Privacy policy

Litora is a VPN service. This page says what we collect, why, and what we never collect. It is written by the people who built the service and is awaiting review by counsel; where the reviewed version differs, it will replace this text and the effective date will change.

What we never collect

The sites you visit, or the names your device looks up. Gateways run their own DNS resolvers with query logging off, and traffic destinations are not recorded.
Your private key. It is generated in your browser and never sent to us; we could not disclose it because we never had it.
Your email address. Nothing asks for one.
Payment card numbers, wallet keys, or any payment instrument. Telegram, the card payment page and the crypto invoice page handle payment on their own systems.
National identity numbers. A payment processor once required them; we withdrew the processor and kept the principle.
Your IP address, on this website or in the portal. Our analytics provider never receives it: the requests are relayed by our own server, which strips the address before passing them on, and the events carry a flag that turns off location lookup.

What we collect, and why

A sign-in identity. Either your Telegram user ID, or the subject identifier Google or Apple asserts when you sign in. It is how your access is yours. There is no password.
Device records. The public key of each device configuration you create, and when it was created or revoked. Public keys cannot be turned into private ones.
Session records. Which gateway a device was placed on and when the session expires. Sessions expire after 30 days.
Usage totals. How much data your account moved, measured per account — data allowances would mean nothing otherwise. Totals, not contents.
Purchase records. What was bought, on which rail, what was quoted and what settled. Required to grant what you paid for and to handle disputes.
Product analytics. Which pages were opened, which setup steps completed, and which of them turned into a purchase — so we can tell what is broken from what is merely unused. It is processed for us by PostHog, in the United States.

On the website and in the portal this is a small script we wrote, not a third-party library. It stores no cookie, keeps a random identifier that lasts one visit and is not linked to your account, and sends nothing at all if your browser asks not to be tracked (Do Not Track or Global Privacy Control). It reports the page path and campaign parameters such as utm_source; it never reports the rest of a URL, which is where sign-in codes and setup links live.

From the Telegram bot we record the sale itself — plan, rail, price, and whether a trial converted. You are identified there by a value derived from your Telegram user ID with a secret key that never leaves our systems, so PostHog can tell one customer from another and cannot tell who either one is. It never receives your Telegram ID, username, or anything you typed.

Where things run

Exit gateways are in the European Union (Poland, Lithuania and Germany) and in the United States (Chicago). The control systems run in Turkey. Payment happens on Telegram's or the crypto processor's systems, not ours. Product analytics is processed by PostHog in the United States. These are four different legal regimes, and we name them rather than hiding them.

Only the exit you pick is in the path, and the choice is yours: traffic leaving through Chicago is handled under United States law, and traffic leaving through a European one is not.

Retention

Session records are removed as sessions expire and are swept. Purchase records are kept for as long as disputes about them are possible. Device records live until you revoke the device or your account is removed. The reviewed version of this policy will carry exact periods per class.

Your choices

You can revoke any device at any time from the portal, reissue or invalidate a subscription link, and stop using the service without telling anyone. Turning on Do Not Track or Global Privacy Control in your browser stops the website and portal sending any analytics at all, and nothing about the service changes when you do. To ask about your data, message the bot.