Privacy Policy
Written from the code, not from a template. Every claim below describes something you can check in the source.
Last updated 31 July 2026
We do not know your name, your email, or your address, because we never ask. We do not record which sites you visit. What we do keep is listed in full below — it is short, and none of it is your browsing.
1. What we ask you for
Nothing. There is no signup form. You sign in by proving you control a wallet address — your wallet signs a short message, we check the signature. That is the whole account.
The message you sign says, in plain text, that it grants sign-in only and authorises no transaction. Read it before you sign; it is shown in full every time.
We therefore hold no email address, no name, no password, and no payment card — not because we protect them well, but because they were never collected and cannot be demanded from us.
2. What we store
This is the complete list. It is derived from the database schema, not summarised from it.
| Record | What is in it | Why | Kept for |
|---|---|---|---|
| Account | Wallet address, which wallet family (EVM or Solana), creation date | To know your devices and plan are yours | Until you stop using the service |
| Session | A random token, expiry | To keep you signed in | Until it expires or you sign out |
| Device | A name you choose, platform, WireGuard public key, tunnel address (10.7.0.x) |
To route your traffic and let you revoke a lost device | Until you revoke it |
| Security events | What happened (signed in, device added, device revoked) and when | So you can see if someone else got in | Rolling window |
| Route events | Which country your device used, and why the router chose it | So the route history in your terminal is real | Rolling window |
| Payments | Transaction hash, amount, which plan | To stop the same payment being used twice | Kept — it is a financial record |
Your private key never reaches us
Your device generates its own WireGuard key pair and sends us only the public half. We could not decrypt your tunnel if we wanted to, and neither could anyone who took the database.
3. What we do not store
These are the entries you would find in most VPN privacy policies as carefully worded promises. Here they are absences in the schema.
- No browsing history. No record of which sites or services you visited, at any time, in any form.
- No DNS query log. The resolver on the node answers your lookups and keeps counters — how many were asked, how many were blocked. Not what was asked.
- No connection log tied to you. No timestamps-plus-address record of who was connected when.
- No traffic content. The tunnel is WireGuard; we hold no key that would open it.
- No IP address history. Your home IP address is not written to the database. Admin sign-ins are the one exception, and those are ours, not yours.
4. The parts that need explaining honestly
Application routing
ROHU decides which applications belong in the tunnel. To do that it needs to know what
kinds of applications exist — that chrome.exe is a browser, that some unfamiliar
executable talks to an exchange.
That knowledge is stored as a catalogue of applications, with no device and no account attached to any entry. "chrome.exe is a browser" is the same fact for every user, and attaching a person to it would create exactly the browsing record this policy says does not exist. When your device asks what to do with its applications, it sends its own list and receives an answer; that exchange is not written down.
The phishing filter
A domain you look up is checked against a blocklist locally on the node. If it is unknown and looks suspicious, a language model may be asked about it — the bare domain, nothing else. No address, no device, no account, and no connection to you.
Where that model runs matters, so we state it plainly: on nodes running a local model, the domain never leaves the machine. If we ever use a hosted model instead, this page will say so before it happens.
Node measurements
Our nodes measure their own latency to supported services. This is about the servers, not about users, and contains no user data at all.
5. Payments
Payment is on-chain. That means the transaction is public on the blockchain forever, visible to anyone, and we cannot change that — it is a property of the chain, not a choice we made.
The wallet you pay from is linked, publicly and permanently, to a payment to us. A VPN protects the route your traffic takes. It does not make a blockchain transaction private. If that link matters to you, pay from a wallet that is not tied to your identity.
6. Who else sees anything
We do not sell data, and we have nothing to sell. Data reaches other parties only where running the service requires it:
- Hosting providers operate the machines our nodes run on. They can see that traffic passes, as any host can.
- Upstream resolvers see DNS queries forwarded from our nodes, coming from the node's address — not yours.
- Threat feeds supply the blocklist. We download from them; we send them nothing.
7. What you can do
- See everything. Your terminal shows every device, session and security event we hold.
- Revoke. Any device or session, immediately. A revoked device stops working on the node's next sync, not eventually.
- Leave. Ask us to delete the account and it goes, along with its devices and events. Payment records stay, because a financial record must.
8. Legal requests
If we are compelled to hand over data, we can only hand over what exists. That is the list in section 2 — a wallet address, some device names, and public keys. There is no browsing history to produce, because there is none to keep.
We will say if that ever changes.
This page is written to be accurate about what the software does. It has not been reviewed by a lawyer, and it is not a substitute for advice about your own situation or jurisdiction. If you need a guarantee rather than a description, do not rely on this page alone.
9. Changes
If what we store changes, this page changes first, and the date at the top changes with it.