Security & privacy
Privacy
Which data Colitu keeps, what it never records and for how long it stores things.
Colitu's principle: keep the least data needed to run the service and prevent abuse. This page lists plainly what we store. The full inventory is in the Security Whitepaper; the legal text is the Privacy Policy.
What the VPN servers do not record
| Data | Stored? |
|---|---|
| Content of your traffic | Never |
| Sites and IP addresses you visit | Not stored |
| Your DNS queries | Not stored. Our ad-blocking DNS servers have query logging and statistics turned off. By default the apps use public resolvers (Cloudflare, Google), which receive queries from the VPN server's IP address, not yours. |
| Your IP address on the VPN servers | Not stored; used in memory for the connection only |
What the VPN servers do record
Traffic volume per user: bytes per user per server in windows of about 15 seconds, kept 90 days for quotas and fair use; afterwards only totals per billing period. This shows when an account was active and how much it used, but not where it went.
Account and website
| Data | Retention | Purpose |
|---|---|---|
| E-mail address, password hash (Argon2id), language, account dates | Until the account is deleted; deletion replaces the address with a placeholder and makes the password unusable | Account and sign-in |
| E-mail verification and password reset codes (address, hashed code, IP address) | 7 days | Verifying the e-mail address, password reset |
| Sign-in events (IP address, country, browser or app) | 180 days | Account security, abuse prevention |
| IP address and country at registration and at the last sign-in | Registration: 180 days. Last sign-in: erased after 180 days without a sign-in | Account security, regional rules |
| Sign-ups and sign-ins refused under regional rules (IP address, country) | 90 days | Enforcing regional rules |
| Web sessions (IP address, country, browser, sign-in method) | Deleted 30 days after the session ends (sign-out, expiry or revocation) | Signing in, sessions list on the account page |
| App sign-in tokens (stored only as hashes, tied to a device) | Deleted 30 days after they expire or are revoked | Keeping the apps signed in |
| Two-step verification (encrypted authenticator secret, hashes of single-use recovery codes, 5-minute sign-in steps) | Secret and recovery codes until you turn it off or the account is deleted; sign-in steps are deleted 1 day after they expire | Account security |
| Passkeys (public key, credential ID, the name you give it, signature counter, creation and last-use dates; the private key and any biometric data never leave your device; 5-minute single-use verification challenges) | Until you remove the passkey or the account is deleted; verification challenges expire and are deleted after 5 minutes | Password-free sign-in and account security |
| VPN connection credentials (random secrets per server, tied to a device or a subscription link) | While the device or link is in use; deleted 30 days after it is removed or replaced | VPN access |
| Subscription links (the name you give, creation, last-use and expiry dates, a "may be shared" flag; the link itself is stored only as a hash). The IP addresses that use a link are not stored; only a daily, anonymous, approximate count of how many different networks used each link is kept for 48 hours | Until you revoke the link or delete the account (an expired link is revoked automatically); the network count deletes itself after 48 hours | One link per device and the shared-link warning |
| TV sign-in requests (device name, IP address, country) | Deleted 1 day after the 10-minute code expires | QR sign-in |
| Devices (name, platform, app and OS version, last IP address and country, keyed hash of a hardware identifier) | Kept while the device is on the account. A removed device's name, IP address, country and hardware hash are erased after 30 days; the IP address and country of a device not seen for 180 days are erased | Device limits, account security |
| Refused device and trial attempts (IP address, device details) | 180 days | Device limits, abuse prevention |
| Free plan and trial abuse checks (HMAC-SHA256 keyed hashes of the e-mail address, hardware ID and network; the key is not stored in the database) | Network: 30 days. E-mail and hardware ID: while the account exists and for 180 days after it is deleted. Unkeyed SHA-256 hashes written before this change are deleted at the latest 180 days after they were written | Preventing repeated free accounts |
| Automatic bot and abuse screening: for held or blocked accounts the score, the signals that triggered it, IP address, country, network (ASN) and user agent; for sign-ups refused before an account existed also the e-mail address | Held or blocked accounts: while the account exists, deleted with it. Refused sign-ups: 30 days | Preventing bots, scripted sign-ups and the harvesting of server addresses |
