How to Read a VPN Logging Policy

Start with the exact promise

When a VPN says it does not keep logs, find the sentence in its privacy policy that defines the claim. A policy might rule out saving the sites you visit and still describe records used to issue access, handle support or operate the service. Keep the exact wording and the policy date. If you cannot identify the kind of record the sentence refers to, mark the scope as unclear.

Begin with the information you care about most. For example, you may want to know whether anyone stores your original IP address together with a connection time. That is a different question from whether an operator saves browsing history. Our guide to what a VPN can and cannot hide explains the network path and why a website account remains a separate source of information.

Make a record map before comparing providers

Give each record its own row in a note. Use five columns: information, system, purpose, retention and evidence. Begin with four categories. These are questions to ask, not a list of records every VPN keeps.

• Browsing activity: Does an operator store destination domains, DNS requests or browsing content? Does its answer cover all the servers and name resolution services used by the app?
• Connection events: Does the service keep an incoming IP address, a session timestamp or a device identifier? If the fields are stored separately, ask whether an operator can join them.
• Access and payment: What records establish that access is valid, when it expires and which device can use it? Who keeps any payment or reconciliation record?
• App diagnostics and support: What stays on the device, what is transmitted automatically and what leaves only when the user submits a report? Does the answer differ by platform?

For diagnostics, compare the documented JungleVPN app controls with the release you are actually using. An interface that displays a count or timestamp does not by itself tell you whether the same field is sent elsewhere or retained after the app closes.

Check when the retention clock starts and ends

For every record the policy says is stored, look for a duration or a rule that decides when it is removed. A line such as “seven days” is incomplete if you cannot tell whether the clock starts when the event happens, when a support case closes or when an account ends. Ask whether the rule covers searchable copies, backups and support exports, and what happens to a retained copy after a restore.

The UK Information Commissioner’s storage limitation guidance illustrates why retention schedules identify categories of information separately and why taking information offline differs from deleting it. Use those distinctions to make a precise question about a policy. A single retention number cannot answer for records outside its stated scope.

Match the evidence to the product you would use

If a provider cites an audit, look for the report or a scope statement you can actually read. Note the date, named service, components included and exclusions. A review of network servers may tell you something useful about those servers during the period examined. It cannot answer a question about an app, payment system or support platform that the review did not cover. Check whether the reviewed service and the one on offer are the same.

Read the current JungleVPN privacy and logging disclosure with that same scope in mind. It describes an intended short retention period for a temporary supercode verification record and says that retention and deletion across the complete live service still need verification. It discusses access and payment records separately. Read the JungleVPN activation and access guide to see where that verification step fits. The code entry window is a separate question from how a system handles records.

Ask one question the provider can answer

Send a narrowly framed enquiry: “For this app version and service, do any of your systems or network partners retain my incoming IP address and connection time? If so, which system stores them, how long are they kept, and can they be associated with an access record?” Adapt the question to the fields in your own note. Ask for the relevant policy section or review scope so you can check the answer later.

You can ask without sending a real code, credentials or a configuration file. The OWASP application logging guidance treats credentials and session secrets as sensitive fields to keep out of direct logging. If support requests a screenshot or export, use our VPN support report privacy checklist before attaching anything.

Keep unanswered rows visible

Label each row as explicitly excluded, stored with a stated rule, or unanswered. A response that explains server browsing records may leave the app diagnostics row open. Compare providers on the same field and system, and decide which unanswered question affects your intended use. Keep the date and policy link with your notes so that a later policy or app change has a clear baseline.