Short version: We collect the absolute minimum required to operate the service. We do not know who you are. We do not store what you do online. We cannot share what we don't have.
1. Who we are
FluxVPN AB is a privately held company registered in Sweden, operating under Swedish and EU law. We provide a Virtual Private Network (VPN) service accessible via our applications and website at fluxvpn.app.
We are committed to the highest standards of user privacy. This policy describes what data we process, why, and what we do not process - which is equally important.
2. What we collect
We collect only the information strictly necessary to provide and improve the service:
2.1 Account information
When you create an account, we generate a random 16-digit account number for you. This number is your only identifier. We do not collect your name, email address, phone number, or any other personal identifying information.
2.2 Payment information
If you purchase a paid subscription, we process a payment transaction. We accept only cryptocurrency (Bitcoin, Monero, Ethereum, Solana, USDT) - no credit or debit cards. We do not offer card payment because card processors require identity verification and leave a financial paper trail; that would be incompatible with our promise to be a private VPN.
For crypto payments:
- Cryptocurrency (BTC, XMR, ETH, SOL, USDT): Transactions are handled on-chain. We receive only the public wallet address used in the transaction and the transaction hash. No personal data is required.
Payment data is associated with your account number only - never with any personal identifier.
2.3 Aggregate service metrics
We collect anonymised, aggregated statistics about our server infrastructure - total bandwidth used per server, server load, uptime - to ensure service quality. This data cannot be linked to individual users.
2.4 Support communications
If you contact our support team, we retain the content of that communication for up to 12 months. You are not required to identify yourself beyond your account number.
3. What we never collect
The following categories of data are never collected or stored by FluxVPN:
- Your real IP address
- DNS queries you make while connected
- Websites or services you access
- Traffic content of any kind
- Connection timestamps or session durations
- Your physical location
- Device identifiers, MAC addresses, or hardware fingerprints
- Your name, email, or any government-issued identifier
We have designed our systems so that even if compelled by a court order, we would have nothing useful to provide about any individual user's activity.
4. How accounts work
FluxVPN uses a novel account model inspired by cryptographic wallet design. When you click "Generate account," your browser generates a cryptographically random 16-digit number locally. This number is transmitted to our servers solely to register a subscription record.
Because this number was generated randomly and is not linked to any email address, phone number, or other identifier, it is effectively anonymous. Whoever holds the number controls the account. We strongly recommend:
- Writing your account number down on paper and storing it securely
- Never sharing your account number with anyone
- Treating your account number like a password or private key
We cannot recover a lost account number. There is no password reset mechanism because there is no identity to reset it to.
5. Payment processing
FluxVPN accepts only cryptocurrency. We do not accept credit or debit cards, PayPal, or any payment method that requires identity verification. If we added card payment, we could not call ourselves a private VPN - card processors require identity checks and leave a trace that can be linked to you.
Accepted payment methods:
- Bitcoin (BTC) - on-chain, self-custodied wallets only
- Monero (XMR) - the privacy-native option; transactions are untraceable by design
- Ethereum (ETH) - on-chain
- Solana (SOL) - fast, low-fee on-chain payments
- USDT - stablecoin on supported networks
We specifically do not offer PayPal, Google Pay, Apple Pay, card payments, or other systems that require account linking or identity verification, as these are incompatible with our privacy model.
6. Server infrastructure
All FluxVPN VPN servers operate in RAM-only (diskless) mode. No data is written to persistent storage on any server. When a server restarts, all memory is cleared. There are no access logs, connection logs, or session logs on any server.
Our Blind Operator model means that even the companies hosting our physical servers cannot read any VPN traffic, as all content is encrypted end-to-end. Hosting providers see only encrypted traffic volumes, not content or identities.
7. Website & cookies
Our website (fluxvpn.app) uses a minimal set of cookies necessary for operation:
- Session cookie: Keeps you logged into your account during a browser session. Expires when you close your browser or log out.
- Preference cookie: Stores UI preferences such as language. Expires after 1 year.
We do not use:
- Advertising or tracking cookies
- Third-party analytics (Google Analytics, Hotjar, Mixpanel, etc.)
- Social media tracking pixels
- Fingerprinting scripts
Our website does not load any external resources from advertising networks or data brokers.
8. Data sharing
We do not sell, rent, or share your data with any third party for commercial purposes. We do not use payment processors that receive your identity (we accept only cryptocurrency). The only third parties who may process data on our behalf are:
- Server hosting providers - they see only encrypted traffic, no user data or identities
All such processors are contractually bound to use data only for the specific purpose described and are prohibited from using it for any other purpose.
9. Data retention
We retain data for the minimum period necessary:
- Account records: Retained as long as the account is active. Deleted within 30 days of account cancellation.
- Payment records: Retained for 7 years as required by Swedish tax law. These records contain only account numbers and transaction IDs - no personal identifiers.
- Support communications: Deleted after 12 months.
- Server logs: None created.
10. Your rights
Under the EU General Data Protection Regulation (GDPR) and Swedish law, you have the following rights:
- Right of access: Request a copy of all data we hold associated with your account number.
- Right to rectification: Request correction of any inaccurate data.
- Right to erasure: Request deletion of your account and associated data. We will comply within 30 days.
- Right to data portability: Receive your data in a structured, machine-readable format.
- Right to object: Object to any processing you believe is not justified.
- Right to lodge a complaint: You may complain to the Swedish Authority for Privacy Protection (IMY) at imy.se.
To exercise any of these rights, contact us at privacy@fluxvpn.app with your account number. Note that because accounts are anonymous, we can only act on data linked to the account number you provide.
11. Jurisdiction & law enforcement
FluxVPN AB is incorporated in Sweden and is subject to Swedish and EU law. We comply with valid legal orders from competent authorities.
However, because we do not collect or retain connection logs, IP addresses, or user activity data, we have nothing to provide in response to most requests for user activity. We can confirm only whether an account number exists and its subscription status.
We will always notify users of legal requests where we are legally permitted to do so, and we will challenge requests that we believe are overbroad, unlawful, or incompatible with EU law.
We do not cooperate with informal requests, voluntary data sharing programmes, or surveillance initiatives.
12. Children
Our service is not directed at children under the age of 16. We do not knowingly collect information from minors. If you believe a minor has created an account, please contact us and we will delete the account promptly.
13. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will post a notice on our website at least 30 days before the changes take effect and update the "Last updated" date at the top of this page.
We will never make changes that reduce your privacy rights without providing advance notice and, where required by law, obtaining your consent.
14. Contact
Data controller: FluxVPN AB, Stockholm, Sweden
Privacy enquiries: privacy@fluxvpn.app
General support: support@fluxvpn.app
For urgent security disclosures: security@fluxvpn.app