Template text. This page is a starting point written for this service and must be reviewed (and adapted to your jurisdiction) by the operator before launch.
Last updated: 14 October 2026
The short version
- No sign-up: we never ask for your name, email or phone number to create an account.
- Your password, keys and config files are shown to you once. We keep no copy of them.
- We never store raw IP addresses. Abuse protection uses a keyed hash that cannot be turned back into your address.
- No advertising, no analytics trackers and no third-party scripts (except the optional captcha described below).
When you create an account
To create and later remove your account we record:
- the protocol, the server and the validity you chose;
- the username (for SSH-type accounts) or an internal account identifier;
- when the account was created and when it expires;
- a keyed hash of your IP address, used only for rate limits and to stop mass account creation.
The VPN server you picked needs your credentials so that you can log in. They exist there while your account is valid and are removed from the server when it expires or is revoked.
One-time delivery of your details
Right after creation, your connection details are encrypted and held for at most 1 hour, so that your browser can fetch them (also after a reload). Only your browser holds the claim token that unlocks them. When that time runs out, the encrypted copy is erased for good.
This is why we cannot show your password again or send it to you later. Copy it, scan the QR code or download the file before you leave the page.
When you report a problem
The report form stores the server and protocol you selected, the category, your message, the email address if you choose to give one, and a keyed hash of your IP address (to limit spam). We use it only to investigate the problem and, if you left an address, to reply.
What stays in your browser
- My accounts: a short, non-secret summary of the accounts you created on this device (protocol, server, username, avatar and expiry), kept in your browser's local storage. It never contains passwords, keys, links or configs, and you can clear it at any time on the My accounts page.
- Your light or dark theme choice, and whether you dismissed the announcement bar for this session.
We do not use tracking or advertising cookies.
Captcha
When the captcha is switched on, the account and report forms load Cloudflare Turnstile to tell people from bots. Cloudflare then processes technical data such as your IP address under its own privacy policy. It is the only third-party service the public site talks to.
Your traffic
We do not record which websites you visit or what you send through our servers. Servers collect only what they need to run: for example whether an account is active and basic health figures such as CPU load and uptime.
How long we keep things
- Encrypted one-time results: at most 1 hour.
- Account records (without any credentials): kept after the account expires, for statistics and abuse prevention.
- Problem reports: kept while we look into them, then deleted automatically 90 days after they are resolved (sooner on request).
- Server health history (no personal data): 7 days.
Your choices
You can clear the My accounts list in your browser at any time. To have a report you sent deleted, or for any other privacy question, contact us through the contact page. Because we never ask who you are, we may not be able to link an account to you.
Changes to this policy
If we change what we collect, we will update this page and the date at the top. Using LitronSSH after a change means you accept the updated policy.