Privacy during early access

Updated October 31, 2026. BoltVPN is in early access. Public VPN access is open; general paid checkout remains in test mode.

BoltVPN is a product of JMAF Labs Inc.

Account information

We store your email, display name, linked sign-in provider identifiers, devices, support requests, and subscription records to provide your account. Our website hosting provider also processes website requests and authentication.

Email verification

Resend processes the recipient address and verification email to deliver one-time codes. Codes expire after 10 minutes. We store keyed code hashes and short-lived request records, rather than plaintext codes. Verification emails are transactional; they do not subscribe you to marketing.

Social sign-in

If you choose Google, GitHub, Microsoft, or Facebook, that provider processes your sign-in and shares your basic identity information and email. We request identity access, not your messages, repositories, contacts, or social posts. Provider tokens are used to verify identity and are not kept as ongoing access credentials.

Connections and usage

The VPN service records device and gateway identifiers, connection timestamps, and aggregate uploaded and downloaded bytes for account usage and capacity. The gateway design does not record browsing destinations, DNS queries, or packet contents. This design has not yet undergone an independent privacy audit.

Optional network diagnostics

When you refresh the network card, our hosting edge returns the IP address and approximate location it sees for that request. This does not use GPS or prove that every app is protected. An optional speed check transfers up to 8 MiB of test data to estimate download speed to our edge. The application does not store raw diagnostic IP addresses, location lookups, or speed results on the server. Short-lived salted counters limit repeated checks. Protection-time totals are stored locally on your device and count only intervals the app can confirm; they are not a browsing history or an independent security audit.

Security and retention

Sessions use secure cookies or device tokens. Short-lived verification and sign-in records expire and are cleaned up. Rate limits use salted address hashes rather than raw IP addresses in the application database. Hosting and email providers may retain their own operational logs under their policies.

Account deletion and your requests

Accounts with no active subscription or unfinished checkout can request deletion from Delete account. Sign in to the account, verify a separate deletion code sent to its verified email, and confirm the permanent removal. This removes the stored profile, linked sign-in identities, sessions, devices, connection and usage records, and support messages. A keyed account-identifier hash remains to prevent old sessions from restoring the account. Security audit actions and timestamps may remain with account identifiers replaced and free-text details redacted.

For accounts with billing history, we check that subscriptions and checkout are closed before deleting the profile. Minimal payment-provider references, subscription history and financial review records remain separately, linked to a keyed account marker, for accounting, disputes and required records. We do not retain the deleted profile, email, name, device details or VPN usage in that billing archive. Stripe retains its own invoice and payment records. Account deletion does not issue a refund. Deleting the app does not cancel a subscription. Hosting and email providers may retain their own operational records. For access or correction requests, contact support@boltvpn.io. Complete billing retention periods and service policies remain launch requirements.