When choosing a no-logs VPN, what matters isn’t whether the homepage says “no logs,” but whether the privacy policy explains what data is collected, how long it’s kept, and why. Choose a service with clear limits and verifiable evidence, then minimize what you share and check your client settings to reduce exposure. Encryption helps, but it doesn’t replace these checks.
No-logs claims: break down the data categories first
“Doesn’t log browsing activity” and “doesn’t retain connection logs” aren’t the same thing. The first may refer only to webpage content; the second concerns metadata such as your IP address, connection times, and selected routes. Even if HTTPS hides webpage content, connection metadata may still show when an account used the service. The claims are comparable only when the data categories are clearly defined.
Review account details, orders, and data allowances separately, too. A service may need to process billing information without necessarily tracking browsing history. Conversely, a claim that browsing history isn’t logged says nothing about how orders or diagnostic logs are retained. Check that the privacy policy, terms of service, and client diagnostic documentation are consistent; don’t rely on a single sentence taken out of context.
| Data category | What to ask | Wording to watch for |
|---|---|---|
| Browsing and DNS query logs | Are visited domains, destination addresses, DNS queries, or request contents retained? | Says it doesn’t log “content” but doesn’t explain whether it records domains or queries |
| Connection metadata | Are source IP addresses, timestamps, or route selections retained, and can they be linked to an account? | Uses “necessary data” to describe all connection information |
| Accounts and billing | How usernames, orders, and traffic statistics are used, how long they’re kept, and how they’re deleted | Treats account deletion as if it also deletes all payment records |
| Diagnostics and support materials | Are they uploaded automatically? Can uploads be disabled? Who can access them, and when are they deleted? | Doesn’t distinguish crash reports from logs submitted manually |
Retention can be defined by a specific period or a clear trigger, such as deletion after troubleshooting is complete. What matters is whether the conditions are specific, whether exceptions apply, and how information that must be retained by law is handled. If anything is unclear, ask support and keep the response. Treat anything not clearly explained as unknown—not as proof that nothing is logged.
Verifyclaims: evidence matters more than badges
If a service provides an independent audit, review the original report or a verifiable summary and confirm what was audited, when, and what the findings were. A review of client code, server configuration, and privacy processes covers different things. Passing a client audit doesn’t prove that every server and account system handles data the same way.
An audit is evidence limited to a particular scope and point in time, not a guarantee for the future. Open-source clients can help you inspect the implementation, but they can’t show what the servers actually retain. Transparency reports can clarify how requests are handled, but they don’t replace day-to-day data policies. If no materials are public, the evidence is limited; don’t fill in the gaps by assuming promises the service hasn’t made.
Protocol names don’t establish privacy practices, either. Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC use different proxy or transport implementations; actual protection depends on the specific configuration and implementation. Their names alone can’t prove that an operator keeps no logs. Nor do route descriptions such as IEPL, relay, or direct connection provide evidence of a logging policy.
Accounts and payments: put data minimization into practice
Data minimization means providing only what’s needed to use the service—not entering false identity details. Before creating an account, check which fields are required, why they’re collected, and how account recovery works. VPNBody doesn’t require an email address; you can create an account with a username and password. That means sharing less email information, but it also makes safeguarding your login credentials especially important.
Avoid reusing a public social media handle as your username, and don’t reuse passwords from other sites. Store your credentials in a password manager and check which account recovery options are available. When contacting support, start by describing the issue and the checks you’ve already tried. Don’t send your full configuration or a large set of system screenshots right away.
- ✅ Check which fields are required before creating an account, and provide only what’s necessary.
- ✅ Use a unique password for the service and save your available account recovery information.
- ✅ Before submitting a support ticket, redact account credentials, subscription links, and sensitive payment details.
- ❌ Don’t assume that your payment method, encrypted connection, or an account that needs no email address makes you impossible to identify or link to.
VPNBody supports Alipay, WeChat Pay, and USDT. Payment providers may retain transaction records, and the service may need order details to reconcile payments and process refunds. USDT transfers are publicly traceable on-chain; using digital assets doesn’t make a payment anonymous. When choosing a payment method, consider what records are kept, how transfers are matched to orders, and how after-sales support works.
