Privacy Policy

Effective date: 2026-05-18.

This policy explains what data Arcana VPN ("the Service") collects when you use the Telegram bot and the website at arcanavpn.com, what we never collect, and what your rights are.

What we collect

The minimum required to operate a subscription service:

• Telegram user ID — a number assigned by Telegram. We need it to deliver your VPN key to the right account.
• Subscription token — a random 32-character string we generate and link to your subscription. Used in the public subscription URL.
• Plan and expiry timestamp — what you bought and when it ends.
• Language preference — to show the bot/site in your chosen language.
• Payment record metadata — provider (Stars or CryptoBot), invoice/charge ID, amount, status. We do not see or store card numbers, crypto wallet keys, or banking details — both payment providers handle that data outside of our system.

What we do NOT collect

• ❌ Your IP address (we never log connection IPs)
• ❌ DNS queries
• ❌ Browsing history or destination websites
• ❌ Traffic content
• ❌ Your real name, email, or any government identifier
• ❌ Device fingerprints

The VPN traffic itself passes through our servers but is never inspected, logged, or stored. We have no technical mechanism to record it. The Reality protocol means we cannot link a specific connection to a specific user from network traces alone.

How long we keep data

• While your subscription is active: all minimum-required fields above.
• After expiry: subscription record retained for 30 days for support purposes (so you can recover access if you mis-clicked "delete"), then permanently purged.
• Payment records: retained for 12 months for accounting / dispute resolution, then purged.

Third parties that touch your data

We use these providers — each handles only the slice they need:

• Telegram — to deliver bot messages and process Stars payments. Subject to Telegram's privacy policy.
• CryptoBot — to process USDT payments. We send them: invoice description, amount. They send us: payment status.
• Cloudflare — to manage DNS for arcanavpn.com (DNS-only; no traffic proxying). They see DNS lookups to our domain, nothing else.
• Netlify — to host the marketing website. They see web visits to arcanavpn.com but not your VPN traffic.
• Cloudflare Web Analytics — anonymous, cookieless visit statistics for the marketing site. No personal data collected.

We do not sell, rent, or share your data with advertisers, brokers, or analytics partners beyond what's listed above.

Cookies

The website uses exactly one cookie: NEXT_LOCALE, set when you select a language. It's strictly necessary for the site to remember your language preference and is exempt from consent under the ePrivacy Directive. No analytics or tracking cookies are set.

Your rights (GDPR / CCPA-equivalent)

You can ask us to:

• Access the data we hold about you
• Delete your account and all associated records
• Correct any inaccurate data
• Export your data in a portable format

Email support@arcanavpn.com with your Telegram user ID. We respond within 30 days.

Government data requests

Warrant canary (as of 2026-05-18): We have not received any government data requests, gag orders, or subpoenas.

If we ever receive one, we will:

1. Push back on overbroad requests via legal channels
2. Notify the affected user if not legally prohibited
3. Update this canary

If this section disappears without explanation, draw your own conclusion.

Children

The Service is not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor has used the service, contact us and we will delete the account.

Changes to this policy

Material changes will be announced in the bot and on this page at least 14 days before they take effect. The "Effective date" at the top will reflect the most recent revision.

Contact

Email: support@arcanavpn.com Telegram: @arcanavpnassistant

---

Translations of this policy may be provided for convenience. The English version is authoritative in case of conflict.