Privacy Policy

We do not log your activity. We do not record the sites you visit, the services you stream, the DNS names you look up, or the contents of your traffic. There is no record anywhere in our systems of where you went while connected.

We do keep a limited amount of connection metadata — when a session started and ended, which server it used, how many bytes moved, and the IP address your device connected from. We keep it because your plan limits how many devices can be connected at once, and enforcing that limit requires knowing which sessions are open. We are telling you this rather than claiming a blanket “zero logs” policy that our systems would not support.

“StreamShield VPN”, “we”, and “us” means the operator of the StreamShield VPN service and the streamshieldvpn.net website and applications. “You” means anyone who uses the service, visits the site, or holds an account.

Questions about this policy, or about the data we hold on you, go to [email protected].

We do not record, and therefore cannot disclose to anyone:

• The websites, servers, or services you connect to through the VPN.
• Your browsing, streaming, or download history.
• The contents of your traffic, messages, or files.
• DNS lookups made while you are connected.
• The IP addresses you were assigned inside the tunnel, mapped to the destinations you visited.

We do not sell personal information, and we do not share it with advertisers or data brokers.

When you connect, our servers instruct your device to use public DNS resolvers operated by Cloudflare (1.1.1.1) and Google (8.8.8.8). We do not run our own resolver and we do not log your queries — but this does mean your DNS lookups are answered by those third parties, subject to their own privacy policies, rather than by StreamShield.

You can override the DNS servers your device uses if you would prefer a different resolver.

We use the data described above only to:

• Provide the service, issue configurations, and authenticate your devices.
• Enforce the simultaneous-connection limit attached to your plan.
• Take payment, issue receipts, process refunds, and prevent payment fraud.
• Answer your support requests.
• Investigate abuse of the network — such as attacks launched through it — and enforce our Acceptable Use Policy.
• Keep the network secure, available, and adequately provisioned.
• Meet legal and accounting obligations.

Where the GDPR or similar law applies, our legal bases are: performance of our contract with you (providing and billing for the service), our legitimate interests (network security, abuse prevention, and capacity planning), your consent (optional marketing email, where offered), and compliance with legal obligations (tax and accounting records).

We share personal data only with the parties needed to run the service:

• Payment processors, to take payment and process refunds and disputes.
• Our email delivery provider, to send account notices, verification links, receipts, and configuration files you request.
• Infrastructure and hosting providers, which host the platform, the VPN servers, and encrypted off-site database backups.
• Your reseller, if your account was sold through one. A reseller can see and administer the accounts they created, including plan status and session activity for those accounts.
• Google Analytics, which receives visit data from our public pages only — never from the signed-in panel. See section 14.
• Law enforcement or other authorities, where we are legally compelled — see below.

We may also transfer data as part of a merger, acquisition, or sale of assets, in which case we will say so before your data becomes subject to a different policy.

We respond to valid legal process. We can only produce data that exists, and what exists is described in Section 3. We cannot produce browsing history, DNS records, traffic contents, or a record of what any user did while connected, because we do not have them.

Where we are legally permitted to do so, we will decline overbroad requests and will seek to notify affected account holders.

• Account data is kept for as long as the account exists.
• Connection metadata and device records are kept for the life of the account and are deleted together with it. Deleting an account removes its session history.
• Support tickets, including their messages and attachments, are kept while the account exists and are deleted together with it.
• Order and payment records are kept after account deletion for as long as accounting, tax, and chargeback rules require — normally several years — with the account link removed.
• Revoked certificate records outlive the account. The serial number of every revoked certificate stays on our revocation list — that is what stops an old configuration file from working — and the certificate name contains the account username.
• Administrative audit logs are kept as a security record, so that changes to accounts and billing remain attributable. The acting account is unlinked when a user is deleted, but an entry may still name the account it concerned.
• Encrypted database backups are retained on a rolling schedule — daily backups for 14 days and monthly backups for 12 months — so deleted data can persist in backups until those expire.

You can ask us to delete your account at any time, and we will actually delete it. We do not satisfy a deletion request by suspending the account, disabling sign-in, or marking it inactive — the account record itself is removed.

• Traffic between you and our servers is encrypted by the VPN tunnel itself.
• Passwords are stored only as salted hashes, never in a recoverable form.
• Session, refresh, and email-verification tokens are stored as hashes, so a database disclosure does not hand over usable tokens.
• Certificate private keys are encrypted at rest with authenticated encryption.
• Database backups are encrypted and stored off-site.
• Administrative access is role-based, and privileged actions are recorded in the audit log.

No system is perfectly secure. If a breach affects your personal data, we will notify you and any required regulator within the timeframes the law sets.

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, receive a portable copy, object to or restrict certain processing, and withdraw consent you previously gave.

To exercise any of these, email [email protected] from the address on your account, or open a support ticket from within your account. We will respond within the period required by applicable law, normally 30 days. We may need to verify your identity first, and we may keep records we are legally required to retain, such as payment history.

For deletion specifically there is a dedicated form at streamshieldvpn.net/data-deletion, which works even if you can no longer sign in. What it removes and what we keep is set out in section 9.

If your account was sold to you by a reseller, ask them as well — they hold their own customer records that we do not control.

California residents: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we will not discriminate against you for exercising your rights.

EEA and UK residents: you also have the right to lodge a complaint with your local data protection authority.

Our servers and service providers are located in a number of countries, and using a VPN necessarily means routing your connection through a server in the location you choose. Your data may therefore be processed outside the country you live in, including in countries whose data protection laws differ from your own. Where required, we rely on appropriate safeguards such as standard contractual clauses with our providers.

The analytics described in section 14 are processed by Google in the United States. This applies to visits to our public pages only.

The service is not directed to children and is not for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact [email protected] and we will delete it.

The management panel uses only the storage needed to keep you signed in and to remember interface preferences. No analytics or third-party script runs there at all.

Our public pages — the home page, pricing and app pages, the legal pages, and the sign-up and password screens — use Google Analytics to measure how many people visit and which pages they land on. It sets a cookie in your browser and sends Google the page address, your approximate location, and basic device and browser details.

Three limits on this, which we consider part of the policy rather than a configuration detail:

• It is never loaded once you are signed in. Nothing you do inside the panel — the pages you open, your plan, your session activity — is measured or sent to Google.
• Advertising features are switched off. Google Signals and ad personalisation are disabled in the code that loads the tag, not merely in a settings screen. This traffic does not enter Google’s advertising graph, and we do not run remarketing or retargeting.
• Links containing a security token are stripped before anything is sent. Email verification, password reset and reseller invitation links carry a single-use token in the address; the tag reports only the page, never the token.

To opt out, use your browser’s cookie controls, a tracker-blocking extension, or Google’s own browser add-on at tools.google.com/dlpage/gaoptout. Blocking it has no effect on the VPN service or on your account.

We may update this policy as the service changes. The effective date at the top always reflects the current version. If a change materially reduces your privacy — for example, if we began collecting a new category of data — we will give notice by email to account holders who have provided an address, or by a notice in the panel, before it takes effect.

• Privacy questions, data requests, and general support: [email protected]
• Network abuse reports: [email protected]
• Copyright notices: [email protected] or [email protected]