Free No-Logs VPN: Can the Claims Be Trusted?

"We keep nothing about you" is the most popular sentence in free VPN marketing, and also one of the hardest to check. The phrase sounds like a guarantee. In practice it is a claim, written by the company that benefits from you believing it, about records that live on servers you cannot see.

This article is about that gap between a promise and proof. We will look at why a free service has a harder time earning belief than a paid one, what kinds of records exist, which kinds of evidence deserve weight, how to cross-check a claim against the rest of the app, and what to do if you decide to use a free tool anyway. For the general skill of reading a logging policy and understanding audits, the related guide listed at the end of this page goes through the vocabulary. Here the focus is narrower: whether a claim from a free service deserves your trust.

A claim is not evidence

Start by separating three things that are often blurred.

• A claim is a statement made by the provider: "we do not keep records of your activity".
• A policy is the longer document that says what is collected, why and for how long.
• Evidence is something outside the provider's own control that supports or contradicts the claim.

Free VPN marketing is almost always stuck at the first step. The home page says the claim in large letters; the policy, if you find it, repeats it in softer words; and no evidence appears at all. That does not mean the claim is false. It means you are being asked to take it on faith.

A useful habit is to rewrite every claim as a question. "We keep nothing about your activity" becomes "Who has checked, when, and what exactly did they look at?" If the page cannot answer, the claim is still only a claim.

Why free makes the claim harder to believe

Running a VPN costs money. Servers, bandwidth, engineers, support and legal work all have a price, and the price grows with every extra user. When customers pay, the money covers those costs, and the incentives point reasonably well toward keeping the customer happy. When customers pay nothing, someone else must cover the bill.

Source of income	What it needs from you	How it clashes with a logging claim
Paid upgrades from a few users	Nothing about your activity	Little conflict, but free users get less attention
Advertising inside the app	Identifiers, device details, sometimes usage patterns	Ad systems usually collect data to target ads
Selling or sharing analytics	Records of what users do	Directly opposed to the claim
A parent company with another product	Possibly cross-product data	Depends on what the privacy terms allow
Venture funding or a hobby budget	Nothing, for now	Funding runs out, and the model may change

This table does not accuse any specific service. It shows that the question "how does this app pay for itself?" is not rude. It is the most direct way to test whether the claim fits the rest of the business. Our article on whether free VPNs are safe looks at the same issue from the safety side.

A free service can still behave well. A company may offer a limited free tier to attract customers who later pay, and may have no need for your data. The point is only that the claim needs more support, not less, when the usual source of income is missing.

What kinds of records exist

The word "logs" hides several different things. Knowing the categories lets you ask precise questions.

1. Connection records. Timestamps of when you connected and disconnected, the address you came from, the server you used, and how much data passed.
2. Activity records. Which sites, apps or services you contacted through the tunnel.
3. Diagnostic records. Error reports and crash data sent from the app to help developers fix problems.
4. Analytics records. Usage events collected by the app or by third-party software inside it, such as screens viewed or buttons tapped.
5. Account and payment records. Email, sign-up details and billing information, if any.

A provider might sincerely say that it keeps no activity records while collecting connection and analytics records, and the statement would still be technically accurate. That is why the exact scope of the claim matters. Ask which of the five categories it covers, and how long the others are retained. The guide on what a VPN provider can see explains what is technically visible at each step.

The evidence ladder

Not all evidence weighs the same. Here is a rough ranking from weakest to strongest. It is a guide to judgement, not a score.

Evidence	Strength	Why
A statement on the home page	Very weak	Written by the party with the incentive
A privacy policy that matches the statement	Weak	Still the provider's own words
An app store privacy label consistent with the policy	Weak to moderate	Self-reported, but conflicts are visible
A named company, address and history	Moderate	Gives you someone accountable
A recent independent audit with a published scope	Moderate to strong	Third party, but check the date, scope and what was audited
Open-source client code	Moderate to strong	Anyone can inspect the app, though not the servers
Documented cases where the provider could not hand over data	Strong	Real-world test, though rare and case-specific

Notice what is missing from the free side. Most free services appear in the first two rows only. Some reach the middle rows. Very few can show the strongest evidence, which tends to be costly to produce. If a free provider does point to an audit, read its date and scope. An audit of one part of a business, years ago, says little about today's app.

Cross-checking the claim against the rest of the app

The best test you can run without special tools is a consistency check. A genuine claim fits the rest of the app; a hollow one often does not.

