How to read a VPN privacy policy in ten minutes

Skip the preamble and go looking for five specific answers: what the service collects at the moment you connect, how long it keeps it, who it shares it with, which country's law it operates under, and how you delete it. Every VPN policy worth anything answers all five in a few sentences each, and the ones that do not are telling you something by omission. Ten minutes is enough if you read for those and nothing else.

Start from the data table, not the top

Most policies open with several paragraphs about how seriously the company takes your privacy. They contain no information. Scroll until you find a section with a heading like "information we collect", "what data we process", or a table of data types; that is where the policy begins. Read that section first, then retention, then sharing, then the legal section at the end, then deletion. Read the opening last, if at all.

Two reading rules. "May collect" means "collects"; nobody writes a clause they do not use. And a list that ends with "and other information" is a list with no end, so treat it as covering anything.

1. What is collected when you connect

This is the whole question for a VPN, because the connect moment is when the provider learns your IP address and, if it chooses, starts recording what you do. Look for three things separately:

• Connection records. Your IP address, timestamps, the server used, bytes transferred. Many providers keep some of this, and it is not disqualifying by itself; the logs explainer explains why. What matters is the next section.
• Usage records. Websites, DNS queries, destinations, contents. A policy should say in plain words that none of these are recorded. If it is silent on DNS specifically, assume the resolver is logging, because that is the default for most resolver software.
• Device and app data. Device model, OS version, crash reports, analytics events, the advertising ID. Look for whether analytics are optional and whether an ads SDK is present; a free VPN with an ads library is a VPN whose business is the ads, and the how free VPNs make money post explains what that costs you.

A policy that lumps all of this into "technical information" has failed the section.

2. How long it is kept

Every item in the collection list should have a period next to it: hours, days, "until you delete the account". Retention is what turns a collected item into a stored one, and a short period on a connection record changes its risk entirely. "As long as necessary" and "in accordance with applicable law" are not periods. If the policy gives a number for some items and none for others, the ones without a number are kept indefinitely until shown otherwise.

Check too where the record lives. A connection record on the VPN server itself is exposed to whatever happens to that server; one held only in a separate system, with the server seeing an opaque identifier, is a different design, because seizing or compromising the server then yields identifiers rather than people.

3. Who it is shared with

Look for named categories: a payment processor, the app store, a crash-reporting service, an analytics provider, an email provider for support. Each is ordinary. What is not ordinary is "advertising partners", "data partners", "affiliates" without saying which, or a sentence permitting sale of data. For a free service the sharing section is often where the business model lives, and the free VPN red flags post lists the phrases to watch for.

Also look for how the provider responds to legal requests. A plain statement of what it can and cannot hand over, given what it stores, is worth more than a promise to resist.

4. Where the company is

The policy should name the company, its country, and the law it operates under, usually near the end. This decides which regulator you can complain to, what rights you have by default, and which courts can compel disclosure. A policy with no company name or address behind it is a policy nobody is accountable for.

5. How you delete it

There should be a deletion section that says how to request it, in the app or by email, what identifier you need to provide, and what is retained afterwards and for how long. Google Play requires apps with accounts to offer a way to delete them, so the absence of a path is a bad sign twice over. The deletion post covers what a complete answer looks like.

A worked example

Reading Culvert VPN's privacy policy with those five questions gives: it does not log the websites you visit, your DNS queries or the contents of your traffic; its servers see only an opaque connection id and never an account or device identity; it keeps your client IP address for up to 30 days for abuse handling and then erases it; app analytics are optional and disclosed, collected only if you leave them on; and the account can be deleted in the app or by email via /data-deletion. Those are the sentences to look for in any policy, and every provider should be able to produce its equivalent in about the same space.

The ten-minute checklist

Culvert VPN's answers fit in the paragraph above, which is about the length a VPN privacy policy's substance should have, and the app is on Google Play.