Privacy Policy

Last updated: 2026-07-25  ·  In force from that date  ·  This revision: rewritten in full — what our nodes actually do to name lookups and to traffic, the sessions list you can use to sign a device out on our side, a retention table that names who enforces each row, how long server logs now survive, and the real scope of account deletion.

This policy sets out what Yunoc ("we") collects, why, how long we keep it, who else receives it, and what you can do about it. It is written against what our systems actually do, which makes several parts of it less flattering than the usual privacy page — including things we block, things we drop, and one password we can read. Using the service means you accept this policy. It sits alongside our Terms of Service.

1. What this policy covers, and how to reach us

It covers this website, the member area, and the connection service together with the access nodes that carry it. It does not cover the payment provider's own checkout pages, or any third-party site you choose to visit while connected — those run under their own policies.

A ticket in your member area is our day-to-day channel for everything, including privacy questions. It is usually faster and it proves it is you, because you are already signed in. For privacy and data requests, or if you can no longer sign in at all — the account has been terminated, you have lost the mailbox it was registered with, or a parent or guardian is writing on someone else's behalf — write to privacy@yunoc.com.

Those two are the only channels we use. Anyone contacting you from a social account or a group chat and asking for your account details is not us.

2. What we collect

Three groups: what you hand us, what the service generates while you use it, and what a payment provider sends back.

a) What you give us

• Email address (required): it identifies the account and carries verification codes, expiry reminders and password recovery. Registration is not possible without one.
• Sign-in password (required): stored as a one-way hash. We cannot read it back and we will never ask you for it.
• Ticket messages (optional): whatever you write to support, stored against your account. Please leave out personal details the question does not need.
• A linked messaging account (optional): stored only if you start the link yourself, and you can unlink it whenever you want.

b) What the service generates

• Connection password: generated automatically at registration, separate from your sign-in password, and used only to authenticate a connection. Access to it is fenced off: the component that performs authentication reads three purpose-built, read-only database views and nothing else — it cannot see your balance, your orders or your sign-in password hash.
• Internal identifiers: a numeric account id, an internal UUID, your personal invite code, and the timestamps for when the account was created, last updated and last signed in.
• Usage counters: cumulative bytes up and down, plus a breakdown by day and by node. Byte totals and dates only.
• Device state: while you are connected, the addresses assigned to your sessions inside the tunnel are held in a short-lived memory cache so the device limit can be applied. Two derived values are written to your account record: how many devices are online, and when you were last online. The address detail is not stored in the database; the count and the timestamp are.
• Connection preferences: the connection options you switch on for yourself in the member area.
• Sign-in tokens: issued when you sign in and stored in your browser to keep you signed in. You can list and revoke them yourself — see section 9.
• Client certificates: used for one-tap connection on mobile. A certificate contains a numeric account id — no email address, no name. We also keep an issuance ledger (serial number, expiry, account id) so a certificate can be revoked if it needs to be.
• Per-account configuration distributed to nodes: so a node can apply the right speed and device limits the moment you connect, access nodes receive your account identifier and your plan parameters. Your registered email travels with it, including to nodes you have never used. Nodes never receive your sign-in password, your orders or your tickets.
• Mail delivery records: recipient address, subject and delivery result, so we can answer "I never got the code".
• Safety counters: failed sign-in, registration and password-reset attempts counted per source address in a short-lived cache; and records of abnormally high simultaneous connections on an account (the account and the connection count — never a destination).
• Technical logs: the application error log; the web server access log (source address, requested path, browser string); and the runtime logs of the access nodes, which are described in section 3 because people usually assume they do not exist.
• Referral and reward ledgers: who invited whom, and the commission and bonus entries, so settlements are correct and nothing is granted twice.

c) What a third party sends back

• Payment result: the payment provider's callback tells us the status, the amount and its own reference number.

3. What we do not collect, and the boundaries we have to state

We do not record which sites you visit, and we do not keep the content of your traffic. That is not restraint, it is absence of the machinery: metering reads the send and receive byte counters on the tunnel interface — two integers, with no destination anywhere in them.

What we will not claim is that your traffic is never examined at all. To enforce the limits in section 10, our nodes run automatic checks on traffic passing through. Those checks apply to every account alike, and produce a decision — forward or drop — rather than a record of where you went. We do not describe how they work. Section 13 explains what all of this means when someone asks us for records.

• No profiling, no tracking code. Our pages load no third-party scripts, fonts or images.
• Your sign-in address is not written to your account record. We store the time of your last sign-in, not the place.
• Ordinary user activity does not enter the admin audit trail. That trail records administrator actions.
• Client certificates carry a number, not an identity. No email address, no name.

