Stored
- Bytes in and out, per session, in hourly buckets
- Which node a session ran on, and when it opened and closed
- Last handshake time, which is how an idle tunnel is noticed
- The client's public IP at connect time, for abuse handling
- Device labels — a name, a platform, and a fingerprint used only for display
- Administrative actions, append-only, with actor and source address
Not stored, because it is not collected
- Destinations — hosts, addresses or ports you reach
- DNS queries: this platform ships no resolver and installs none
- Packet payloads, headers or flow records of any kind
- Browsing history, in any form, at any layer
- Anything a node could hand over, because a node holds none of it
There is no logging switch to leave on
The node's collector reads WireGuard's per-peer counters. That interface exposes bytes and a handshake timestamp, and nothing else — there is no destination in it to record even carelessly.
Nothing in the platform inspects a packet. Nothing resolves a name on your behalf. The absence is structural rather than a setting, which is the only kind of absence worth trusting.
The one field that is genuinely sensitive
A session records the client's public IP, because handling an abuse report without it is not possible. It has its own retention window — thirty days by default — separate from the session record, and a deployment that does not want it can null it at ingest.
Where your queries actually go
Because full-tunnel routing sends DNS through the tunnel and out of the node, the resolver sees the node's address rather than yours. The default is a pair of public resolvers, and it is one setting to change.
An operator who runs their own resolver on a node points the configuration at its tunnel address, and then the queries never leave the node at all — which is better again.
An honest note about self-hosting
Running your own VPN moves trust; it does not remove it. Whoever runs the master can see who connected, when, to which node, and how much moved. If that is you, this is a privacy win. If it is somebody else, the question you should ask is who runs it — and the answer to "what can they see" is the list on this page.
Ask us something specific
If there is a field you need gone, or one you need kept longer, say so — the retention windows are configuration.