Privacy Policy

Who we are

KAPO VPN ("KAPO", "we", "us") operates the KAPO VPN application and network. You can reach us at privacy@kapovpn.com.

What we do not ask for or set out to collect

• No name, email, phone number or address to create an account.
• We do not set out to log the websites you visit, the content of your traffic, or the IP addresses you connect to. On all three VPN servers, the ad-blocking and adult-content filters have their query log and statistics switched off: see Server logging.
• We do not set out to keep bandwidth-per-site or browsing history, or a record of each time you connect. The times listed below, such as when a device was first seen, are kept, and a VPN server holds in memory when each device last connected: see Server logging.

What we do hold

• Your account number - the full number is stored only as a one-way hash. We also keep its last 4 characters in readable form so we can tell accounts apart. It is linked to your remaining subscription time, its creation time (exact, except as described under Prepaid codes), and the device and payment records below.
• Your devices - each device that checks your account: a one-way fingerprint of the device identifier its app sends (on Android, the Android ID), tied to your account so one phone can't be matched across accounts, and the exact time it was first seen. Our account database does not record when a device was last seen; a VPN server does hold this in memory, as described under Server logging.
• Device enrollment - when a device connects, we store the public key it generated, the internal tunnel IP we assign it, the servers it is routed through and the exact time it was added, so the network can route it. Private keys are generated on your device and never sent to us. If a server does not confirm a change, such as when a device is removed, moves to another server or fails to connect the first time, we keep a record of its public key, tunnel IP and that server, and the time the record was made, until the server confirms the removal. That record holds no account number, but while the device is still enrolled, for example after a move, the same public key is also in its enrollment entry, which is tied to your account, so the two can be matched. The VPN servers themselves also keep each enrolled device's public key and tunnel IP, and any multi-hop route, on their disks, so this data survives a reboot while the device is enrolled.
• Payments - handled by a third-party crypto payment processor. The processor receives your full account number as the order reference, and its records can link your payment to that number. We receive a confirmation that a payment for a given account number succeeded, so we can add time. We note on the account which processor handled its latest payment, and keep a one-way fingerprint of each payment ID, with the exact time, so one payment can't add time twice. We may email ourselves a notice, sent through a third-party email service (Resend), with the last 4 characters of the account number, the days added, the days left, the processor and the time. A separate notice tells us that a Kapo Guard licence was paid, with the time. Another tells us that a reported payment could not be credited, for example because too little was paid, with the payment's status and the time. We do not store your wallet details or card data.
• Prepaid codes - if prepaid codes are offered: for each unused code, a one-way hash and its batch. For each batch, the plan and days, the creation time, how many codes were made, used and revoked, and any note we typed. When a code is used or revoked its record is deleted and the batch's counter goes up by one. The live database does not hold which code went to which account, and we do not store the time or IP address of using a code: using one sends no notice and adds no note or event. Using a code does change your account's dates. Its end date is rounded up to the next midnight UTC, and if the number never had paid time, its creation date is rounded down to the midnight before. So the dates do not show the time of day. They can still show the day, when the account had no time left, and an end date at exactly midnight can show that a code was used. The database also keeps account records in the order they were made, so a number's place among its neighbours can narrow down when it was made, whatever its creation date says. A number the account page makes for a code is made seconds before the code is used, so this can narrow down that time too. Our backups hold older copies of these records: comparing two of them could show that a code's record went away and which account gained time in between. That can link the code's hash to the account, and anyone who also has the code itself can tell which code it was. Whoever sold you a code knows they sold it to you, but not your account number unless you tell them.
• Kapo Guard licences - a one-way fingerprint of the licence key and its last 4 characters, the tier, creation time and status, a one-way fingerprint of the phone's identifier (its hardware serial or Android ID), the activation time, how many times the licence has moved to a new phone, and which processor it was paid through. NOWPayments receives the raw key as the order reference. Activating and checking a licence contact our server. The buy page keeps your key in your browser's local storage, and the USB installer keeps its connection key in your browser.
• Notes we type - an account, licence or batch of prepaid codes we issue or annotate by hand can carry a short internal note we typed, for example how it was paid or who a gift licence is for, so it can hold details about a person.
• Event log - counters for our own dashboard, each with an exact time: checkouts started with the plan, payments with the processor, days and US dollar amount, licence events and page views. It holds no account number or device identifier. Everything except sales records is deleted after 90 days.
• Backups - nightly copies of this database, of which the newest 14 are kept. Something deleted from the database stays in a backup until that backup is replaced.