| Trial promo code abuse checks (HMAC-SHA256 keyed hashes of the normalised e-mail address, the device hardware ID and the network — IPv4 /32 and /24 or IPv6 /64 and /48; the key is not stored in the database) | Network: 35 days. E-mail and hardware ID: 365 days, also after the account is deleted | One trial code per person |
| Migration requests from the previous service (Telegram ID and name, notes, IP address) | Deleted 30 days after the last change. Of an approved request only a keyed hash of the Telegram ID remains, for 2 years | Moving old subscriptions; preventing the same subscription from being moved twice |
| A signup source label (e.g. "github", "app:android") from the utm/ref tag of the site's entry link, the name of the site that sent you (e.g. github.com) or the app; no cookie, tracking pixel or URL is stored. The time of the first VPN connection. | Deleted with the account | Measuring, in aggregate, which channels bring real users and how long the first connection takes |
| Your invite code; the link between an account opened with an invite link and the inviting account, the invite's status (pending, earned, not valid and why) and the Premium days granted. The inviter is never shown the invitee's name or e-mail. | Deleted when either account is deleted | Granting invite rewards; preventing abuse (same IP address or device, throwaway e-mail); measuring invite signups in aggregate |
| The apps' anonymous usage statistics: connection results and the kind of failure, connect and recovery times (as range counts), unexpected disconnects, Adaptive Connect's protocol switches, latencies measured to servers and automatic mode's server choice, features used and the kill-switch state; the network type and the country and internet-provider number (ASN) of the network in use (from a signed label received while the VPN is off). The server keeps only totals per day, with networks (country + ASN) and servers in separate tables; no account, device, IP address or visited site is stored. Server events also get a city-level location: the city is derived from the IP address of the report when it arrives, and the address is not kept; a city is shown on its own only when at least five different devices reported from it that day (devices are counted under an hourly pseudonym that is deleted when the hour ends). Can be turned off in the app settings. | Totals kept indefinitely (not linkable to a person); server totals with a city 90 days | Measuring and improving connection quality, Adaptive Connect and feature use |
| Colitu Passport is saved to your account and follows you to every device you sign in on. Per stamp country: unlock time and pieces; achievements, collections, weekly expedition progress, nickname, title, cover, time-zone offset and collector number; day totals (minutes of use, pieces, night and early-morning minutes, and the list of countries used that day); the current run (country, its length and the last counted minute); reward events for the apps' reveal animations. Our servers count the minutes from connection time: a minute counts when one of our servers reports traffic for your account in that minute (each minute at most once, whatever the number of devices), and the country is the server's country; apps cannot add minutes. Only totals per day and per country are stored; there is no per-minute or per-session log, and no sites or IP addresses. Progress already on a device from the old version is imported once per device (capped to what is plausible, the higher value wins). | Day totals 400 days, reward events 30 days, the rest until the account is deleted | Saving the passport to your account, showing it on every device and working out rewards and weekly expeditions |
| Colitu Passport's optional anonymous counters, at most one report a day: number of stamps opened, highest open chapter, stamps per level, finished weekly expeditions, pieces earned that day and whether the passport was opened that day. Sent without authentication; the server only adds each report to per-day totals and stores no report row, account, device or IP address. Which countries the stamps came from, and when, is not sent. Only older app versions send it; new versions do not, because the passport is now kept on your account (see the "Colitu Passport" row). The setting starts off and can be turned off in the app. | Totals kept indefinitely (not linkable to a person) | Seeing in aggregate how much the passport is used and whether its rules are balanced (level and piece pace) |
| Your answers to in-app surveys: recommendation score (0–10), how you would feel without Colitu, why you did not renew Premium, an optional comment and the platform; surveys you closed (at most one survey in 30 days) | When the account is deleted the link to it and the comment are removed; only the anonymous score remains | Measuring satisfaction (NPS), product–market fit and reasons for leaving in aggregate |
| The 1–5 rating and optional comment you give a resolved support conversation; when it was first answered and resolved | Deleted with the support conversation | Measuring support quality (satisfaction, response and resolution time) in aggregate |
