What KAPO VPN does and doesn't do

What it protects you from

• Your internet provider. Your traffic is encrypted from your device to our server, so your provider cannot read it or see which websites you visit. It can still see that you are connected to a server, when, and how much data you send. Our disguised traffic makes a VPN harder to spot, not impossible.
• The local Wi-Fi. The same goes for whoever runs the cafe, hotel or office network you are on, and for anyone else on it.
• Websites seeing your IP address. Websites see the address of our server instead of yours, so your IP address no longer gives away your rough location.

What it does not do

• It does not make you anonymous. No VPN does. We need no name or email, which limits what we know about you, but that is not the same thing.
• You now trust us instead of your provider. Any VPN operator is in a position to see where your traffic goes while it passes through. We aim not to record it. Our Privacy Policy lists what we do hold, and nobody independent has checked it. Multi-hop sends your traffic through more than one country, but we run all of those servers, so it does not protect you from us.
• Logged-in accounts still identify you. If you sign in to Google, Facebook or your bank, they know it is you, whatever IP address they see.
• Browser fingerprints still identify you. Websites can often recognise your browser from its settings, screen size and similar details, and from cookies. A VPN changes none of that.
• Split tunnelling leaves a gap. Any app or device you keep out of the tunnel uses your normal connection and is not protected.
• The last stretch is not covered. After our server, your traffic travels the normal internet to the website, protected only if the website itself uses encryption (HTTPS).
• Payment can leave a trail. Payment is in crypto through a payment processor, which receives your account number and can link your payment to it. A crypto payment may also be traceable, depending on the coin and how you got it.
• What we hold can be requested. The records in our Privacy Policy are what we could hand over in response to a legal demand. A summary is below.

If your safety depends on not being identified, use Tor Browser, and read its advice first. As a simple rule: a VPN is for privacy, Tor is for anonymity.

Check it for yourself

Connect, then open any independent IP and DNS leak test website in your browser, with the VPN off and then on. The app has its own leak test too, but that comes from us, and it may not show all of these checks yet. With the VPN on, you should see:

• IP address: our server's address in the country you chose, not your own.
• DNS: Quad9, not your internet provider. With ad blocking or the adult-content filter on, the filter on our server answers first and passes the rest on to Quad9.
• IPv6: no IPv6 address at all.

If you see your own address or your provider's DNS, please tell us at support@kapovpn.com.

DNS: who sees the names of the sites you visit

DNS is the phone book of the internet: your device looks up a site's name before it connects. Either way, these lookups travel inside the tunnel, so your internet provider does not see them.

• Ad blocking off: your device uses Quad9 (9.9.9.9), a public DNS service we do not run. Quad9 keeps its own records under its own policy.
• Ad blocking on: your device asks a filter called AdGuard on the VPN server you connect to. It passes the lookups it does not block on to Quad9 over an encrypted connection, from the server's address rather than yours. Its query log and statistics are switched off on all three servers. The one day of statistics it used to keep was deleted on 7 November 2026.
• Adult-content filter on: all three servers have it, and it works together with ad blocking. Your device asks it for lookups. It passes those it does not block to the same server's ad-blocking filter, which passes them on to Quad9. Its query log and statistics are switched off, and the statistics it had kept were deleted on 7 November 2026.

IPv6

IPv6 is the newer kind of internet address. Our servers do not offer an IPv6 way out. The app sends IPv6 traffic into the tunnel, where it stops at our server, so it does not go around the VPN. A site that only works over IPv6 will not load.

The kill switch is an Android setting

A kill switch stops your phone using the normal internet if the VPN drops. On Android this is not a feature of our app. It is Android's own setting, and you have to turn it on:

• Open Android Settings, then Network & internet, then VPN (names differ a little between phone brands).
• Tap the gear next to KAPO VPN.
• Turn on Always-on VPN and Block connections without VPN.

With these off, your phone can go back to your normal connection when the VPN drops. On any other system, do not assume you have a kill switch.

Why this matters even when the app works. If Android stops the KAPO app, for example to free memory or after a crash, while your screen is off, your traffic can go outside the tunnel for a few minutes before KAPO notices and turns the VPN back on. The app can't close this gap by itself. Turning on Always-on VPN plus Block connections without VPN closes it, because Android then blocks the normal internet whenever the tunnel is down.

Where to find it: Settings > Network & internet > VPN > the gear next to KAPO VPN.

You share your exit address with other users

Everyone leaving through the same KAPO server shows the same public IP address, which makes it harder to tell who did what. That only helps as much as the crowd is big, and ours is still small. You may be one of only a few people using an address at a given moment. A bigger VPN gives you a bigger crowd.

The app checks for new versions

Versions after 1.0.8 do this. About once a day, only while KAPO is connected, the app asks this website for one small file with the latest version number. You can turn this off in the app under Settings, then Check for updates.

• What it sends: no account code, no device ID, no cookies, and not your phone model. Only a plain request for the file.
• What our server sees: the IP address the request comes from. That is our VPN server's address, not yours.
• If KAPO is off: the app won't check and sends nothing, so look on this website for new versions.
• What it does: it only tells you about a new version. It never downloads or installs anything by itself.

What we store

The Privacy Policy has the full list and how long each thing is kept. In short:

• Your account: a one-way hash of your account number, its last 4 characters, your remaining time and when it was created.
• Your devices: a one-way fingerprint of each device and when it was first seen, plus the public key, internal tunnel IP, route and time it was added. Your private keys stay on your device.
• Payments: which processor handled the latest payment and a one-way fingerprint of each payment ID, with the time.
• On the VPN servers: each enrolled device's public key, tunnel IP and any multi-hop route, on disk. In memory, the last IP address each device connected from, until the server reboots or the device is removed. That is your real address on the server you connect to. A one-off backup made on 7 November 2026 also holds each device's last IP address on disk until we delete it: see What has not been done. Also in memory, the time of each device's last handshake and how much data it has sent and received, until the server reboots or the device is removed.
• Notes we type: an account we issue or annotate by hand can carry a short note, which can hold details about a person.
• Event log: counters for our own dashboard with exact times, such as checkouts, payments and page views. It holds no account number or device identifier.
• On the account and website server: this separate server has a disk, and holds the account database and ordinary service logs. We also keep nightly backups of the database, so something deleted stays in a backup until that backup is replaced.

Our aim is to keep no log of the websites you visit or the content of your traffic. On 7 November 2026 we checked all three VPN servers: the main system log is kept in memory only, a second logging service that copied it to disk is now off, and both DNS filters have their query log and statistics off. The old disk copies of the system log and the filters' stored statistics were deleted the same day. Nobody independent has checked this: see What has not been done.

What has not been done

• No independent audit. Nobody outside KAPO has checked our servers or our no-activity-logs claim. For now you are taking our word for it.
• Our servers are ordinary rented servers with disks. They are not RAM-only and not diskless. A reboot does not wipe them, and the device records above stay on disk. The hosting companies control the hardware. We use different ones in Reykjavik, Helsinki and Kuala Lumpur.
• Some log files are still on disk. For example kernel and cloud start-up messages, records of SSH logins to the server (ours, and failed attempts by others), a log of addresses blocked after repeated failed logins and, on some servers, server load figures. From what we checked, none of these record your traffic or your DNS lookups. A one-off backup made on 7 November 2026 also holds each device's last IP address on disk until we delete it; we will update this page when we have.

Questions

Ask us at support@kapovpn.com or privacy@kapovpn.com.