the control system does keep your client IP address for up to 30 days, for abuse handling, and then erases it. Counters: per-server totals are kept for capacity planning. Optional app analytics are collected only if you leave them on. The privacy policy states all of this in full.
If you want a VPN whose logging position fits in one paragraph and names each kind of record, Culvert VPN's free tier is on Google Play.
Questions people also ask
Is a VPN that keeps connection logs unsafe?
Not by itself. A connection record with a short retention period, held away from the VPN servers and used for abuse handling, is a limited thing. It becomes a problem when it is kept for years, sits on the same server as your traffic, or is joined to a usage log.
Why can't a VPN simply record nothing at all?
It has to know who is allowed to connect, it receives abuse complaints about its own addresses, and if it sells a subscription somebody has to be billed. Every provider keeps something; the question is what, where and for how long.
What are aggregate counters?
Totals with no per-user detail, such as bytes carried by a server per day or the number of active sessions. They are needed to run a service and reveal nothing about any one person once the per-user rows are gone.