Check the store listing. On the app store page, read the privacy section. In Apple's system, developers must declare which data types the app collects and whether they are linked to you or used for tracking. If the marketing says the service keeps nothing but the label lists identifiers, usage data or contact info, that is a mismatch worth noting.

Check the permissions. A VPN needs permission to create a VPN connection. It does not need your contacts, your photos, your precise location or your microphone. Extra permissions are a red flag.

Check the ads. If the app shows adverts, it contains ad software. Ad software usually communicates with outside services. Ask whether the policy mentions those services and what they receive.

Check the company. Is there a legal name, a street address and a way to contact someone? Look for the same details on the website, in the policy and in the store listing. If they disagree or are missing, treat the claim with extra caution.

Check the age and updates. Is the app maintained? Are there recent updates? Abandoned apps are a risk even when the original intent was good.

Check your own browser. Visit a tool such as EFF's Cover Your Tracks before and after connecting. It does not test logging, but it shows what your browser reveals regardless of the VPN, which is a useful reminder that a logging claim covers only the provider's side.

A short worked example helps. Imagine a free app whose home page says "your activity is never recorded". The store label lists "usage data" and "identifiers" as collected and used for third-party advertising. The privacy policy mentions "trusted partners". The company name is a single word with no address. None of these items proves wrongdoing, but together they contradict the headline, and a careful person would walk away.

A twenty-minute due diligence routine

Run this before you enter any account details. Set a timer so that you actually finish.

1. Minutes 0 to 3. Find the company name, address and contact on the website. Write them down.
2. Minutes 3 to 8. Read the privacy policy for four items: what is collected, for how long, who it is shared with and how deletion works.
3. Minutes 8 to 11. Open the store listing. Compare the privacy label to the policy and note any differences.
4. Minutes 11 to 14. Look for independent evidence: an audit, open-source code or a transparency report. Note dates and scope.
5. Minutes 14 to 17. Search for the company name together with words like "complaint", "investigation" or "data". Read a few sources, not just the first.
6. Minutes 17 to 20. Decide. If you cannot name how the service pays for itself, and nothing independent supports its claim, treat it as untrusted.

Write the verdict and the date. If the policy changes later, you will know what you agreed to. Our guide on comparing VPN providers offers a fuller scorecard.

Three people, three decisions

A student on campus Wi-Fi. Ploy wants a free VPN to read news between classes. She runs the routine and finds a store label that matches the policy, an identifiable company and no ads. The only evidence is the policy itself. She decides it is acceptable for low-risk reading, and does not use it for her university login or banking.

A traveller at an airport. Marcus needs a VPN for ten minutes to check email. The only free option he can find has a vague policy, ad pop-ups and a request for contact access. He skips it, uses mobile data for his email and keeps his laptop off public Wi-Fi.

A remote worker on a tight budget. Lin handles client files. A free tool would be convenient, but she cannot verify any claim about it. She treats a free VPN as unsuitable for work and chooses a paid option with clear terms. Our guide to free versus paid VPNs helped her frame the decision.

If you still use a free VPN

Sometimes a free tool is the only thing available. Reduce the downside with a few habits.

• Limit what you do through it. Use it for ordinary reading, not for banking, work or private messages.
• Keep sensitive logins elsewhere. Mobile data or a trusted network is safer for those.
• Use a separate email for the account, and do not reuse any password.
• Review permissions and remove any that are not needed.
• Uninstall when finished. Do not leave an unused VPN app on your device.
• Do not treat it as anonymity. Accounts, cookies and apps identify you regardless of the VPN.

Common mistakes

• Treating a home page sentence as a fact.
• Assuming "no activity records" also means no connection or analytics records.
• Trusting an audit without checking its date and scope.
• Ignoring that the app shows ads.
• Believing a popular app must be honest.
• Using a free tool for the sensitive tasks that matter most.

Summary

A logging claim from a free VPN is a statement, not a proof. Free services have a harder time earning trust because someone has to pay for the servers, and the usual alternatives to your money often involve data. Judge the claim by the evidence outside the provider's control: an identifiable company, a recent audit with a clear scope, open-source code and consistency between the policy, the store label and the app's behaviour. If you cannot verify, limit what you do with the tool.

If you would rather deal with a clearly bounded paid arrangement, the pricing page explains how a prepaid pass works, with no automatic renewal.