And four boundaries we would rather write down than let you assume away:

• Node runtime logs contain connection source addresses. Access nodes record the address a connection came from, along with the time, for troubleshooting and abuse control. So the accurate statement is that your network address is not kept in the database, but it does appear in node runtime logs. They are not joined to your account record and survive only as long as the rotation window in section 5 holds them.
• Your traffic does pass through our nodes. It has to; that is the service. What we describe above is that we do not record or keep your destinations and content — not that they never reach us.
• Name resolution is provided by us, and some domains are blocked. Inside the tunnel, name lookups are handled by a resolver we provide, and we keep no record of the names you look up. For abuse control we block a list of domains — they will not load while you are connected. If a site fails to load only while you are connected, this is one of the possible reasons. The list is maintained by our administrators and can change at any time; how to object is in section 10.
• Some traffic is dropped outright. Outbound mail ports and file-sharing traffic do not leave our nodes. The full list, and what it means for you in practice, is in section 10.

4. Why we collect it

• To run the service you paid for: the email address and the two passwords open the account, sign you in and authenticate the connection; your preferences configure it the way you chose.
• To meter your plan: byte counters and the daily breakdown decide how much of your allowance is left, and are shown back to you in the member area.
• To keep accounts and the network safe: device counts, abnormal-concurrency records, per-address rate limits and the image check enforce the "your account is for you and your devices" rule in the Terms and hold off bulk registration and credential stuffing.
• To talk to you: verification codes, order and expiry notices, ticket replies. Promotional email is optional and you can tell us to stop.
• To settle money correctly: orders and the commission and reward ledgers exist so amounts are right and nothing is granted twice.

Optional features — the messaging bot, the referral programme, promotional email — are processed only if you turn them on, and turning them off stops that processing from then on.

5. How long we keep it

Where a period is given below, the data is cleared automatically when it expires — you do not have to ask. A few rows have no fixed period: your account record lives as long as the account and goes when you close it; orders and commission ledgers are kept as financial records; offsite backups are replaced on their rotation. For security reasons we do not describe here how these clean-ups are carried out.

6. Who else can see it

We do not sell personal information and we share nothing for advertising or with data brokers. Outside our own systems, data goes only to the recipients below.

7. Where your data goes: nodes and regions

So that every access node can authenticate you and apply your speed and device limits the instant you connect, we generate a per-account configuration file — named with your account id and your registered email, and carrying the limits that come with your plan — and synchronise it to all of our own access nodes. The file has to be named that way because the connection service looks it up by the exact name you sign on with. The sync is a full replacement of the set and overwrites what was there before, which means each node holds the current configuration for every registered account, not only for the people currently using that node. Nodes do not hold your sign-in password, your orders, your tickets or your usage history.

Our systems and nodes sit in more than one jurisdiction outside mainland China, so your account information and usage figures move between them. If the rules where you live require separate consent before your data leaves the country, please weigh that before signing up.

We do not publish the list of countries, facilities or providers behind the nodes. That is a security trade-off, not evasiveness: publishing where the machines are hands over a ready-made target list and directly affects whether everyone can stay connected. It is the same reasoning behind labelling lines "Line 01" and "Line 02" on the site rather than naming places.

8. Security, backups and incident notice

• Encryption in transit: both web access and the tunnel itself run over TLS/DTLS.
• Least privilege: system accounts are separated by purpose, and the authenticating component can read only the three purpose-built views it needs.
• Signing key isolation: the key that issues client certificates is held by a separate, isolated component. The public-facing web application does not hold it, and neither do the access nodes, so a compromise of the website does not hand anyone the ability to mint credentials.
• Backup encryption: the database dump and the server directory are encrypted before they leave our servers, so both the contents and the file names reach the storage provider as ciphertext and the provider can read neither. We verify regularly that a backup would actually restore, and a failure raises an alert. To be precise: the protection comes from the payload being encrypted, not from the transport. For security reasons we do not describe how, how often, or where backups are run and kept.

Like any connected system, we cannot promise this is airtight, and we will not pretend otherwise. If a security incident affects your data, we will post a notice on the site within a reasonable time and email affected users, describing what happened and what you should do.

9. Cookies, sign-in sessions, and how to end one

We use only the browser storage the site needs to work. There are no advertising or cross-site tracking cookies.

• Sign-in token: issued when you sign in, stored in your browser, valid for one year at most. Tokens left unused for a long time are cleared sooner.
• You can see your sessions and revoke them. The member area lists the sign-in sessions currently held against your account and lets you revoke any one of them. That is how you end a session on our side, rather than only on the device in front of you — worth using if you have signed in on a shared or borrowed computer, or if you think a token has been exposed. On the device itself, clearing the browser's site data removes the local copy as well. If you can no longer reach the member area, open a ticket or write to the privacy address and we will revoke it for you.
• Session and security storage: what form validation and the image check need in order to work, valid for the browsing session only.
• Image check: generated on our own servers today, so no outside verification service receives your address for it. That is a current configuration rather than a law of nature; if we ever switch to an external provider, this page will say so.
• Language choice: carried in the page address. Nothing is stored.
• Third-party analytics or advertising cookies: none.