How long we keep it

Numbers that were never paid for and never used are deleted after 7 days, except a number we have revoked: we keep its record, with no deletion date, so a later payment can't bring it back. Records of paid accounts, their devices and licences have no automatic deletion date at the moment, including after an account ends.

Server logging

We run our VPN servers with their main system log in memory (RAM), not on disk, and reboot them on a regular schedule. We checked this on all three servers on 7 November 2026. That day we also switched off a second logging service that was still copying system messages to disk, and deleted the older copies it had written. Some other files are still written to disk, for example kernel and cloud start-up messages, records of SSH logins to the server (ours, and failed attempts by others), a log of addresses blocked after repeated failed logins and, on some servers, server load figures. From what we checked, none of these record your traffic or your DNS lookups. On disk, each VPN server also keeps each enrolled device's public key, tunnel IP and any multi-hop route, so it can route traffic and restore those routes after a reboot. During this work on 7 November 2026 we also made a one-off backup on each VPN server that holds, on disk, the last IP address each device had connected from. It stays there until we delete it, and we will update this page when we have. Apart from that backup, a VPN server holds in memory the last IP address each enrolled device connected from, because it needs it to send traffic back to that device. This stays after you disconnect, until the server reboots or the device is removed. It also holds in memory the time of each device's last handshake and how much data it has sent and received, for the same length of time.

With ad blocking off, your DNS lookups go by default to a public resolver, Quad9, which keeps its own records under its own policy. With ad blocking on, the VPN server's own filter handles your lookups and passes those it does not block to Quad9, from the server's address rather than yours. That filter's query log and statistics are switched off on all three servers. Until 7 November 2026 it kept one day of statistics; those were deleted that day.

The optional adult-content filter is set up on all three VPN servers and works together with ad blocking. With it on, your device asks it for lookups. It passes those it does not block to the same server's ad-blocking filter, which passes them on to Quad9. Its query log and statistics are switched off, and the statistics it had kept were deleted on 7 November 2026.

The account and website server is separate and is not set to RAM-only. Its service log holds errors and maintenance messages.

Cookies and the website

This website uses no advertising or tracking cookies, and sets no cookies at all. Two pages do keep something in your browser, as described above: the Kapo Guard buy page keeps your licence key, and the USB installer keeps its connection key. The account page talks to our API only to load prices, create account numbers, check your subscription status, list and remove your devices, start a checkout, and, if prepaid codes are offered, use one.

Most pages also send a single one-off pageview count (the Kapo Guard page and the USB installer do not) to our own server on load - the page path and, if you arrived via a link, the referring site's domain. Those two things and the exact time are all we write down: no cookie, no browser fingerprint, and your IP address is not stored alongside it or in our database - so nothing here can tie two pageviews to the same visitor. Our server holds IP addresses in memory for about a minute to limit abuse, then forgets them. We use it only to see which pages get read and where visitors come from, in aggregate.

The Kapo Guard page and the USB installer load code from jsDelivr, a public content network, so your browser contacts it and it can see your IP address.

App update check

KAPO VPN for Android versions after 1.0.8 ask this website for one small file with the latest version number, about once a day, only while KAPO is connected. You can turn this off in the app under Settings, then Check for updates. The request carries no account code, device ID or cookie. Our web server sees the IP address it comes from, which is our VPN server's address, not yours. If you keep KAPO off, the app won't check, so look on this website for new versions. We do not write these requests into our database or tie them to an account. We have not yet confirmed on the live server that the web server keeps no record of them, so do not assume that it keeps none.

Legal requests

Accounts carry no name or email, and we do not set out to keep activity logs. What we could hand over in response to a data request is the records listed under "What we do hold" and what "Server logging" above describes. Payment processors, our email service and the public DNS resolvers hold their own records. We will not fabricate data we do not hold.

Children

KAPO is not directed to children under 13 (or the minimum age in your country) and we do not knowingly create accounts for them.

Changes

If this policy changes we will update this page and the date above. Continued use after a change means you accept the updated policy.

Contact

Privacy questions: privacy@kapovpn.com · Abuse / legal: abuse@kapovpn.com