What we never record
- Your IP address, or the address you connect from.
- The websites and services you use, and anything you send or receive.
- Your DNS lookups. They're answered inside the tunnel by our own resolver, which keeps no log.
- When you connect or disconnect, for how long, or how much data you use.
The VPN server's log contains only that it started, stopped or hit an error, with any address removed. It is not written to disk with anything about you, because there's nothing about you in it.
While you're connected
To carry your traffic, the server holds a few things in memory for as long as your connection lasts: the keys for that connection, the address your device is reaching it from (so replies can find you) and packet counters. They're never written to disk, and they're gone the moment you disconnect or the server restarts. New keys replace the old ones every two minutes.
Your account
An account is a username and a password. We don't ask for an email address, a phone number or your name. Here is everything stored for it:
- Your username, kept only as a keyed hash (so the site can find your account when you sign in) and in a sealed form that only our staff, signed in, can open. Someone with a copy of the server's disk couldn't read it.
- Your password, as an Argon2id hash. Nobody can read it back, including us.
- Your recovery codes, as hashes.
- Each signed-in device: the public key it uses for the tunnel (the VPN server needs it), its name (sealed, like your username), and the day its sign-in ends. Only the day: nothing finer.
- Whether the account is waiting for approval, active or turned off.
There is no record of when you sign in, when you last used the VPN, or from where.
Support conversations
When you write to support, your messages and our replies are encrypted with a key that belongs to your account. Only you (with your password or a signed-in device) and our signed-in staff can read them. Each message keeps the time it was sent, so a conversation reads in order.
A closed conversation is deleted 30 days after it's closed, and every conversation is deleted with your account.
This website
- No access logs: the site doesn't record who visits, which pages, or from where.
- No analytics, trackers, adverts, or anything loaded from other companies. Fonts and scripts come from this site.
- One cookie, only when you sign in to your account, to keep you signed in. Sessions live in the site's memory, end after 30 minutes without use, and vanish if the site restarts.
- To slow down password guessing, the site briefly remembers a keyed hash of each address that tries to sign in, in memory only, until its limit resets.
The apps
The apps keep your server profile and settings on your device. Your device's private key never leaves it, and it's sealed by the system (Windows Data Protection, or the Android Keystore). The list of recent events in the app is kept in memory and disappears when the app closes.
To find updates, an app asks our site for the latest release every few hours. That request carries the app's version and nothing about you or your account.
Who can see what
Our staff are the owner of Imperial VPN and the support agents the owner adds. Each signs in with a password and an authenticator code, and only through the VPN. Depending on what they've been allowed, staff can see accounts' usernames, device names and status, approve new accounts, make password reset codes, sign devices out, turn accounts off and delete them. They see nothing about what anyone does on the VPN, because nothing is recorded.
So the owner can keep an eye on support, the site remembers a short list of recent staff actions, in memory only. It's gone whenever the site restarts.
Your choices
- See and sign out your devices, change your password, or delete your account on your account page.
- Deleting your account deletes everything listed above, including your support conversations, and signs out your devices at once.
- If you're asked for records of what you did on the VPN, there are none: they were never made.
Donations go through the service you choose on the donate page, which handles its own records. We don't link a donation to an account.