Back to the blog

Privacy — 2017/01/13

Clarifying our no-logging data policy

On our homepage, we state that "we do not store activity logs of any kind." Despite this, we receive a lot of questions about what we mean by "activity logs" and the storage of information in general. We are here with a clarification.

no logsWe want you to remain anonymous

When you sign up for Mullvad, we do not ask for any personal information – no username, no password, no email address. Instead, a random account number is generated, a so-called numbered account. This number is the only identifier a person needs in order to use a Mullvad account. This is a fundamental difference that sets us apart from most other services. 

Anyone at anytime can create as many numbered accounts as they wish on our website. An account can be used by multiple people or by someone other than the person who initially generated it.

A Mullvad account has two properties: the account number and the time remaining on that account. When an account is created, it comes loaded with three hours to try Mullvad for free. At once the countdown starts. After those three hours have passed, the account has no time left. Using it to connect to Mullvad is no longer possible unless it is loaded with more time.

Question: How many numbered accounts does Mullvad have?
Answer: At the time of writing this post, Mullvad has 555,541 numbered accounts. These accounts could have been created by 555,541 unique people, or by one person 555,541 times.

This is the data we store for an account¹:

account number | expiry date
xxxxxxxxxxx    | 20170730


How Mullvad handles payment information

Let's take a transparent look at the information we do store in order to handle payments.

You can pay money to the numbered account and therefore acquire more VPN time. Mullvad accepts Bitcoin, cash, bank wire, Swish and credit card (via PayPal). Here's how we handle each type of payment.

Cash

Put the money in an envelope together with the account number in question and send it to us. We will open the envelope, add time to the account (corresponding to the amount of cash sent), and then use a shredder to destroy the envelope and its non-money contents. We have no way of knowing who made the payment and who the account belongs to. Even if a person were to address the envelope, there is still no way to prove that he or she generated the account or is even using it.

This is what we store when a cash payment comes in¹:

payment    | account number | amount | currency | timestamp
xxxxxx     | xxxxxxxxxxxx   | 5.0    | USD      | 2016-12-09 10:38:23.027076


Bitcoin

This is digital cash, so the process is the same as with physical cash but without humans or any third parties involved. We run our own full node in the blockchain and we verify incoming payments ourselves. Again, we don't use third parties for any step in the bitcoin payment process, from the generation of QR codes to adding time to accounts.

We store these payment details for bitcoin¹:

payment    | account number | amount  | currency | timestamp                  | bitcoin address 
xxxxxxx    | xxxxxxxxxxxx   | 0.00564 | BTC      | 2016-12-10 06:36:12.712836 | xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx


Credit card (via PayPal), Swish, and bank wire

For PayPal, Swish, and bank wire, we do use third parties: PayPal and our bank SEB (which handles both Swish and bank wire). These kinds of companies log everything. For that reason alone, it is out of our control that they have records showing which people have paid us money. They store this data for many years. As a customer of their services, both PayPal and our bank would allow us to request this information if we chose to do so. In short, your payment actions with these two methods are not anonymous, and there is nothing we can do about it.

Here's the information we store for Swish and bank wires¹:

payment    | account number | amount | currency | timestamp
xxxxxx     | xxxxxxxxxxxx   | 30     | EUR      | 2016-12-09 00:01:06.105574


Here's the information we store for credit card (PayPal) transactions¹:

payment    | account number | amount | currency | timestamp                  | transaction_id    | e-mail
xxxxxx     | xxxxxxx        | 15     | EUR      | 2016-12-10 06:40:00.471746 | xxxxxxxxxxxxxxxxx | name@emailacct.com 


Question: Why do you store transaction_id and e-mail?
Answer: Since we support 30-day refunds and because we encounter certain transaction issues from PayPal (for example, double payments and subscription problems), we need to be able to track payments in order to give customers the service we offer. We only duplicate the information since PayPal already has it.

It's important to note that PayPal does not have your Mullvad account number since we encrypt it. If, however, you send a bank wire or Swish payment, the bank will have the account number in its "message" field of the transaction.

What we don't log

We log nothing whatsoever that can be connected to a numbered account's activity:

  • no logging of traffic
  • no logging of DNS requests
  • no logging of connections, including when one is made, when it disconnects, for how long, or any kind of timestamp
  • no logging of IP addresses
  • no logging of user bandwidth
  • no logging of account activity except total simultaneous connections (explained below) and the payment information detailed in this post.

Our OpenVPN server log configuration:

verb 0
log-append /dev/null


Data that we do handle

Our VPN servers send three types of data to our monitoring system:

  • total number of current connections
  • CPU load per core
  • total bandwidth used per server.

We log the total sum of each of these statistics in order to monitor the health of each individual VPN server. We ensure that the system isn't overloaded, and we monitor the servers for potential attacks, bugs, and network issues.

We also monitor the real-time state of total connections per account as we only allow for three connections simultaneously. As we do not save this information, we cannot, for example, tell you how many connections your account had five minutes ago.

With regard to our web servers, we handle certain types of information in the following ways:

  • We store normal Apache logs for up to 24 hours.
  • Information older than 24 hours is deleted and only aggregated information about number of hits and number of visitors to our website is saved.
  • We refrain from sending usage statistics to external parties such as Google Analytics.
  • Our website uses three cookies [updated 2017 March 28:th]
    • sessionid (one hour) -  Keeps the users logged in to their account
    • django_language (until browser is closed) -  Keeps track of the users selected language
    • csrftoken (one year) - Protects against Cross-site request forgery. I.e. prevents other sites from tricking a user into submitting a POST request to us, constructed by the malicious site.

In summary

We strongly believe in having a minimal data retention policy. We hope this post has answered all of your questions.

Notes

¹The table's format and header names have been simplified for the purpose of making the principles mentioned in this post easy to understand.