Privacy policy

1. Data we store

For every device:

• A device identifier randomly generated by the app on your machine.
• Platform and app version, for technical support.
• The IP address of the most recent API call — overwritten on each call, so no history is kept.
• The device's public key and the in-tunnel address of the currently open session.

Only for registered accounts:

• Display name and email address.
• Password hashed with bcrypt — it cannot be reversed to the original password.
• Subscription history and transaction reference codes.

2. Data we do not store

• Websites you visit, DNS queries, traffic contents.
• Data usage per session.
• The device's private key — it is generated and kept in the app's own storage.
• Browser fingerprints, advertising cookies, third-party tracking code.

3. Retention periods

• Closed or expired sessions: deleted within 30 days.
• Devices inactive for 12 months: deleted along with all their tokens.
• Invoices and transaction codes: kept as required for accounting, at least 5 years.
• Database backups: kept for at most 14 days, then overwritten.

4. Sharing with third parties

We do not sell, rent, or trade user data. The only parties with access to the infrastructure are the server provider hosting our nodes and the transactional email provider. Both see only operational metadata, never the contents of your traffic.

5. Legal requests

When we receive a valid request from a competent authority, we can only provide the data we actually store, as listed in section 1. We are unable to provide browsing history or decrypt traffic, even if compelled to do so.

6. Your rights

• Request a copy of the data linked to your account.
• Request correction of inaccurate information.
• Delete your account, along with all associated devices and sessions, directly from your account page.
• Withdraw your consent at any time by stopping use of the service.

Send requests to support@lycheevpn.com. We respond within 30 days.

7. Cookies

The website sets only two technical cookies: one for your login session and one for the anti-forgery token used by forms. There are no analytics or advertising cookies. If you are not logged in, the site works normally without setting any cookie other than the anti-forgery token.

8. Changes to this policy

Any changes will be posted on this page with an updated date. If a change reduces the current level of protection, we notify users with accounts by email at least 30 days in advance.

9. Contact

Privacy: support@lycheevpn.com
Abuse: abuse@lycheevpn.com