A subscription link is a sensitive credential, too. It usually contains a token that grants access to route configuration, so anyone with the link may be able to view or use the subscription. Import it locally in a trusted client; don’t paste it into an unfamiliar online conversion tool. If the link has been exposed, ask the service provider whether it can be reset or revoked. Deleting a post won’t erase copies others have already made.
Public Wi-Fi: Check the Network Before Connecting
At an airport or café, ask the venue to confirm the network name instead of connecting based on a similar-looking name. If a captive portal is required, pause background syncing, complete only the necessary sign-in steps, and then start your client. If the portal asks you to install a root certificate, configuration profile, or unfamiliar software, stop and check with the venue rather than treating it as a normal step.
Being on public Wi-Fi doesn’t mean bystanders can directly read HTTPS content. Properly validated HTTPS encrypts traffic between your browser and the website. A VPN or proxy mainly changes what’s visible along parts of the network path and which network acts as the exit point. It can’t fix phishing pages or malware on your device, nor prevent a site you’re signed in to from identifying your account.
If your browser shows a certificate warning, don’t bypass it just to sign in. Check the domain and your device’s clock, and switch to a trusted network if needed. After connecting, confirm that the app you’re using actually follows the intended route. A system proxy may cover only apps that honor its settings; that doesn’t mean all traffic from your device is routed through it.
DNS and split tunneling: check the actual traffic path
DNS queries resolve domain names to addresses. If an app’s traffic goes through a proxy but its DNS queries still take an unexpected local route, the domains you look up may be exposed. Browser Secure DNS, the system resolver, the client’s DNS mode, and split-tunneling rules can all affect the result, so a “connected” icon isn’t enough to tell you what’s happening.
On Windows and macOS, system proxy settings and full-tunnel modes work differently. Android and iOS clients typically use the network extension capabilities provided by the operating system, but coverage still depends on the app and its rules. On Linux, check whether desktop proxy settings, environment variables, and system resolver services agree. Don’t assume that importing the same subscription means every platform will behave identically.
- Note your current settings. Check the client mode, DNS options, split-tunneling policy, and any excluded apps. Don’t run multiple proxy tools at the same time while testing.
- Check the app you’re testing. Open the site you want to access and use the client’s rule-matching logs to check the route. You can use an IP lookup tool to check your browser’s exit IP, but the result applies only to that browser request.
- Check DNS resolution. Use a trusted DNS test site to see whether the resolver matches your expectations. An unfamiliar organization name doesn’t necessarily mean there’s a leak; check it against your client settings rather than relying on the location label alone.
- Check what happens when the connection drops. Find out whether the client offers a kill switch and which modes it applies to. Disconnect deliberately when you aren’t transmitting sensitive information, then see whether the app switches to a direct connection. Don’t rely on a setting’s name alone.
Split tunneling often sends some traffic directly, which may be exactly what the rules are designed to do. That isn’t automatically a leak; check whether the actual behavior matches your expectations. Include IPv6 in your checks, too. If something looks wrong, review the client and system settings instead of treating permanently disabling a system feature as a universal fix.
Choosing a Plan: Separate Privacy Evidence from Plan Details
When comparing services, first decide whether their privacy boundaries are acceptable, then consider routes, devices, and payment options. VPNBody offers 110+ countries, 220+ routes, and unlimited devices. These describe the service’s coverage, not the findings of a privacy audit. Having more routes doesn’t prove they’ll all perform the same way on your current network.
Monthly plan data resets each month on the activation date. Data add-ons remain available until used and never expire. Choose based on how you actually use the service, not as a measure of privacy. The full refund policy is: you can request a no-questions-asked full refund within 7 days of your first payment. Before getting started, review the plan details and check the getting started guide for client setup.
Bottom line: A credible no-logs claim should explain data types, purposes, retention periods, and exceptions, and provide evidence whose scope can be checked. Not requiring an email address means sharing less information, but it doesn’t replace a logging policy. Staying safer on public Wi-Fi also depends on using a trusted network, validating certificates, checking split-tunneling rules, and testing what happens if the connection drops.