Privacy policy
Who runs the service
The MizanVPN service is operated by MizanVPN. Contact: maqsudkovser@mizan.casa.
What data we store
- Email address: to create your account and to send password-setup links and confirmation messages.
- Password hash: you set your own password; the password itself is not stored and is never sent by email.
- Subscription data: plan type, status and expiry date.
- Invitation records: the invited email and the date the invitation was used.
- Sign-in and sign-up log: IP address, the country and provider determined from that IP, whether the IP belongs to a VPN or data-center network, browser or app information (user-agent), time and result (successful or not). Used to protect your account and to prevent fake sign-ups and password guessing, kept for 90 days. Country and provider are determined with a local database on our server — your IP address is not sent to anyone for this.
- Free-trial abuse protection: a one-way hash of your email address and device identifier (not the values themselves). Kept even after the account is deleted, so the free trial cannot be claimed again and again.
- An encrypted hash of the sign-up IP address (not the IP itself): to prevent mass sign-ups from one place.
- Website logs: IP address, time and the page opened. Used for security and error detection, kept for about 14 days.
- Payment data: this section will be updated when the payment system is active.
When you use the VPN
- We do not record or store the pages (URLs) you visit, your DNS queries or the content of your traffic. Only the technical data described in “Connection log” below is kept.
- Connection log: when you connect and disconnect, your account, your real IP address, the temporary internal address assigned to you and the time are recorded. In addition, for each new outgoing connection through the VPN, the time, destination IP address and port are recorded. Site names, pages and content are not recorded. These records are used only to investigate complaints about unlawful use of the service (attacks, spam, fraud) or lawful requests from competent authorities; they are kept for 100 days and then deleted automatically.
- Abuse protection: harmful connections such as spam, attacks and scanning are blocked automatically. For such blocked attempts the type, count, time, destination address and port are kept, linked to your account, for 90 days. Your normal traffic is not included in these records.
- An account token is used to check whether your sign-in and subscription are active.
- When you connect with the MizanVPN app, your traffic reaches the server under two layers of encryption: TLS 1.3 and, inside it, a quantum-resistant layer with a separate key (agreed via ML-KEM-1024 + X25519, data encrypted with AES-256-GCM). The keys of this layer are created anew for every connection and are not stored on the server. Sites and services see you as the VPN server's IP address.
- When you connect with the WireGuard app, traffic is encrypted with the WireGuard protocol (Curve25519 key agreement, ChaCha20-Poly1305), plus a separate additional key (PSK) for each device. Your secret key is created in your browser and is never sent to the server. The server stores only the public key, the additional key (PSK), the internal address assigned to you, the time of the last connection and the amount of traffic. You can delete the key on the Connect page at any time; it is deleted together with your account; a key that is never used within 20 minutes is deleted automatically.
Who we share data with
We do not sell data or use it for advertising. Only parties needed to run the service can access data: the server (hosting) provider and the email delivery service. When the payment system is added, the payment provider will be added to this list.
Upon a lawful request we can only provide the data described on this page that we still hold. Data we do not store (for example, the sites you visit) cannot be provided.
Retention and deletion
Data is kept while your account exists, and records with a specific retention period stated above are deleted automatically when that period ends. You can delete your account at any time on the Delete account page: the account, subscription, invitations, sign-in log and abuse records are deleted. Connection logs are kept until their 100-day period ends even if the account is deleted, and are then deleted automatically. The one-way hashes kept for the free trial are not deleted. Data may remain in backups for up to 7 days. For help with deletion you can write to the email above.
Security
Connections are encrypted, passwords are stored only as hashes, and access to servers is restricted. No system can provide an absolute security guarantee.
Children
The service is not intended for children.
Changes
If this policy changes, the new version will be published on this page and the date above will be updated.