VPN Privacy Policy Checklist: 15 Questions

A privacy policy is the one document where a VPN company has to say, in writing, what it does with your information. Most people never open it, and those who do often give up after the first screen of legal phrases. That is understandable, but it leaves the most important evidence unread. A VPN sits between you and the internet, so what the company stores about you is the heart of the product.

This article gives you a repeatable method: fifteen plain questions, in five groups of three, that you can put to any VPN privacy policy in about fifteen minutes. For each question you will see what a clear answer sounds like and what a weak one sounds like. You do not need legal training. You need patience, a pen and a willingness to mark an answer as missing when it is missing. If you want the wider background on what a provider can observe in the first place, start with what a VPN provider can see.

How to use the checklist

Open the privacy policy in one window and a note in another. For each question, record one of three marks.

• Clear. The policy gives a specific, readable answer. For instance, it names a data category and a time limit.
• Vague. The policy touches the topic but uses broad words such as "may", "certain data" or "as needed" without saying what or how long.
• Missing. The policy does not address the question at all.

Count your marks at the end. Clear answers earn two points, vague ones earn one, missing ones earn zero. The highest score is thirty. There is no magic pass mark, but as a rough guide, scores in the twenties suggest a company that has thought about the questions, scores in the teens suggest gaps worth asking about, and scores in single digits suggest you should look elsewhere.

Two tips before you begin. First, read the policy that applies to the app and the service, not only the one for the marketing website; some companies publish separate documents. Second, note the date. A policy that has not been updated in years may not describe today's product.

Questions 1 to 3: who is behind the policy

These questions are about accountability. A promise from an unnamed party is worth little.

1. Which company is responsible, and where is it registered? Look for a company name, a registration country and a postal address, not only a brand name. A clear answer names the legal entity that decides what happens to your data. Be wary of policies that talk about "we" without ever saying who "we" are.

2. How do I contact someone about my data? A strong policy provides a dedicated contact, such as a privacy mailbox or a form, and says how quickly it responds. Be wary when the only route is a general sales address or a social media account.

3. When was the policy last updated, and can I see earlier versions? Look for a visible date and, ideally, a short change history. Be wary of undated pages. A date lets you notice when terms have changed since you signed up.

Questions 4 to 6: what is collected when you sign up and pay

This group covers information you hand over deliberately.

4. What account data is required? Typical answers include an email address, a username and a password. Good policies say which fields are mandatory and which are optional. Be wary when a service asks for a phone number, real name or location without saying why.

5. What payment data does the company hold? The policy should say whether card details are handled by an outside payment processor, and what the company itself receives afterwards, such as a payment confirmation or the last digits of a card. Be wary if it is silent about billing, or if it says it "may store payment information" with no further detail. The payment side matters more than people expect, as explained in what to check before paying for a VPN.

6. What does the app collect from my device? Look for a list that covers device type, app version, crash reports and any identifiers. The app's store listing usually summarises this in a data disclosure section, which you can compare with the policy. Be wary of broad permissions, such as access to contacts or precise location, that a VPN does not need to do its job.

Questions 7 to 9: what is collected while you use the service

This group matters most for a VPN, because the service sits in the path of your traffic.

7. What connection data is created, and is it tied to my account? Connection data can include when you connect, how long, how much data moves and the network address you connect from. A strong policy says which of these are created, whether any are linked to your account, and for how long. Be wary of general statements such as "we respect your privacy" that avoid the specifics.

8. Does the policy address the content and destinations of my traffic? The policy should state plainly whether it records the websites you visit or the content you send. If it says it does not, look for how the claim is worded: does it cover everything or only some things? Ask whether the definition of "activity" is written out or left to the reader's imagination. Be wary of absolute slogans without definitions of what "activity" covers.

9. Are analytics tools or trackers built into the app or website? Many apps include third-party code that measures usage or serves advertising. A clear policy names the categories of tracking used and explains how to turn them off. Be wary of policies that mention "partners" without naming a purpose. This is the question where free services most often differ from paid ones, as explained in are free VPNs safe.

Questions 10 to 12: keeping and sharing

Collecting data is one thing. The more important matter is how long it stays and who else receives it.

10. How long is each kind of data kept? A good policy gives retention periods by category, for example "account data until the pass ends plus a set number of months". Be wary of "for as long as necessary" and similar wording, which sets no limit.

