Privacy policy

Litora is a VPN service. This page says what we collect, why, and what we never collect. It is written by the people who built the service and is awaiting review by counsel; where the reviewed version differs, it will replace this text and the effective date will change.

What we never collect

The sites you visit, or the names your device looks up. Gateways run their own DNS resolvers with query logging off, and traffic destinations are not recorded.
Your private key. It is generated in your browser and never sent to us; we could not disclose it because we never had it.
Your email address. Nothing asks for one.
Payment card numbers, wallet keys, or any payment instrument. Telegram and the crypto invoice page handle payment on their own systems.
National identity numbers. A payment processor once required them; we withdrew the processor and kept the principle.

What we collect, and why

A sign-in identity. Either your Telegram user ID, or the subject identifier Google or Apple asserts when you sign in. It is how your access is yours. There is no password.
Device records. The public key of each device configuration you create, and when it was created or revoked. Public keys cannot be turned into private ones.
Session records. Which gateway a device was placed on and when the session expires. Sessions expire after 30 days.
Usage totals. How much data your account moved, measured per account — data allowances would mean nothing otherwise. Totals, not contents.
Purchase records. What was bought, on which rail, what was quoted and what settled. Required to grant what you paid for and to handle disputes.

Where things run

Exit gateways are in the European Union (Poland and Lithuania today). The control systems run in Turkey. Payment happens on Telegram's or the crypto processor's systems, not ours. These are three different legal regimes, and we name them rather than hiding them.

Retention

Session records are removed as sessions expire and are swept. Purchase records are kept for as long as disputes about them are possible. Device records live until you revoke the device or your account is removed. The reviewed version of this policy will carry exact periods per class.

Your choices

You can revoke any device at any time from the portal, reissue or invalidate a subscription link, and stop using the service without telling anyone. To ask about your data, message the bot.