Privacy Policy
Every VPN says it keeps no logs. The question worth asking is whether the system could produce the record at all — because a capability that exists can be compelled, and one that does not, cannot.
Last updated 13 August 2026.
The short version
We do not log what you do through the VPN. We do not know your name, your email address or your phone number, because there is no field for them. We do not sell or share data with advertisers, because we have nothing to sell. We keep one number per account per day — total bytes — because a data allowance cannot be enforced without it.
1. Who is responsible
AxonVPN is the controller of the limited personal data described here. Company registration details are added here on incorporation, before card payments open. For any privacy question, write to privacy@axonvpn.com.
2. Everything we store
This is the complete list. It is the schema of our database, not a summary of it.
| Record | Contents | Why | Kept for |
|---|---|---|---|
accounts | An opaque identifier, a hash of your account code, the date it was created, and the /24 network block it was created from. | To recognise a returning account and to rate-limit mass signup abuse. | Until you delete the account. |
devices | A public key your device generated, a label you chose, and when it was last seen. | To enforce the device limit on your plan and to let you remove a lost device. | Until you remove the device. |
grants | That an entitlement was issued and when it expires. Not that it was used, and not where. | To revoke an entitlement and to stop the same one being issued twice. | 7 days after expiry. |
usage_daily | One integer: total bytes for an account on a date. No server, no destination, no time of day. | To enforce a monthly data allowance. | 60 days, then deleted. |
subscriptions | Which plan is active, when it renews, and an identifier from our payment processor. | To know what you are entitled to and to process renewals. | As long as required by tax and accounting law. |
What is deliberately absent
There is no sessions table. No record anywhere places an account next to a server, an IP address, a destination or a moment of connection. There is no DNS query log — queries are resolved inside the tunnel and not written down. There is no browsing history, because it never reaches us in a readable form.
This is architectural rather than a setting. Exit servers decide whether to admit you by checking a signature locally, so they never ask us about you and have no natural reason to tell us you were there. Nothing about the design produces the record that a conventional VPN produces every time anyone connects.
3. The website
This site sets no cookies, runs no analytics, embeds no third-party script, and loads no external font. Our web server keeps standard access logs — request time, path, response code, and a truncated client address — for up to 14 days to detect attacks and diagnose faults. They are not connected to any account.
4. Payments
When you pay by card, the card details go directly to our payment processor and never touch our servers. We receive a token, the last four digits, the card brand, the country and the outcome. Our processor is an independent controller of what it holds and acts under its own privacy policy.
The billing record and the traffic record cannot be joined, because the traffic record does not exist. A subscription knows which account it entitles; nothing knows what that account did.
Cryptocurrency and voucher payment exist for people who would rather not create a payment relationship at all.
5. Support email
If you write to us we necessarily have your email address and whatever you tell us. We keep support correspondence for 12 months and then delete it. Please do not send us information you would not want us to have — in particular, we never need your account code to help you.
6. Legal basis
Where the GDPR applies: account and device records are processed to perform our contract with you; usage totals and signup rate limits are processed under our legitimate interest in enforcing plan limits and preventing abuse; billing records are processed to comply with a legal obligation. We do not rely on consent for anything, because we do nothing optional with your data.
7. Your rights
You may ask for a copy of what we hold, ask us to correct or delete it, object to processing, or complain to your data protection authority. Write to privacy@axonvpn.com and we will respond within 30 days.
One honest limitation: because we do not know who you are, we cannot verify that an account is yours unless you can prove control of the device key or the account code. We would rather refuse a request we cannot verify than hand your data to someone claiming to be you.
Deleting your account removes the account and device records immediately. Usage totals are already anonymous aggregates and age out on their own; billing records are kept as long as tax law requires.
8. Where data is processed
The control plane runs in Germany (Frankfurt). Exit servers run in the countries listed in the application and carry your traffic without storing it. Where we transfer personal data outside the EEA, we do so under standard contractual clauses.
9. Requests from authorities
We respond to lawful requests with what we actually have, which for a question about someone's activity is nothing. We cannot produce connection logs, traffic contents, browsing history, or a link between an IP address and an account, because we do not hold them.
Where we are legally permitted to tell you about a request concerning your account, we will.
10. Children
The service is not for under-18s and we do not knowingly hold data about a child. Since we collect no age or identity data, this is enforced through our terms rather than through screening.
11. Changes
If we change this policy in a way that affects what we collect, we will give notice in the application before it takes effect. The date at the top of the page is the last substantive change.
Questions about privacy? Write to privacy@axonvpn.com. We answer every message from a person, usually within two business days.