| Which transports worked for a device on which server, and how fast (no IP address) | Overwritten with each report; deleted 35 days after the last report | Trying working transports first |
| Plan, payments and orders (including Colitu Space extra space; amount, payment method type, provider transaction ID, the provider's notification; for Rialit payments, a fixed payer number tied to the account) | As long as accounting and tax law requires, also after the account is deleted; automatic deletion at the end of that period is not implemented yet | Billing, refunds, legal obligations |
| Colitu Space vault: account ID, size of the encrypted data, number of files, creation and modification dates, folder structure (which item is in which folder), number of versions, favourite flag, end time of travel mode, vault settings (auto-lock time), encrypted key material (Argon2id salt and parameters, the master key wrapped with the password and with the recovery key) and passkey records. The vault password is never sent to the server | Until the vault or the Colitu account is deleted | Providing Colitu Space: opening the vault, listing files and folders, enforcing the storage limit |
| Files you upload to Colitu Space, thumbnails, file and folder names, file details and your profile (name and profile picture): encrypted in your browser with your own key; Colitu cannot see the content, the names, your profile or your key. The encrypted data is stored on Backblaze B2, in a separate Colitu account | Deleted files stay in Trash for 30 days, then are permanently deleted; at most 10 old versions of a file are kept; when a vault or file is deleted, its objects are also removed from storage through a deletion queue; deleting the vault or the Colitu account deletes everything | Storing your files encrypted and returning them to you |
| Colitu Space shares (only between Colitu Space users, end-to-end encrypted): who shares what with whom, stored with the encrypted content but without seeing the content; share dates; if a recipient reports a share, the reason (illegal, harassment, spam or other) and an optional note | At the latest until the vault or the Colitu account is deleted | Providing sharing; preventing abuse by reviewing reports |
| Colitu Space file request links: the public label the link's owner writes (not encrypted), and the number and size of the files received. Someone without an account can send files to a vault through the link; the file is encrypted in their browser. The uploader's IP address is held only in a counter for the daily size limit and is never written to the database | Label, file count and size: at the latest until the vault or the Colitu account is deleted; the uploader's IP address: at most 25 hours, in the counter | Providing file requests; preventing abuse with the daily size limit |
| Colitu Space emergency access: the emergency contact the vault owner chose (another Colitu Space user), the waiting period (1–30 days), the dates of the request and of a refusal, and the master key sealed to that person's key | At the latest until the vault or the Colitu account is deleted | Letting the chosen contact open the vault if the owner does not refuse within the waiting period |
| Colitu Business company account: company name, billing e-mail, country, tax number, number of seats and their term; membership (role, invitation, joining and leaving dates, who added the member); company invoices and the company activity log. The company's owner and admins see each member's e-mail address and role and their devices' name, platform, app version and last-seen time; they cannot see traffic or visited sites | Until Colitu closes the company account; company invoices as long as accounting and tax law requires; password set-up links are valid for 7 days. When a member deletes their account, the membership is closed and the seat returns to the company | Managing company seats, company billing, renewal reminders |
| Businesses and content creators we send Colitu Business partnership offers to: company or channel name, the e-mail address they publish for business contact on their website or channel description, country and language; the mails we sent and when; the subject and first 300 characters of replies, and bounces | Sending and reply records in the panel are deleted after 12 months. The contact list is kept until the contact asks us to stop or the address is no longer needed; an address that replies "don't write to me" is never mailed again | Offering Colitu Business reseller and white-label partnerships (legitimate interest; every mail says how to object and links this policy) |
| Support conversations and attachments, including app logs the app attaches (addresses, site names and secrets masked) | Closed conversations: deleted 2 years after the last message | Support, handling complaints |
| Security reports: the text of the vulnerability you report (title, description, steps, impact) and the messages with the team; if you ask to be credited in the Hall of Fame, the name you choose (published publicly with the month and severity) | Until the account is deleted; deletion removes the reports, the messages and the Hall of Fame entry | Fixing vulnerabilities and paying rewards (optionally: crediting you in the Hall of Fame) |
