How TinyStone / DawnVPN handles account, billing, and operational data. VPN node service logs record the connecting IP address and account name and are kept for at most 7 days. We do not keep a browsing-history archive of sites you visit through the VPN. This is not a certified no-logs claim.
Effective date: 6 October 2026 Last updated: 6 October 2026 Document version: 2026-10-06 1. Who we are DawnVPN is a consumer VPN and network-acceleration service operated by TinyStone (“we”, “us”, “our”). The registered legal entity name, company number, and registered office are not yet published on this page and will be added when finalized. Until then, treat TinyStone / DawnVPN as the operator of https://www.tinystone.us, https://client.tinystone.us, and the official DawnVPN clients (Windows, Apple platforms, Android, Linux/CentOS, and the travel-router gateway). Privacy requests: [email protected] General support: [email protected] Website: https://www.tinystone.us 2. Scope This policy describes personal data we process when you create an account, buy a plan, sign in, run a client, connect to a VPN node, order an exclusive server, open a support ticket, optionally contribute a TLS fingerprint, or optionally watch a rewarded advertisement. It covers the public website, customer APIs, and official apps. It does not govern third-party sites or services you reach while connected. 3. What we collect We process the following categories when you use DawnVPN: • Account: username, email address (when you provide it or when verification is required), password hash (passwords are not stored in plaintext), UI language, and support notes. • Subscription and billing metadata: plan, status, expiry, store or processor references (for example an Apple subscription identifier), traffic quota, and monthly usage totals. Payment cards are handled by the payment processor; we do not store full card numbers (PAN) on our servers. • Devices and sessions: device or installation identifiers used for multi-device limits and abuse prevention; portal session tokens and their expiry; the virtual tunnel address (VIP) leased to that device while it is connected. • Portal security logs: time, username or email, source IP address, user-agent, and success or failure reason for sign-in and similar account actions. • VPN operations metadata: the node you connected to, coarse session timing used for online/presence status (one current row per account, not a connection history), and bytes uploaded and downloaded per node per billing month (quota, capacity, and abuse control). • VPN node service logs: when a connection is established, the node’s service log records the connecting IP address and port, your account name, the virtual tunnel address (VIP) assigned to the session, and the device identifier. The same log may include the session identifier, transport choices, and, when the session ends, byte counts for that session. About every 10 minutes the node sends its most recent log lines to our control server, at most 80 lines per status report (shortened if the text is very long). The control server keeps at most the latest 200 reports per node. Purpose: troubleshooting, abuse prevention, and service security. These logs do not include the contents of your traffic or the sites you visit. • Support: ticket subject, category, message text, and attachments you send. • Email operations: one-time codes and send logs (recipient address, source IP, purpose) needed to deliver and rate-limit verification messages. • TLS fingerprints: an HTTPS visit to the customer portal records the browser TLS ClientHello (JA3) and User-Agent into a shared pool used for connection camouflage. That record is not tied to your account by itself and is not a log of VPN destinations. If you are signed in, we may assign one pool entry to your account. You can also contribute a fingerprint from the portal fingerprint page. • Optional rewarded ads: if you watch an ad to receive extra traffic, we record the callback (account, result, granted bytes, client IP, user-agent, and the ad-unit or transaction identifiers supplied by the ad network). • Travel-router cloud: if you use the travel-router gateway with our router cloud, we store a device identifier, a hash of the bind token (not the token), the latest encrypted configuration (ciphertext we cannot read), the latest status blob the router sent (replaced on each update, not a history), and encrypted remote commands. • Operator audit log: actions taken in the admin console, including the operator name, source IP, and the account or object named in the action. 4. What we do not collect We do not run a “browsing history” feature. We do not log browsing content or the destinations of traffic inside the VPN tunnel. We do not intentionally retain: • the contents of traffic inside your VPN tunnel; • an archive of websites, hostnames, or destination IPs you visit through the tunnel; • a plaintext archive of DNS queries kept as a history file; • the files you transfer or the contents of your encrypted application sessions. VPN nodes forward tunneled packets without writing those destinations into the service log in section 3. A travel-router feature that matches a destination name on the device itself, in order to choose a route or block a category, does not upload that name to our control server as a browsing archive. We do not sell personal data. We do not advertise an independently audited “no-logs” certification. The operational records in section 3 exist so we can bill, secure accounts, enforce quotas, troubleshoot nodes, and prevent abuse. 