A clear explanation of what the service does — and does not — record.
The app, backend, and node agent are designed not to persist browsing history, DNS queries, traffic content, or originating client IP addresses. This is a description of the supplied implementation, not an independent audit certification.
The service stores an installation ID, device and app information, authentication proofs and refresh-token hashes, entitlements, purchase verification records, promo redemptions, reward tickets, server requests, and operational peer leases. These records are distinct from browsing or traffic logs.
WireGuard necessarily holds the current peer endpoint, handshake time, and transfer counters in memory while a peer is active. Public keys and assigned tunnel addresses are retained for operational peer management.
Google Play handles purchases and Google AdMob supplies ads. Nsec’s own ads and API requests bypass the VPN. Infrastructure providers and optional speed-test providers have their own data practices. Website and proxy logging must be configured separately.
The privacy policy explains the records and third parties in more detail. Contact the published support address for privacy questions or deletion requests. Clearing app data does not delete backend records.