10. What our systems do automatically

These run without a person looking first and can affect you directly, which is why they are written down rather than left for you to discover. They apply to every account alike and work from rules, signatures and counters — not from any record of where you have been.

a) On the network, while you are connected

• Outbound mail sending is blocked. Sending mail out through the tunnel is closed off so that our lines cannot be used to push bulk mail. The practical consequence for you: a desktop mail client will not be able to send while you are connected. Webmail is unaffected, and so is receiving mail.
• File-sharing traffic is blocked. Peer-to-peer downloading will not work inside the tunnel.
• Per-device connection caps. Each connected client has a ceiling on how many simultaneous outbound connections it may hold and how fast it may open new ones; anything past the ceiling is dropped. Ordinary browsing stays well below it; tools that open hundreds of connections at once may notice.
• Name lookups are filtered against a blocklist, as described in section 3. If you believe an ordinary domain has been listed by mistake, tell us in a ticket and we will review it.

b) On your account

• Rate limits and a human check: sign-in, registration and password reset are rate limited, and unusual attempts are asked to complete an image check, to fend off bulk registration and credential stuffing. The counters used for this live in a short-lived cache and are never written to the database. We do not describe the exact trigger conditions.
• Expiry and quota checks: when a plan expires or its data allowance runs out, live sessions are ended and the client certificates issued to that account are revoked, until you renew or the cycle resets.
• Device limit: sessions beyond your plan's device count are dropped.
• Abnormal concurrency: accounts showing sustained abnormal simultaneous-connection levels are recorded and reviewed, and may face rate limiting, suspension or termination under the Terms.
• Appeal: if you think an automatic action was wrong, open a ticket or write to the privacy address in section 1 and a person will review it.

11. Your rights and your choices

You can see and do the important parts yourself without asking: your remaining allowance and your day-by-day usage are in the member area, your connection password is on your connection details page, and your active sign-in sessions are listed where you can revoke them.

• Access: ask for a copy of what is held against your account.
• Correction: ask us to fix wrong account details.
• Ending sessions: revoke any sign-in session yourself, as described in section 9.
• Deletion and closure: see section 12.
• Withdrawing consent: unlink the messaging bot whenever you like, or tell us to stop promotional email. Withdrawal takes effect from then on; it does not undo processing already done, and it does not switch off essential notices such as expiry reminders.
• Complaint: if you are unhappy with how we handled a request, say so in the same ticket or by email and ask for it to be reviewed. You may also raise it with whichever authority is competent where you live.

A request submitted from inside your signed-in account verifies itself, and we will not ask you for identity documents. If you write from the address on file because you cannot sign in, we may ask a question or two to establish that the account is yours. We answer within a reasonable time and charge nothing, unless the same request is repeated at unreasonable volume.

12. Closing your account, and what deletion actually removes

There is no self-service delete button today. Ask in a ticket, or by email from the address on the account, and we will do it and confirm.

What closure removes: the account record itself — registered email, sign-in password hash, connection password and invite code — together with your orders, your invite and redemption codes, your traffic statistics and your tickets. Removing orders and tickets means you will not be able to look that history up afterwards, so export anything you want to keep before you ask. Entries that settle someone else's account, such as the commission recorded for whoever invited you, stay with that account, as do the accounting records the books require.

Two limits of the routine, stated rather than glossed over. The messages inside a ticket are not part of the same action — the ticket goes, the conversation rows are not removed with it. Your connection preferences are not part of the deletion routine either. If you want both cleared as well, say so in the same request and we will remove them by hand.

Closing the account does not revoke a certificate already installed on a device. Certificates carry their own validity of 30 to 90 days and stop working when it lapses. If you need one revoked at once — a lost phone, for example — say so in the same request and we will revoke it. The same goes for sign-in sessions: revoke them yourself in the member area before you close the account, or ask us to.

Closing your account is not a refund. Consistent with sections 4 and 6 of the Terms, closing an account, or having it terminated for a breach, does not entitle you to money back for the unused part of a plan, and does not entitle you to draw down a commission balance that has not yet been paid out. Please be sure of that before you ask.

13. Legal requests

We disclose data only where there is a valid legal basis, and only the minimum that answers the request. We do not act on informal demands, and we do not act on requests whose authority we cannot verify.

There is also a factual limit worth stating plainly: we hold no record of which sites you visited or what your traffic contained, so there is nothing of that kind for us to hand over. That is a description of what is on our disks today rather than a prediction about the future — if it ever changes, this page changes with it, and the "Last updated" line at the top will say so.

14. Minors

This service is not intended for children. We do not knowingly collect information from anyone below the age at which they can enter into a contract where they live. If we learn that an account belongs to such a person, we delete the account and its data. A parent or guardian who needs to raise this can write to the privacy address below — a ticket requires a sign-in, and that is usually exactly what a guardian does not have.

15. Changes to this policy, and how to reach us

If we change this policy we will post a notice on the site, update the "Last updated" date at the top, and say what changed. Please check this page from time to time; continuing to use the service after a change takes effect means the revised policy applies to you.

Privacy and data requests: privacy@yunoc.com  ·  everything else, including privacy questions you can raise while signed in, through a ticket in your member area, which is faster and leaves a record. Those two are our only channels; anyone approaching you elsewhere and asking for your account details is not us.