5. How we use information • Create, authenticate, and secure accounts; verify email; reset credentials. • Provide VPN connectivity, exclusive-server fulfillment, and plan entitlements. • Measure usage against your quota and detect sharing, flooding, or attacks. • Troubleshoot nodes and investigate abuse using short-term connection logs (connecting IP address, account name, device identifier, virtual address). • Process payments and unlock purchases (app stores and checkout links). • Answer tickets and send transactional notices. • Understand node load and reliability using aggregate counters. • Comply with law and enforce our Terms of Service. 6. Connection records and retention The control server deletes the records below on this schedule. It does not keep a second copy past the period. A size cap, where stated, can delete rows sooner. • Account profile (username, email, password hash, language, notes, and the subscription status we store): while the account is open. When you delete the account, or an administrator deletes it, we remove the profile at that time. We do not keep a leftover account profile afterwards. Leftover login, email, and ad rows that have no foreign key are stripped of the account name or address and then follow the time limits below. • Monthly traffic counters (bytes uploaded and downloaded, per account, per node, per UTC calendar month): 12 months, including the current month. An older billing month is deleted. • Portal login and security logs (time, username or email, source IP, user-agent, success or failure): 90 days. We also keep at most the latest 5,000 login rows. • Email send log (recipient address, source IP, purpose such as verification): 90 days. • One-time passwords: the code expires after 10 minutes. The stored hash, address, and IP are deleted within about a day after expiry. • Operator audit log (operator account, action, source IP, and the customer or object the action names): 90 days. • VPN node service logs: on the node, the system journal keeps them for at most 7 days (a size limit may remove them sooner). Each status report includes at most 80 lines. The control server keeps at most the latest 200 reports per node and deletes reports older than 7 days. • Virtual tunnel address leases: account, device identifier, and VIP while the session is active, then released after about 60 minutes without activity (the operator can change that idle time). This is not a connection history. • Online presence: one current row per account (last node, rates, a short client label). It is overwritten, not appended, and removed when the account is deleted. • Portal session tokens: until they expire (30 days), you log out, or the password changes. Expired tokens are deleted. • Support tickets and messages: removed when the account is deleted, and also removed 24 months after the ticket’s last update. • Subscription rows we store (plan, status, store, transaction identifiers): removed when the account is deleted. Apple, and Stripe when you pay through a Stripe link, may keep their own payment records for longer under their rules. • Rewarded-ad callback and grant logs: 12 months. • TLS fingerprint pool: an entry that is not assigned to an account is deleted 12 months after it was last seen. An entry assigned to an account stays with that account and is removed when the account is deleted. • Travel-router cloud commands: they expire within minutes (at most 10) and we delete the stored ciphertext 7 days after expiry. The device row, token hash, latest encrypted configuration, and latest status blob stay until that device registration is removed. • In-app notices: removed when their expiry time passes. A notice with no expiry stays until an operator revokes it. 7. Where data is stored and jurisdiction Account data, billing metadata, tickets, security logs, and copies of recent node service-log lines are stored on our control-plane systems (commercial cloud infrastructure, including hosts we currently operate in Singapore and other regions used for the portal). VPN nodes are located in multiple countries and may be rented from Vultr, Linode (Akamai), or DigitalOcean. Tunneled traffic is processed on the node you select; we do not keep a destination history on that node as described in section 4. The node’s own service journal is kept for at most 7 days. The operator’s formal legal jurisdiction will be stated here when the registered entity is published. 