Privacy Policy

01Scope

This policy applies to the marketing pages and the user panel under vpnzm.com. The user panel handles registration, orders, subscription import and support tickets; the marketing pages describe the service scope, routes and plans.

Third-party payment channels complete payment on their own pages, where their own privacy policies apply. This policy does not cover those external pages.

Continuing to use the service means you have read and understood this policy. If you disagree with any part of it, please stop using the service and submit an account deletion request in the user panel.

02Data collected and why

The service collects only the data needed to maintain accounts, deliver subscriptions and troubleshoot faults. Registration does not require an email address — a username and password are enough.

• Account information: username and password. Passwords are stored as an irreversible hash and used to verify sign-ins and confirm account security.
• Order and subscription records: plan tier, data packs, order number, payment status, activation date, data reset day and refund requests. Used to deliver subscriptions, tally data usage, prorate mid-cycle upgrades and handle the 30-day refund.
• Session information: client type and version, sign-in time and the number of devices currently online. Used to manage sessions with no cap on simultaneous devices, and to tell whether a connection problem comes from the client version.
• Visit statistics: page views, referring page, browser type and approximate region. Used in aggregate for capacity planning and page improvements, never to build a personal profile.
• Ticket content: text and screenshots users submit voluntarily. Used only to diagnose the issue and report progress.

The service does not ask for a real name, address or ID documents. Anything not submitted voluntarily is not collected.

03No-logs stance

The service does not record which websites users visit, does not store DNS queries, and does not log connection destinations or access timelines. On the network side, only the aggregate metrics needed to run the service are kept: concurrent connections, bandwidth usage and node health. These metrics carry no destination information and cannot be traced back to any individual user's browsing.

Data usage for billing is counted per account: only the total volume is recorded, never where it went. The retention policy for connection logs is not to create them, not to archive them, not to sell them and not to use them for advertising. When session state has to be checked for troubleshooting, only the necessary fields of the current session are read, and nothing is written to storage once the work is done.

If a legal process requires data, the service can only provide account- and order-level information; browsing records are outside what can be provided, because the system does not generate such records.

04Cookies and local storage

The marketing pages use a small number of cookies to remember language preference and whether the announcement bar was dismissed. The user panel uses browser local storage to keep the sign-in token, current language and interface preferences. This data stays in the user's own browser and saves repeated sign-ins and repeated choices.

Visit statistics use aggregate counts, set no cross-site tracking identifiers and are not connected to any third-party ad network. The results are used only to judge whether a page needs more explanation or whether route capacity needs adjusting.

Users can clear cookies and local storage in their browser settings. After clearing, they need to sign in again and the language preference returns to the default. Disabling cookies does not affect reading the marketing pages, but it does affect keeping the user panel signed in.

05Payments and third-party handling

Payment is completed through Alipay, WeChat and USDT. When Alipay or WeChat is selected, the page redirects to that payment channel, which handles identity checks and charging. The service never touches card numbers, payment passwords or full payment credentials; it receives only the order number, amount and payment result.

USDT payments record only the on-chain transaction hash and the confirmation status, for reconciliation and refund verification.

Payment channels handle the necessary information under their own policies, so it is worth reading the relevant channel's privacy terms before ordering. The service does not give account information to any third party other than the payment channel for marketing purposes.

06Data retention and deletion

Account information is kept until the account is closed. After closure it enters the deletion process; order and payment records are kept for the period required by financial and tax compliance, then deleted or anonymised. Raw visit statistics are aggregated once the statistical purpose is served, and the aggregate carries no personal identifiers.

How to delete: sign in to the user panel, open a ticket with a deletion request, and state the username and the scope to be deleted. Tickets are the on-site channel, and progress can be checked on the same page. Once an account is closed, the subscription and remaining data cannot be restored, so please confirm before proceeding.

When this policy is updated, the Last updated month at the top of the page is revised with it. Material changes to what is collected or how it is used are flagged in the user panel. Continuing to use the service means accepting the updated policy.