Data we collect and how it's used
Sign-up needs only a username and password — no email address. The account stores the username, an irreversible hash of the password, the plan tier and its expiry date. The plain-text password is never written to the database and cannot be recovered, only reset.
The order record stores the plan or data-pack tier, amount, payment method and order time. Monthly plans are ¥9.9/month for 60GB, ¥18/month for 250GB and ¥28/month for 500GB; data packs are ¥158/300GB, ¥358/1000GB and ¥658/3000GB, valid until used up with no expiry. These records are used to activate subscriptions, calculate remaining traffic and process 60-day no-questions-asked refunds.
Visit analytics record the page address, visit time, referring site, browser and device type, and a coarse region. They are used to check that pages load properly, decide which content needs expanding, and plan capacity.
On the client side, only the connection duration and total traffic per route are counted, to verify plan quotas and route capacity. The results contain no destination information.
No access logs
VPNVL does not record which websites users visit, and keeps no connection records that could reconstruct browsing activity.
- No record of visited sites, page content or search terms, and no record of the domains behind DNS queries.
- No records of the form "this account connected to that destination at this time" — nothing that could reconstruct browsing activity.
- Route node operational logs contain only aggregate connection counts, bandwidth usage and fault information. They are kept briefly and then cleared, and contain no destinations.
- No user profiling, and no selling, renting or trading of access records to third parties.
One boundary to note: account and order data needed for billing, refunds and abuse handling is kept as described in "Data retention and deletion" below; that data does not include browsing content.
Cookies and local storage
The site uses only a small amount of storage needed to keep things working: the sign-in state of the user panel, language preference, and the currently selected billing cycle on the plans page.
Pages load only the site's own scripts, and visit analytics are aggregate counts only, with no cross-site linking.
To clear it, delete this site's data in your browser — the trade-off is being signed out and the language preference returning to its default. With cookies disabled, the marketing pages still work; signing in to the user panel and placing orders will be affected.
Third-party payment processing
Payment methods are Alipay, WeChat and USDT. Alipay and WeChat payments complete in the checkout page of the respective channel, and the service never touches card numbers or payment passwords; USDT transfers settle on-chain, with a publicly verifiable transaction hash.
Payment channels handle account and transaction information under their own privacy policies; the service receives only the result — whether payment succeeded, the amount and the order number.
Infrastructure providers such as server and content delivery services process technical data only as far as needed to deliver the service, and are bound by contract. Access records are not provided to any third party except where legally required.
Data retention and deletion
- Account data is kept while the account is active, for sign-in, renewals and support tickets.
- Order and payment results are kept while the account is active, for refund checks and billing enquiries.
- Route operational logs are kept briefly, used only for troubleshooting, and cleared automatically when they expire.
To delete your data: sign in to the user panel and submit a request through the ticket entry. Once account ownership is verified, deletion is carried out; the account, subscription and any data packs in the account are voided together and cannot be restored.
Copies in backups are overwritten by new data within the backup rotation cycle; aggregated statistics that cannot be linked to an individual are unaffected.
Policy updates and contact
When the policy changes, the "Last updated" month at the top of this page is revised; material changes to the scope or purpose of data handling are also flagged in a site announcement.
Continuing to use the service after a change means you accept the updated terms; if you do not accept them, you can stop using the service and request a refund under the refund policy.
Privacy requests (access, deletion, correction) are all submitted through the ticket entry in the user panel so that account ownership can be verified. Service rules are set out in the terms of use.