Culvert VPNWhat a VPN hides, and what it does not
A VPN hides your IP address from websites and your traffic from the Wi-Fi and your ISP. It does not hide your accounts, cookies or the fact you use a VPN.
A VPN hides two things. From the websites and apps you use, it hides your IP address, so they see the VPN server's address instead. From the network you are on, whether that is café Wi-Fi or your mobile carrier, it hides where your traffic is going and what is in it, so they see one encrypted stream to one server. It does not hide who you are from any service you are signed in to, it does not hide your device, and it does not hide the fact that you are using a VPN.
Hidden from the network you are on
Without a VPN, the Wi-Fi router, its owner and everyone upstream of it can see the address of every server your phone talks to, and the names of the sites you visit, because DNS lookups and the first part of every HTTPS connection carry the site name in the clear. On a shared network, other devices can sometimes see it too.
With a VPN connected, all of that is inside the tunnel. The network sees encrypted packets going to a single address, and the size and timing of those packets. That is genuinely all: not the site names, not the page contents, not which app made the request. The post on what your ISP can see walks through this from the carrier's side.
Hidden from the websites and apps you use
Every website records the IP address of every visitor. That address identifies your ISP, your rough location, and, over time, every visit from the same household. With a VPN on, the site records the exit IP instead, which is shared by everyone on that server at the time. A site cannot tell your visit apart from anyone else's on the same server by address alone.
That is the limit of what is hidden from a website. Everything the site learns from you directly is unchanged, which brings us to the longer list.
Not hidden: everything that identifies you above the network
| What | Hidden by a VPN? | Why |
|---|---|---|
| Your IP address, from websites | Yes | The site sees the server's address |
| Site names and contents, from the Wi-Fi and ISP | Yes | They travel inside the tunnel |
| Accounts you are signed in to | No | The service knows you by your login, not your address |
| Browser cookies and fingerprint | No | They live in the browser and travel with every request |
| App and advertising identifiers | No | Apps read them from the phone directly |
| GPS location | No | Apps read it from the phone's sensors, not the network |
| Your phone number and carrier | No | The carrier knows the SIM regardless of what the phone sends |
| That you are using a VPN | No | The encrypted stream is a recognisable pattern |
| Your traffic, from the VPN provider | No | The provider's server has to decrypt it to forward it |
The middle rows are where most misunderstandings live. If you are signed in to a shopping site, that site knows exactly who is browsing, VPN or not. If your browser has a cookie from a tracking network, that network follows you across sites as before. A VPN changes the address on the envelope; it does not change what is written inside. The post on whether a VPN makes you anonymous goes into what this means in practice.
Not hidden: the VPN provider's view
The last row of the table is the one to think hardest about. A VPN does not remove the party that can see your traffic. It moves that role from whatever network you happen to be on to the provider you chose. The provider's server decrypts your packets to forward them, so it can see the same destinations and, for anything not protected by HTTPS, the same contents the Wi-Fi owner could have seen. What matters is what the provider does with that view.
Culvert VPN does not log the websites you visit, your DNS queries or the contents of your traffic; its servers see only an opaque connection id rather than an account or a name; and it does keep the client's IP address for up to 30 days so that abuse complaints can be handled. That is the complete list, and it is written out in the privacy policy.
Not hidden: the fact of the VPN itself
A VPN's traffic has a shape. One address, a steady stream, characteristic packet sizes, and on many protocols a recognisable header. The network operator cannot read what is inside, but can usually tell a tunnel is there, and some restrictive networks filter ports or drop VPN protocols on that basis. This is why a good app has more than one way to connect, including a method that wraps the tunnel in ordinary TLS on port 443, and tries them in order until one works.
Where the hiding stops
The tunnel ends at the VPN server. From there your request continues to the website as normal, protected by HTTPS if the site uses it and readable if the site does not. Almost every site uses HTTPS today, so in practice the contents stay private end to end; the point is that this is HTTPS's work, not the VPN's. The two protect different stretches of the path, which is covered in VPN and HTTPS.
Culvert VPN hides your IP from the sites you visit and your traffic from the network you are on, shows the exit IP it verified through the tunnel, and is free on Google Play.
Questions people also ask
Does a VPN hide my browsing history?
From the network you are on and from your ISP, yes: they see one encrypted stream to the VPN server. Your browser still keeps its own history on the phone, and any site you are signed in to still records what you did there.
Can the Wi-Fi owner tell I am using a VPN?
Usually yes. They cannot read the traffic, but a constant encrypted stream to one address is a recognisable pattern, and some networks block it on sight.
Does a VPN hide my location?
It hides the location your IP address implies. It does nothing about GPS, which apps read directly from the phone, or about the location your mobile carrier knows from the cell you are on.