Last updated: September 28, 2026

Psiphon Inc. (“Psiphon,” “we,” “us,” or “our”) respects your privacy and is committed to protecting it through our compliance with this Privacy Policy. Psiphon exists to give people access to the open internet in countries where access is restricted, monitored, or blocked, including places where privacy is not a preference but a necessity. That reality informs every decision we make about data.

This Privacy Policy describes the types of information we may collect or that you may provide when you access or use the Services and our practices for collecting, using, maintaining, protecting, and disclosing that information. Please read this Privacy Policy carefully to understand our policies and practices regarding information and how we will treat it. By accessing or using the Services, you agree to the practices described herein. If you do not agree with this Privacy Policy, you must not access or use the Services.

This Privacy Policy may change from time to time (see “Modifications to this Privacy Policy” section below). Any changes to this Privacy Policy will be effective immediately upon posting the updated Privacy Policy unless otherwise stated or as required by applicable law. Your continued use of the Services after we make changes is deemed to be acceptance of those changes to the fullest extent permitted by applicable law, so please check the policy periodically for updates. We also record changes to this policy, and any temporary deviation from it, in our Privacy Bulletin.

Terms not defined in this Privacy Policy shall have the meanings as set forth in Psiphon’s Terms of Service.

Psiphon is a Canadian corporation with its head office in Ontario, and this policy reflects Canadian and Ontario privacy law. For more on those laws, see the Office of the Privacy Commissioner of Canada and the Office of the Information and Privacy Commissioner of Ontario.

This page covers how we handle data in brief. For the complete detail, see our Policies & Data Handling page.

1. Scope of Privacy Policy

This Privacy Policy applies to all aspects of our Services. The Services may link to or incorporate websites or content hosted and served by others over which we have no control, such as third-party websites, online properties, platforms, social media, or systems, which are each governed by the privacy policies and business practices of third parties. You understand and agree that Psiphon is not responsible for the security, privacy, or business practices of any third party. This Privacy Policy applies to information we collect:

• through communications between you and the Services;
• in email or other electronic correspondences and interactions between you and us;
• automatically as you use or access the Services; and
• through third-party applications and links.

2. Information We Collect

2.1 What We Do Not Collect

We do not collect information about your identity or what you do online. Accordingly:

• We never log your IP address. It is not written to a file, a database, or any persistent storage.
• We do not record the sites and services you connect to. We do not record the websites, applications, or services you access.
• We do not record the content of your traffic. What you send and receive through Psiphon is not stored or retained by us.

2.2 What We Collect

Psiphon collects aggregate data about how its network is being used, things like connection counts by region, data volumes, and network performance. This is what lets us detect censorship events in real time and respond to them.

None of this data is tied to you as an individual. We never log IP addresses. We never record what sites or services you connect to.

Specifically, for each connection we record:

• Approximate location and network provider. Your country, city, and internet provider, derived from your connection. Your IP address itself is never stored.
• Session statistics. Connection duration, data volumes, and network performance.
• Technical details. Protocol information, platform (Android, iOS, or Windows), Psiphon client version, and which of our servers you connected to.

2.3 Information You Provide

• Email correspondence. If our website is blocked, you can email us to receive download links. Your email reaches an auto-responder so it can send a reply, which means that system, hosted on Amazon Web Services, can see the message. Psiphon only sees an email address when you choose to give us one.
• Diagnostic feedback. If you run into issues using the Services, you may optionally submit diagnostic feedback. Submissions are encrypted on your device before transmission. You may also choose to include an email address so we can follow up.
• Subscription information. Subscriptions are purchased through the Apple App Store or Google Play. Psiphon receives transaction and receipt data from these platforms to confirm your subscription status. We never receive your payment details.

2.4 Website Analytics

Our website uses Google Analytics, which sets a cookie so it can recognize repeat visits. That information is not personally identifying, and you can disable cookies in your browser settings. This applies only to Psiphon's websites, not to the Psiphon app or VPN service.

3. How We Use Information

We use aggregate network data to:

• keep the Psiphon network fast and reliable;
• detect and respond to censorship events in real time;
• identify threats to users’ devices, such as malware attempting to contact known command-and-control servers;
• plan infrastructure capacity; and
• improve the service.

We use diagnostic feedback to diagnose connection problems and improve the service. We use email correspondence solely to respond to your request. We may also process any data we hold to comply with legal obligations.

4. How We Share Information

When we share statistics with sponsors, researchers, or partner organizations, we share only aggregated numbers, overall trends and counts. We never share anything at a level of detail that could point to a specific person or connection. If a region has too few users to report on safely, we don’t report on it at that level at all.

