Security and privacy at ForestVPN
A VPN moves your trust from your network to its operator, so these are the questions to ask, answered with specifics. If an answer is missing, write to support@fvpn.net.
Can ForestVPN see the sites I visit?
There is no column anywhere in our systems for the sites you visit or the names you look up. Your traffic leaves through an exit server we run, and the control-plane service in front of it issues signed server lists and entitlements and never carries a packet. When your network's DNS fails, the app may ask a public resolver for the addresses of our own servers, never for a site you visit: the privacy policy names them.
What do you keep?
One row ties your device, and any linked account, to each session it pays for, to meter data and to cut off a revoked device. It is deleted an hour after the session settles, or up to 17 days later for a ticket that was never used.
Not kept
- The sites you visit and the names you look up.
- Which exit a session used: it is erased when the session ends.
- Your card number: Apple, Google or the payment processor you choose handles payment, and we never see it.
Collected
- Per device: a public key, the platform, when it registered, the day it was last seen, any name you give it and any account link.
- Data and connection counts per day, kept 31 days, and per month, kept indefinitely, with any block and its reason.
- Each ticket request's country and network provider, and each connection's data use, under a pseudonym for three months, to spot abuse and set limits.
- If you subscribe: Apple's or Google's signed purchase record and a token tied to the device, or, for a web purchase, a one-time reference number we generate.
A diagnostic report shows you its contents before you send it.
Does ForestVPN know who I am?
No name, no email and no password. Your account is a 32-character number, and it is optional until you want a subscription on your other devices. See No sign-up.
Does a VPN make me anonymous?
No. It changes who can see your traffic, not who you are to the sites you sign in to. We never claim otherwise.
How is the tunnel built?
The handshake is Noise_IKpsk2, unmodified, with X25519, ChaCha20-Poly1305 and BLAKE2s. Your traffic ends on exit servers we operate, not on a Worker. The details are on the protocol page.
Who runs ForestVPN?
ForestVPN is operated by Digital Services LLC. The terms say which law governs, and you can reach us at support@fvpn.net.
What happens when I delete my account?
The account number stops working for good, every attached device is unlinked, and it cannot be undone. Deleting does not cancel a subscription: cancel it in the store first. See Delete your account.
How do I report a security problem?
Write to support@fvpn.net. The same address is in our security.txt.