| Connection report: when support looks into a connection problem, your app sends app and device details, connection events and app logs the next time it opens; site names and addresses are masked on the device and on the server, the sites you visit are not sent. The report also holds Adaptive Connect's journal of its latest decisions (candidate servers, measurements, choice and outcome, hidden servers, whitelist checks); an AI diagnosis for support is written from the masked report | Deleted after 90 days | Fixing connection problems (support) |
| Colitu Bot conversations (text, IP address, "was this helpful" feedback) | 180 days | Answering questions |
| E-mail delivery records (recipient address, type of e-mail) | 90 days | Solving delivery problems |
| Newsletter subscription (e-mail address, language, time of confirmation); only if you confirm through the link in the e-mail | Until you unsubscribe; unconfirmed sign-ups are deleted after 7 days | Announcement, release-note and offer e-mails (with your consent) |
| Website and API access logs (IP address, address requested, browser) | 14 days | Operating and protecting the Service |
| DNS leak test on our website | 10 minutes, in memory only | Showing the test result |
| Audit log (admin actions, and some account actions such as deleting the account, by account ID) | Indefinitely; the optional reason you give when deleting your account: 180 days | Accountability for actions |
Deletion and remaining gaps: an hourly job applies the periods above. Deleting your account erases your sign-in history, IP addresses, sessions, device details and the other records the Privacy Policy lists at once; billing records, keyed abuse-check hashes (180 days), traffic volume (90 days) and closed support conversations (2 years) stay for the time shown. Plan, payment and order records and the audit log have no automatic deletion yet. Backups are encrypted to a public key and the decryption key is kept offline; an encrypted copy is stored at Backblaze B2 (EU Central). Backups made before a deletion keep the data for at most 36 days, and unencrypted snapshots taken before a deployment for at most 7 days. Fixing the rest is on the roadmap.
The account database is on a server in Turkey. Colitu is operated by COLITU LIMITED, a company registered in England and Wales (128 City Road, London, United Kingdom, EC1V 2NX; company number 17520342).
Traffic that goes outside the VPN
Regional sitesonly when privacy mode is turned off, the Android, Windows, iOS and Linux apps send some regional sites (domains and IP ranges on a built-in list) directly, outside the VPN, so that services which refuse foreign IP addresses keep working; this does not apply when the selected server is in the same region. For this traffic the site and your internet provider see your real IP address. Privacy mode is on by default for new installations (Windows and Android 2.7.0, iOS 5.6.0, Linux 1.3.0 and later), so by default all traffic goes through the VPN; installations from before keep their previous setting.
Local networktraffic, update checks and latency measurements to the servers.
Details: Split tunneling.
Third parties
- Payment provider (paid plans only): order number, amount, plan and payment method. Colitu does not send your e-mail or IP address.
- Resend (account e-mails) and Brevo (replies from our support mailbox).
- DeepSeek (Colitu Bot): your question and the last few messages; no account details, but anything you type is passed on.
- No analytics or crash reporting: none of the Colitu apps (Android, iOS, Windows, Linux) contains analytics, advertising or crash-reporting libraries; the iOS app has none since version 5.4.1.
- The Colitu apps and the browser extension may send anonymous usage statistics, which you can turn off in the settings (in the Firefox extension they stay off until you turn them on): only numbers such as connection success, timings and the features used. The server keeps them as totals per day, platform and version; no account, device, IP address or visited site is sent or stored. This is not a third-party analytics library.
- Cloudflare: DNS hosting, the default DNS resolvers in the apps, and the exit for a few domains on two servers.
- Hosting providers run our servers and have technical access to them.
How is the country found?
The country of an IP address, and for the anonymous server statistics its city, are looked up in local databases running on our server (IP to Country Lite and IP to City Lite by DB-IP, https://db-ip.com, CC BY 4.0). Your IP address is not sent to a third party for this.
Your rights
You can ask for a copy of the personal data in your account, ask us to correct it, or ask us to delete your account. Just write to support. Details: Account management.
Was this article helpful?
Still need help?
Colitu Bot answers in seconds, and our support team helps in three languages.