This page lists exactly what BoltVeil stores and what it never stores. It is part of our Privacy Policy. We would rather tell you precisely what we keep than promise "zero logs" and leave out the details.
What we store
| Data | Why we keep it | How long |
|---|---|---|
| Your email address and name | Your account, sign-in and service emails | While your account exists |
| Your password, as a one-way hash | Sign-in. We cannot read it | While your account exists |
| Billing records: plan, amounts, dates and status, plus the card brand and last four digits or the crypto order references | Payments, receipts, refunds and tax law | As long as the law requires, usually up to seven years |
| Rewards ledger: every Bolts movement with its date and amount, and for offers the offer name and transaction reference | Crediting and reversing Bolts, stopping abuse | While your account exists |
| Configuration events: the server, protocol and time of each configuration download on our website or configuration fetch by our apps, and the IP address used to reach our website or API | Showing your recent connections, running missions, stopping account sharing and abuse | The IP address: 7 days. The rest of the event: 90 days |
| The IP address you signed up from and the country we derive from it | Stopping self-invites and multi-accounting, suggesting a nearby server | The IP address: 90 days. The country: while your account exists |
| A one-way keyed hash of your signup network (not reversible into an IP address) | Stopping invite rewards between accounts from the same network | While your account exists |
| Your VPN account at our network partner: a random username, a password and WireGuard keys, stored encrypted | Letting your devices connect | While your account exists |
| Proxy traffic totals: how much you have used and how much is left | Proxy balances and billing | While your account exists |
Website sessions, technical logs and linked devices are described in the Privacy Policy.
About configuration events
The IP address in a configuration event is the one your device used to reach our website or API when it downloaded or fetched a configuration. The VPN servers do not record it, and it tells us nothing about what you do once connected. Because a device usually fetches a configuration shortly before it connects, that address is often the network you then connect from. That is why we treat these events as personal data: we erase the IP address after 7 days and the whole event after 90 days, and delete everything at once if you delete your account.
What we never store
- The websites and apps you visit or use through the VPN.
- Your DNS queries.
- The content of your traffic.
- When your VPN connection starts or ends, or how long it lasts, on the VPN servers.
- The IP address you connect to the VPN servers from, as recorded by the VPN servers.
- How much data you send or receive through the VPN.
We never sell or share browsing data, because we do not have it.
Who operates the VPN servers
We do not own or run VPN servers. The BoltVeil VPN network is operated by an infrastructure partner under contract with us. Its published privacy policy states that it does not keep records of VPN browsing activity, DNS queries, connection and disconnection times, source IP addresses, destination addresses or the bandwidth used by individual users, and that the data a server must hold in memory to route your traffic while you are connected disappears when it is no longer needed.
The partner holds only what it needs to run your VPN account: the random username, credentials and keys we create for you, and whether the account is active. It does not receive your name, your email address or your payment details.
No independent audit. Neither BoltVeil nor our network partner has had an independent audit of these commitments, so we do not claim one. If that changes, we will publish the report here. We will tell you the name of our network partner on request.
Residential proxies
The commitments above are about the VPN. Proxy traffic runs through our residential proxy partner's network, which may keep technical logs under its own policy to secure its network and investigate abuse. We receive only your traffic totals, not the addresses you visit. Do not use the proxies for anything you would not want an infrastructure provider to see; for privacy, use the VPN.
Requests from authorities
If we receive a valid legal request, we can only provide what is listed under "What we store". We cannot provide browsing history, DNS queries or traffic content, because we do not have them.
Changes to this policy
If we ever change what we store, we will update this page before the change takes effect and email you about material changes.