Privacy Policy

Skryt is a VPN client. The entire point of it is that fewer parties see what you do online — so this policy is specific about the handful of things we necessarily hold, and equally specific about what we don't.

1. What we collect

Account information

When you sign in, we hold the email address on your Stremit account, a hashed version of your password (we never store the password itself), the date the account was created, and flags recording whether your Stremit Pro subscription or Skryt add-on is active.

Billing

Subscriptions are processed by Stripe. We store the Stripe customer and subscription identifiers so we can tell whether your plan is active. We never receive or store your card number — that stays with Stripe.

Tunnel credentials

When you first connect to a location, we generate a WireGuard key pair for you on that server and record it against your account: the public key, the private key, the internal tunnel address assigned to you (for example 10.66.66.11/32), which server it belongs to, and when it was created. This peer is reused on later connections so your tunnel identity stays stable instead of changing every session.

What we don't collect

• Your browsing history, the sites you visit, or your DNS queries.
• The contents of your traffic. It is encrypted between your device and the exit server.
• Advertising or analytics identifiers. The app bundles no analytics, attribution or crash-reporting SDK — the only network calls it makes are to our own API and the tunnel.

2. What stays on your device

• Your session token is held in memory only. Closing the app or signing out discards it, and you sign in again next launch.
• Your preferences — currently just the auto-connect setting — are stored locally on the device and never sent to us.
• Latency measurements are taken by your device against each server and displayed to you. They are not reported back to us.
• Speed counters are read from your operating system's own network statistics for display in the app. They stay on the device.

3. What happens on the VPN servers

Our exit servers run WireGuard. In the ordinary course of operating it, a server holds — in memory, for each configured peer — the peer's public key, its assigned internal address, the time of the most recent handshake, and cumulative byte counters. This is how the protocol keeps a tunnel alive; it is not a browsing log, and it does not record destinations.

We do not run traffic logging on our exit nodes. We may retain short-lived operational logs (for example, system and error logs from the API) needed to keep the service running and to investigate abuse or outages.

4. How we use what we hold

• To sign you in and keep your session valid.
• To check that your subscription entitles you to connect — this is verified every time you connect, not just at sign-in.
• To issue and reuse your WireGuard peer configuration.
• To operate, debug and secure the service.

We do not sell your personal information, and we do not use it for advertising or profiling.

5. Who else is involved

• Stripe — payment processing and subscription status.
• Our hosting and server providers — they operate the machines the API and exit nodes run on, and are subject to their own privacy terms.
• Law enforcement — we will disclose information only where we are legally compelled to, and only what we actually hold, which is described above.

6. How long we keep it

• Account records last as long as your account does.
• Peer records last until the peer is revoked or your account is deleted. Revoked peers may be retained in a deactivated state so the same internal address is not immediately reissued.
• Operational logs are kept only as long as needed to run and secure the service.

7. Your rights

You can ask us to show you the personal data we hold about you, correct it, or delete it along with your account and issued peers. Depending on where you live you may have further rights under laws such as the GDPR or CCPA, including objecting to certain processing or requesting a portable copy of your data.

To make a request, email us at the address below from the address on your account.

8. Children

Skryt is not directed at children, and we don't knowingly create accounts for anyone under 13 (or the minimum age in your country, if higher).

9. Changes to this policy

If we change what we collect or how we use it, we'll update this page and move the date at the top. Material changes will be signalled in the app.

10. Contact

Questions or requests: privacy@skryt.app.