Legal
Privacy Policy
Sunshine is a VPN. We built it so that we cannot see what you do online while you are connected. This page lists everything we do keep, why, and for how long. Logan Meyer, sole proprietor doing business as Sunshine VPN (930 North Ogden St., Denver, CO 80218, USA) is responsible for it.
1. What we never collect
- No browsing, DNS or connection logs. We do not record which sites, apps or services your devices reach, what they look up, or when. Our VPN servers have no network flow logs, our DNS resolver has query logging switched off, and these are fixed in the code that builds the servers — not a setting someone can quietly turn on.
- No per-session records. The protocol has no sessions to record. While your device is connected, the server's memory holds the internet address your device last connected from and the time of its last handshake, because the protocol needs them to reach you. They are never written to disk or sent anywhere, and disappear when you remove the device or the server restarts.
- Not your private key. Each device's key is created on the device. Only the public half ever reaches us.
- No analytics or advertising trackers in the apps or on this website, and no advertising identifiers. If that ever changes, this page changes first.
2. What we keep
| What | Why | How long |
|---|---|---|
| Your e-mail address | Sign-in, receipts, the notices about your meter and ceiling | Until you delete your account |
| Each device's name (you choose it), public key, the server region you picked and the private tunnel addresses we assign | So your device can connect, and so you can tell devices apart | Until you remove the device |
| Data used per device per calendar month: one running total of bytes, with no destinations and no times finer than the month | The meter, your ceiling and the per-GB bill | The current and the previous month, then deleted |
| Your account's monthly totals derived from that: data used, cost so far, your ceiling, which notices we sent, any per-GB amount under $3 carried into the next month | The meter and billing | Until you delete your account (one set of numbers per month, overwritten each month) |
| Billing state: Stripe customer and subscription ids, plan, renewal date, and when you accepted these terms and the renewal terms | Billing and your proof of consent | Until you delete your account; Stripe keeps payment records as the law requires |
| Server-wide counters: connected devices, recent handshakes, total bytes per server | Capacity and reliability | 15 months |
| Service logs: errors and counts, with an opaque account number where needed — never your IP address, never traffic | Keeping the service working | 30 days |
| Messages you send us | Answering you | Up to 2 years |
What leaves us for billing is one number per account per month: how many hundredths of a GB to bill. Stripe never learns where your data went.
3. Who processes it
| Who | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting, the VPN servers, sign-in (Amazon Cognito), our database and service e-mail | United States (servers in the regions you choose) |
| Stripe (Link) | Merchant of record for payments (Managed Payments): checkout, sales tax / VAT / GST, receipts, invoices, fraud prevention and the per-GB usage total for billing | United States |
| Our support mailbox (Google Workspace) | United States |
Stripe (shown at checkout as Link) is the merchant of record for payments and processes your card, billing-address and tax details as an independent controller under its own privacy policy (stripe.com/privacy and link.com/privacy). We never see your full card number.
Apple and Google apply their own policies when you download an app from their stores. We do not sell or share personal data, and we do not use it for advertising.
4. Requests from the police and courts
We answer valid legal process from the competent authorities, and we tell you about a request unless the law forbids it. Because of how Sunshine is built, what we can hand over is limited to the table above: your e-mail, billing state, device names and public keys, assigned tunnel addresses and monthly totals. We cannot connect one of our server addresses at a given time to a person, because we keep nothing that would let us.
5. Your choices and rights
- Remove any device at any time from your account page; its connection stops within a minute.
- Delete your account by e-mailing support@sunshinevpn.co from its address; we cancel the subscription and delete your records within 30 days, apart from what the law makes us keep for tax and accounting.
- Ask for a copy of your data, or for a correction, at the same address. Wherever you live, including the EU, the UK and California, we honour access, correction, deletion and objection requests, and you may complain to your data-protection authority.
- Your data is stored in the United States.
6. Security
Traffic between your device and our servers is encrypted. Our servers use encrypted disks, have no stored passwords or static keys, and are replaced rather than repaired. Report a security problem to support@sunshinevpn.co.
7. Children
Sunshine is for adults (18 and over) and is not directed at children.
8. Changes
We post changes here with a new effective date and e-mail account holders about material changes before they apply.