Privacy policy.
- 1 Principle
- 2 What we process
- 3 Hosting providers
- 4 Recipients
- 5 Your rights
- 6 Requests from authorities
- 7 Changes in the law
- 8 Cookies
1. Principle: minimisation by design
The service is built so that data about what you do is never written down. What is never recorded cannot be stored, leaked, or handed over. Specifically, we never record:
- the IP address you connect to the VPN from (while a device is connected, the server holds its current address and the time of the last handshake in memory, as WireGuard requires; this is never written anywhere and is gone when the session ends),
- when a particular account or device connected or disconnected,
- the sites you visit, the DNS names you resolve, the amount of data per account,
- the tunnel address assigned to a device (it exists only in the server's memory for the duration of the session).
Our VPN nodes will run entirely from memory. The disk holds only our public, published boot image and is never written to; at power‑off nothing of any session remains.
2. What we process
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account identifier (random), expiry date | providing the service | contract, Art. 6(1)(b) GDPR | until you delete the account; accounts that have been expired for 90 days are deleted automatically |
| Device public keys. A device public key is a random 32‑byte value your device generates for itself. It is not derived from your hardware or identity, it cannot be turned back into the private key, and you can replace or remove it at any time. | a server admits a device only if its public key is on the list | contract | until the device is removed or the account deleted |
| Payment record: account identifier, amount, date, method. For bank transfers and, later, card payments, the payer's name as it appears on our bank or payment‑provider statement. | tax records | legal obligation, Art. 6(1)(c) GDPR (Czech tax law: Income Tax Act and Tax Procedure Code; VAT Act once we are VAT‑registered) | as long as tax law requires, currently at least 3 years after the tax year and up to 10 years |
| Support correspondence | answering you | contract / legitimate interest, Art. 6(1)(f) | 1 year |
| Aggregate node statistics: number of connected devices and traffic volume per server, 5‑minute samples, no identities | capacity planning | legitimate interest | 30 days |
We keep no web or API access logs; rate limiting runs in memory only. We do not ask for a name or an e‑mail address. Providing an account identifier is necessary to conclude the contract; nothing else is. No automated decision‑making or profiling takes place.
Bank transfers: your bank and our bank statement show your name, the amount and the account identifier you put in the payment reference. We keep that statement as long as tax law requires and can be ordered to hand it over. If you want no link between your name and your account, pay with Monero or, once offered, cash. Crypto payments will go through our own BTCPay Server; the public transaction data is not linked to a person by us. Card payments, once offered, are processed by a payment provider as an independent controller; we receive only a confirmation carrying the account identifier. If VAT rules require it, we record the country of a payment, never the IP address.
3. Our hosting providers
Our VPN nodes are housed with a data‑centre provider in the Czech Republic (currently outside Prague); our control server, which holds the account list, runs with a second, independent provider. Both may monitor and sample network flows to and from our machines, including the IP addresses of computers connecting to them, and both are subject to cooperation duties towards Czech authorities as telecommunications providers. In practice this means a provider may hold a record that a given IP address connected to our server at a given time. Neither can see inside the tunnel. That record does not arise with us, we cannot access it, and we cannot hand it over.
The control server currently runs as a virtual machine with an encrypted disk; a provider operating the hypervisor could in principle read its memory while it runs. We plan to move it to our own hardware. We state this because an honest account of who can see what is part of the service. Multi‑hop through a second, independent provider is planned to make such records less useful.
4. Recipients
We share data with nobody except: our hosting providers as processors under Art. 28 GDPR agreements (WEDOS Internet, a.s. for the VPN nodes; Coolhousing s.r.o. for the control server), a payment provider where one is involved (only what a payment needs; it acts as an independent controller under its own policy), and public authorities where the law obliges us (section 6). We use no analytics or advertising tools. We do not transfer data outside the EU/EEA.
5. Your rights
Access, rectification, erasure, restriction, portability, objection, and a complaint to the Czech Office for Personal Data Protection (uoou.gov.cz). Because an account is not tied to an identity, exercising these rights requires proving possession of the account identifier. Removing devices is available in the account page now. To delete an account, write to privacy@pevnost.net and prove possession of the identifier; deletion directly in the account page will follow.
6. Requests from authorities
We comply only with requests that have a legal basis under Czech law, in particular the Code of Criminal Procedure, with European Production or Preservation Orders under Regulation (EU) 2023/1543, and with requests that reach us through mutual legal assistance. We hand over only data that exists under section 2. A court or prosecutor may order us to preserve data we already hold (§ 7b of the Code of Criminal Procedure); since that data does not include your activity, there is nothing to preserve. In our assessment we are not a provider of electronic communications services, so the Czech data‑retention regime (§ 97 of Act No. 127/2005 Coll.) does not apply to us; in any case our systems are built so that the data it would cover never arises. The number of requests received is published in our transparency report.
7. If the law changes
Should a law or an authority's interpretation force us to keep records of user activity, we will announce it at least 30 days in advance on this site and in the transparency report, state the exact scope, and let you end your subscription with a pro‑rata refund. Should we be forbidden to inform you, our warrant canary will stop being renewed.
8. Cookies
The site uses no cookies. The account page uses browser memory only while it is open. There is no consent banner because there is nothing to consent to.