What we don't log
Once your device has its configuration, the app connects straight to the network's servers — our systems take no part in the connection. So we don't receive or keep:
- the sites, apps and services you use;
- the content of what you send and receive;
- your DNS queries;
- the IP address you connect to the VPN from, or your connection and disconnection times;
- how much data you use.
And who runs the servers?
Servers in Brazil. The Brazil and Brazil + Global plans use servers in Brazil, operated by a Brazilian internet provider we contract. They are configured not to record what you do on the VPN: they don't keep the sites you visit, your DNS queries or your traffic, and they keep no record of connections on disk. While you are connected, the server needs to know, in memory, the address your device connects from — that's how the VPN sends replies back to you —; that information disappears when the connection ends and is not stored.
To keep the network running, each server sends us, every minute, only aggregate numbers: how many devices are connected, the total traffic volume and the machine's load (processor, memory, disk). None of it identifies you or a device. We keep that history for 15 days.
For each device, the server receives only the connection's public key and an internal VPN address — without your name or email.
Servers in other countries. The Global and Brazil + Global plans use these servers. Older and complimentary plans, which work on both networks, can use them too. They are operated by a specialized network infrastructure partner we contract, in data centers across dozens of countries.
For each device we create a technical account on the network, identified by a random code — without your name or email.
Under its contract with us, this partner is bound not to log anything about your VPN activity: not your traffic or the sites you visit, not connection data (your real IP address, connection and disconnection times, session length or data volume), and not your DNS queries — and not to write any of this to disk, even temporarily.
The DNS resolution service is not the network partner and has no data processing agreement with us: it receives the queries coming from the VPN server and handles them under its own privacy terms.
Taken together, neither network keeps a record of what you do on the VPN; DNS queries go to the DNS resolution service, as explained above. What we do keep is listed in “What we keep”. API technical logs (up to 7 days) show when the app talked to our API — not when you were connected to the VPN or what you accessed.
What we keep, why and for how long
| Data | Why | How long |
|---|---|---|
| Email, name (if you provide it) and language | Create and maintain your account, send your sign-in code and subscription notices | While the account exists |
| Sign-in code and the IP address that requested it | Protect sign-in against repeated attempts. The code is stored only as a one-way hash | 30 days |
| Sessions: device type and start, last-use and expiry dates | Keep you signed in | Up to 30 days after the session ends (each session lasts at most 90 days) |
| Devices: the name you give them, the operating system, dates and the VPN technical credential, stored encrypted; for a router, also the connection key, stored encrypted, so you can download the file again | Deliver the VPN configuration to each device | While the device is on the account. Once removed, its network account is deleted immediately and the record is erased after 12 months |
| Subscription: plan, where it was bought, the purchase ID at the store or payment provider, start and end | Know whether you can connect; charge, renew and refund | While the subscription exists and up to 5 years afterwards, for tax obligations and to handle any dispute |
| Crypto payment: the currency and network you chose, the payment address generated for the order, the requested and received amounts, and SafixPay's payment notice, which may include the transaction identifier on the blockchain. A blockchain transaction is public by nature: anyone who knows the address can see the amount and the date | Confirm the payment, grant access and process refunds | The purchase record follows the subscription's retention period |
| Partner coupon used in the purchase and the partner who referred you | Apply the coupon discount and calculate the partner's commission; the partner only sees numbers (sales and amounts), never your name or email | The link to the partner lasts 12 months from the payment; the purchase record follows the subscription retention period |
| Partner activation code: a fingerprint of the code (not the code itself), a reference that doesn't identify the contract to us, the activation date and whether access is active or suspended | Give, stop and restore the access the partner pays for, and count in totals how many accesses they pay for. The partner does not receive your email or any data about your account | While the account exists. If you delete the account, the code is unlinked from it and can be used by another account under the same contract |