11. With whom is data shared, and for what purpose? Look for named categories such as payment processors, hosting providers and email delivery services, with a reason for each. Be wary of sharing with "affiliates", "partners" or "advertisers" that are not identified, and of any language that lets the company sell data.

12. How does the company handle legal requests? The policy should describe a process, such as reviewing requests for validity, challenging overbroad ones and telling affected users when allowed. Companies that publish regular reports on these requests give you extra evidence. Be wary of silence on the subject or statements that the company will "comply with all requests".

Questions 13 to 15: your control and the company's duties

The last group tests whether the policy treats you as a person with rights or only as a source of data.

13. Can I see, correct and delete my data? Look for a clear route, such as an account page or a request form, with a stated response time. Be wary when deletion is described as impossible or when the policy says data is kept indefinitely after you stop using the service.

14. How will I be told about changes? A strong policy promises notice, such as an email or a prominent message in the app, before material changes take effect. Be wary of statements that continued use of the service means automatic acceptance, with no notice at all.

15. What security measures are described, and what happens if there is a breach? Good policies mention encryption of stored data, restricted staff access and a commitment to notify affected users. Be wary when security is described only with adjectives such as "military-grade" and no practice behind them. A promise of perfect security is a red flag, because none exists.

Worked example: scoring a made-up policy excerpt

Here is a short invented excerpt from a fictional provider, "Provider B", so you can practise marking answers.

We collect the information needed to run the service. Account data is stored while your account is active. We may share data with trusted partners to improve the service. We take security seriously. Terms may change from time to time.

Marking it against the checklist gives a sobering picture.

Question	Mark	Why
1 Company identity	Missing	No company name or address given
2 Contact	Missing	No route to a privacy contact
3 Date and versions	Missing	No date visible
4 Account data	Vague	"Account data" is not defined
5 Payment data	Missing	Nothing about billing
6 Device data	Missing	Not mentioned
7 Connection data	Missing	Not mentioned
8 Traffic content	Missing	Not mentioned
9 Trackers	Missing	Not mentioned
10 Retention	Vague	"While your account is active" only covers one category
11 Sharing	Vague	"Trusted partners" with no categories
12 Legal requests	Missing	Not mentioned
13 Your rights	Missing	Not mentioned
14 Changes	Vague	"From time to time" with no notice promise
15 Security	Vague	"Seriously" with no practice described

Total: five vague answers earn five points, ten missing answers earn none, so Provider B scores five out of thirty. The policy is not necessarily dishonest, but it gives you almost nothing to rely on. A sensible reaction is to ask the company specific questions, and to look at other providers before you pay.

Wording that deserves a second look

Certain phrases appear again and again in weak policies. The table shows how to read them.

Phrase	What to ask
"We may collect"	May, or does? Which items?
"Certain information"	Which information, exactly?
"As long as necessary"	Is there any upper limit?
"Trusted partners"	Who are they, and for what purpose?
"To improve our services"	Which data, and could it be done without identifiers?
"Anonymous" or "anonymised"	How is it anonymised, and can it be re-linked?
"Industry-standard security"	Which practices, in plain words?
"We do not sell your data"	Is it shared for free with others for their own use?

None of these phrases proves bad faith. Together, with no definitions anywhere, they tell you the company has chosen flexibility over clarity.

Limits of a policy review

A privacy policy review is valuable, but it is not a full audit. Remember these limits.

• A policy is a promise, not proof. It tells you what the company says, not what its systems do.
• Policies can be technically accurate and still unhelpful. A document can be honest and still leave the questions that matter unanswered.
• Laws shape what a company must say. Some regions require certain disclosures, which means two policies can look similar without equal protection behind them. This is general information, not legal advice.
• The policy covers the company, not the rest of your digital life. Your internet provider, your websites and your apps each have their own rules. See how to compare VPN providers for how this fits into a full evaluation.
• Documents change. Check again when you renew or buy more time.

If you find a gap, write to the company. A clear, prompt reply is good evidence; silence or a copy of the same slogan is also evidence.

Summary

A VPN privacy policy is best read as fifteen questions in five groups: who is responsible, what you give at sign-up and payment, what is collected while you use the service, how long data is kept and who gets it, and what control you have. Mark each answer clear, vague or missing, score the result and treat gaps as things to ask about rather than reasons to assume the worst. A policy is a promise, not proof, and it works best alongside app permissions, store disclosures and the company's conduct over time.

If a simple prepaid option fits what you need, the pricing page shows the available passes whenever you want to look.