8. Subprocessors and other third parties We use the following processors. Each receives only what it needs for the role described. • Apple. Distributes the iOS, macOS, and tvOS apps through the App Store. In-app purchases use StoreKit; we store the subscription and transaction identifiers tied to your account. We do not use Apple push notifications. • Google Firebase Analytics and Crashlytics. Used by the iOS DawnVPN app and the TR3000 travel-router manager app for crash reports and product analytics. They are not linked into the VPN packet-tunnel extension, and the macOS and tvOS apps do not initialize them. They do not receive tunneled traffic. • Google AdMob. Shows advertisements in the iOS app, including rewarded ads that can add traffic quota. The Android app does not currently include an AdMob application id. Ad callbacks to our server are described in section 3. AdMob’s own policy applies to the ad impression. The iOS app may ask for App Tracking Transparency before personalized ads. • Cloudflare. Fronts www.tinystone.us, client.tinystone.us, and the travel-router host router.tinystone.us, and provides Turnstile checks on registration and email verification when that check is turned on. Cloudflare sees ordinary request data such as IP address, URL, and user-agent. We also store an encrypted portal-address record in Cloudflare DNS; it is not your account contents. • Resend. Sends transactional email (verification codes and account notices) through api.resend.com. Resend receives the recipient address and the message. • Stripe. Used when a plan’s checkout link is a Stripe Payment Link. You pay on Stripe’s page. We do not store card numbers. The Android client does not use Google Play Billing; a plan may still open a checkout link, including a Stripe link. • Vultr, Linode (Akamai), and DigitalOcean. Host VPN node virtual machines. We call their APIs to create, import, and manage instances (region, instance id, public IP). They see hosting and network telemetry for those machines, not a DawnVPN browsing archive. • GitHub. Hosts an encrypted bootstrap file that clients download to find the portal. The file does not contain your account contents or VPN traffic. • Google Play. If you install the Android client from Play, Google handles that distribution. The client does not integrate Play Billing. We do not put a marketing-analytics SDK on the VPN data path. Firebase Analytics, listed above, runs in the iOS application process and the TR3000 manager app, not inside the tunnel. 9. Payments and analytics When you pay, Apple (In-App Purchase) or Stripe (when a plan’s checkout link is a Stripe Payment Link) handles payment credentials. We record confirmation metadata such as plan, status, expiry, and transaction references. We do not store full card numbers. We do not currently operate a named third-party marketing-analytics product on signed-in website pages. The iOS DawnVPN app and the TR3000 travel-router manager app use Google Firebase Analytics and Crashlytics as described in section 8. Those libraries are not part of the VPN tunnel. 10. Children The service is not directed at children. You must be at least 18 to purchase a paid plan, or the minimum digital-consent age in your country (16 in much of the EEA) if that age is higher. We do not knowingly collect personal data from children under 16. If you believe a child has registered, write to [email protected] and we will delete the account. 11. Your rights (GDPR, UK GDPR, CCPA/CPRA, and similar) Depending on your location you may request access, correction, deletion, or a portable copy of account data; object to or restrict certain processing; withdraw consent for optional features (fingerprint pool, rewarded ads); and appeal a refusal. California residents may request a category notice and opt out of “sale” or “sharing” as those laws define those terms — we do not sell personal information. Residents of the EEA, UK, or Switzerland may complain to their supervisory authority. We will ask for enough information to locate your account. Some payment or security records may be kept where the law requires. 12. International transfers Accounts and nodes are global. Your account data and the metadata in section 3 may be processed outside your country, including in Singapore and other regions where we or our processors operate. Where a privacy law requires transfer safeguards (such as standard contractual clauses), we will use them with processors. Choosing a VPN node in another country necessarily sends your tunneled traffic through that country. 13. Security Passwords are stored as hashes. Access to the control plane is limited to operators. No system is perfect. Use a unique password and keep official clients updated. Report suspected incidents to [email protected]. 14. Legal requests We may disclose account or operational records if required by a binding legal process that applies to us. Because we do not keep a destination browsing archive, we typically cannot produce a list of “sites visited.” We will not invent records we do not have. 15. Changes Material changes raise the document version (the version field in GET /api/public/privacy). Official clients that store privacy_version will ask for consent again. The dated page at https://www.tinystone.us/privacy is the source of truth. Clients must fetch these URLs and must not ship a baked-in copy. 16. Contact Privacy: [email protected] Support / tickets: https://www.tinystone.us/#/support or [email protected] Postal / registered address: to be published with the legal entity. If language versions conflict, the English text controls, except where a local law requires otherwise.