We do not sell data. We do not share data with advertisers beyond what is described in Section 6.

We may disclose data we hold when required by law, court order, or legal process, or to protect the rights, property, or safety of Psiphon, our users, or others. Any such disclosure is limited to what we actually hold, which as described above excludes IP addresses and activity records.

If Psiphon is involved in a merger, acquisition, or sale of assets, data we hold may be transferred as part of that transaction, subject to this policy.

5. Data Retention

We keep data only for as long as it is needed for the purposes described in this policy.

Connection data is deleted on an automated schedule. Aggregated statistics, which are not attributable to individuals, are kept indefinitely for long-term network analysis and reporting.

Diagnostic feedback, including any optional email address you include with it, may be kept indefinitely so we can diagnose and resolve issues and recognize recurring problems.

Backups and other processes may extend the time some data exists. We take reasonable steps to keep those periods bounded and minimal.

During major censorship events, we may retain a filtered subset of non-identifying connection data for longer so we can study and counter the blocking. We announce this in the Privacy Bulletin.

If you email us for download links, your message is deleted once the reply is sent, and related system logs are deleted after one week.

Specific retention practices for each type of data are published on our Policies & Data Handling page and updated as our practices change.

6. Third-Party Services

Psiphon uses third parties such as Google AdMob, Amazon Web Services, and Cloudflare. Each operates under its own privacy policy. Psiphon is not responsible for the privacy practices of these third parties.

Ads in the free version of the app are served through Google AdMob and use identifiers under the ad provider’s privacy policy.

7. Legal Requests

Psiphon is a Canadian company subject to Canadian law. We occasionally receive law-enforcement requests for user data. We hold no data that ties a connection to a person. Any data we do hold is disclosed only as described in Section 4.

8. Your Rights

8.1 EEA, United Kingdom, and Switzerland

If you are in the European Economic Area, the United Kingdom, or Switzerland, data protection law gives you the right to access, correct, delete, restrict, or object to the processing of personal data held about you, and to receive a portable copy of it.

Our connection records are not attributable to individuals, so most requests will result in a response that no such data exists. The personal data we may hold is limited to an email address you chose to provide to our auto-responder or in a feedback submission, and subscription verification data received from Apple or Google. We will search these records and respond to your request.

You also have the right to lodge a complaint with the competent supervisory authority.

8.2 United States

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have certain rights under your state’s consumer privacy law. Psiphon falls below the thresholds that would make it subject to these laws, including the California Consumer Privacy Act. We will nonetheless respond to requests from residents of these states in good faith, subject to applicable law.

8.3 Exercising Your Rights

To exercise any of these rights, contact privacy@psiphon.ca. Because Psiphon holds so little personal data, we can usually respond without verifying your identity. Where a request could affect another person’s data, we may ask for information sufficient to confirm you are the person the request concerns.

9. Children

Psiphon does not require an account and does not verify age. The limited data described in this policy is the same for every user regardless of age. We do not knowingly collect personal information from children under 18. If you believe a child under 18 has provided us with personal information, contact us at privacy@psiphon.ca and we will delete it.

10. Data Security

Traffic routed through Psiphon is encrypted between your device and our servers. Diagnostic feedback is encrypted on your device before transmission and is designed to be decrypted only by Psiphon. Psiphon’s core tunnel code is open source and independently audited; details are available on our Trust Center page. We maintain administrative, technical, and physical safeguards appropriate to the data we hold.

11. International Data Transfers

Psiphon is a Canadian corporation. The third-party services we use, including Amazon Web Services, Cloudflare, and Google, may process data in the United States or other countries. Psiphon operates servers in many countries; these servers route traffic and do not store data about users. Where data is transferred outside the European Economic Area, the United Kingdom, or Switzerland, we rely on the safeguards available under applicable data protection law.

12. Modifications to This Privacy Policy and the Privacy Bulletin

From time to time we add entries to our Privacy Bulletin, for two reasons:

• We change this policy, for example when a new law adds requirements or we start or stop using a third-party service. We describe what changed.
• We temporarily change what we collect, usually to resolve a service problem or to study a censorship event in more depth. We describe what was recorded, how long it was kept, and why.

The Privacy Bulletin is available at our Privacy Bulletin page. You can see when this Privacy Policy was last updated by checking the date at the top of this page.

13. Contact

To ask questions or comment about this Privacy Policy, contact us at privacy@psiphon.ca.

Psiphon Inc. · Toronto, Ontario, Canada