| Partners (influencers and resellers): name, email, CPF or CNPJ, PIX key or USDT wallet | Register the partner, create the coupons and pay the commission | While the partnership lasts and up to 5 years after, for tax purposes |
| Dedicated IP (only if you buy it): the address, the device using it, the start and end of each use, the ports you opened and the abuse complaints received about it | Provide the dedicated IP, open the ports you asked for, and answer abuse complaints and requests from authorities about that address | While the IP is yours and up to 1 year after each device change or the end of the contract |
| API technical logs: IP address, time and the endpoint called | Security and troubleshooting | Up to 7 days, deleted automatically by Cloudflare |
| Access logs for our systems: date and time, IP address and source port, and the account when identified | Meet the legal obligation to keep access logs (Brazil's Marco Civil da Internet, art. 15) and protect the account. Applies to access from Brazil and to Brazil accounts | 6 months, unless a legal preservation obligation applies |
| Messages you send us | Reply and keep a support record | Up to 2 years after the last message |
| Country and state where you live: they come from the billing address you give when paying with an international card. A purchase in reais counts as Brazil, with no state | Applying the rules of the place where you live, such as the timing of renewal notices | While the account exists; in the purchase record, it follows the subscription period |
| Proof: the version of the documents you accepted, when and how; the notices we sent and when each one takes effect | Showing what was agreed and announced, as some US state laws ask | While the account exists and up to 5 years after deletion, with a copy of your email |
| Refusals and holds because of location: date, step, country and region, where the information came from (IP, billing address or card) and the account. For a held payment, also the amount, the purchase identifiers and a copy of your email. The IP address is not kept in this record | Complying with sanctions and export laws, including reporting to authorities when the law requires | 10 years, including after the account is deleted. Access allowed through the Tor network, with no identified country or from an IP of our own server: 1 year |
A device's “last use”, mentioned above, is the last time the app requested its configuration from your account — not the last VPN connection.
How the deadlines are enforced
- An automatic routine runs every day and deletes sign-in codes, ended sessions, removed devices, access logs older than 6 months and records of subscriptions that ended more than 5 years ago — through expiry, cancellation, refund or account deletion — when each deadline passes. Only a legal preservation request suspends that deletion, and only within its scope.
- In the same daily routine, messages older than 2 years are deleted along with their attachments.
- The servers in Brazil follow the configuration described in the policy; the commitment of the partner in other countries is contractual. We haven't published an independent audit yet.
Requests from authorities
We check the authenticity, authority, legal basis and scope of every request, and disclose only available data covered by a legally applicable order or request — at most, what is listed in the table above. Specific data may be preserved beyond the usual retention periods when a legal obligation applies; preserving is not disclosing. Where legally permitted, we tell you before disclosing; if a temporary restriction applies, we reassess notice once it ends. We publish how many requests we receive in our transparency report.
What this doesn't mean
- A VPN doesn't make anyone anonymous: wherever you sign in, the service still knows who you are.
- The sites and apps you use still log whatever they log themselves.
- Anyone who buys a dedicated IP has that address tied to their account and device, for 1 year after each use, as the privacy policy says (“Dedicated IP” section).
Questions
Does FortiSafe keep the sites I visit?
No. VPN traffic doesn't go through our account and payment systems: it goes straight to the VPN server. The servers in Brazil are configured not to record sites, DNS queries or connection data, and the partner that runs the ones in other countries is contractually bound not to log them. DNS queries are answered by an external DNS resolution service, which receives them through the VPN server, without your real IP address or account data, and handles them under its own privacy terms.
What does FortiSafe keep about me?
Your account email, devices, subscription, sessions and sign-in codes for a short time, access logs for our systems for 6 months, and the messages you send us — each with the deadline shown in the table on this page.
Does FortiSafe hand data to authorities?
Only in response to a legally applicable order or request, after checking authenticity, authority and scope, and only what exists: at most, the data in the table on this page. Preserving data at an authority's request is not disclosing it. Requests received are listed in the transparency report.