No-logs VPN: how to verify the claim, a privacy-first checklist

No-logs: three different meanings

The words "no logs" don't mean the same thing at every provider. Break the claim down and at least three kinds of records need to be looked at separately:

• Connection records: when you connected, which IP you came from, which route you were assigned, how much traffic you used.
• Usage records: which domains were visited, what DNS queries were made, what the requests contained.
• Account records: the fields you filled in at sign-up, the payment channel, order numbers and support ticket history.

When most providers say "no logs", they mean they don't keep the second category long-term and they minimise the first — retaining only the aggregate data needed for billing and troubleshooting. So when you see the phrase, ask four follow-ups: which category isn't recorded, for how long, who can read it, and in what form it's stored. If the terms can't answer that, they effectively say nothing.

One more point that gets muddled: logging and encryption are not the same thing. Encryption governs whether data can be intercepted in transit; logging governs whether it gets written down once it reaches the server. Privacy only works when both are done right — get one right and the other becomes the weak link.

Verification: five checks you can run yourself

None of the five checks below require packet capture or taking the client apart, and all of them take under ten minutes. What you're testing is whether the claims line up — not whether the provider is brave enough to promise something.

• ✅ The privacy policy states which categories are recorded, what for, and how long they're kept — not just a single line saying "we don't log anything".
• ✅ The sign-up form asks only for a username and password. This service sits in that bracket: no email address required, username plus password is enough to register — one less field means one less thread that can be matched against records elsewhere.
• ✅ There is more than one payment channel. This service offers Alipay, WeChat and USDT, and which one you use is your call.
• ❌ The marketing page puts "no logs" in a headline, but the privacy policy has no matching section — or mentions it once in the FAQ.
• ❌ The terms say usage data is collected "to improve the service", but never say what's collected or how it's deleted.

The first three are plus points; the last two are disqualifiers. One disqualifier is enough to go and look elsewhere — vague privacy terms are rarely a typo, they're usually a decision not to be clear.

One practical tip: when you read the terms, search for keywords such as "logs", "retention", "third party" and "law enforcement" rather than reading top to bottom. If the matching section doesn't exist, that tells you how seriously the provider treats the question.

Sign-up and payment: what gets left behind

The two steps most often overlooked in privacy discussions are sign-up and payment. A connection can be dropped at any time, but account details sit in the provider's database for a long time, and they're usually tied to payment records.

The email point deserves its own paragraph. Many services use an email address as the account's unique identifier, relying on it for password resets and renewal reminders; the cost is that this address is usually also tied to social accounts, cloud storage and shopping history, so once it's linked, the separation you built earlier is wasted. When sign-up needs only a username and password, that chain is broken. The trade-off is that you have to remember the password yourself — save it to a password manager the moment you register.

Payment works the same way. Alipay and WeChat leave an order record; USDT doesn't touch a bank account. Which one you pick depends on who you're willing to let see the spending. One warning: don't cut corners by buying a shared account from an unknown seller — the login details sit with someone else, and the money you save doesn't buy back control.

Device limits also affect the privacy cost. Services that charge per device usually require a separate login on each one, and the more detailed the login records, the more there is to correlate. This service has no device limit: one account works across several devices without handing over identity information again for each one.

Four things to do on public Wi-Fi

Hotel, airport and café networks are where privacy risk concentrates: someone on the same subnet can sniff traffic, captive portals may ask you to log in over plain text, and local DNS can be rewritten. Do these four things, in this order:

1. Read the captive portal before you type anything. Hotel Wi-Fi often asks you to accept terms or enter a room number in the browser, and that step usually runs over plain HTTP — don't enter email or payment passwords there.
2. Connect the accelerator client first, then open the browser. Do it the other way round and your first request has already gone out over the local network.
3. Run a DNS leak check once. After connecting, confirm that DNS queries go through the route rather than to the address handed out by the local ISP.
4. Log out when you're done, and turn off "auto-connect" for that network. Next time you walk past, the device won't join it on its own.

DNS leaks are the most common slip. Systems use the DNS servers handed out by the local ISP by default, so even when web traffic is inside an encrypted tunnel, DNS queries can still go out locally — which is effectively publishing the list of domains you visited. Most clients offer a "DNS leak protection" or force-DNS-through-tunnel switch; turn it on, then verify manually.

# macOS: check the DNS servers the system is currently using
scutil --dns | grep nameserver

# Linux: check the resolver configuration
cat /etc/resolv.conf

# Windows Command Prompt: check the adapter's DNS servers
ipconfig /all

Run it once before connecting and once after, then compare. If DNS still points at the local ISP's address after connecting, the queries aren't following the tunnel and you need to go back into the client settings. No extra tools needed — the commands built into the system are enough.

One more: on public networks, stick to sites served over HTTPS where you can. The padlock in the address bar isn't a cure-all, but it blocks most plain-text sniffing, and combined with a tunnel it shrinks your exposure considerably.

The privacy-first selection order

When privacy comes first, the order changes: rule out, then compare, and only then look at price.

1. Rule out any service that demands an email address at sign-up and has no logging section in its privacy policy.
2. Look at payment channels: beyond Alipay and WeChat, is there an option such as USDT that doesn't depend on a bank card?
3. Look at the refund window: can you walk away unharmed after trying it? This service offers a 30-day refund with no reason needed — just open a ticket.
4. Only then compare routes and price: 120+ countries / 150+ routes; monthly plans at ¥9.9 for 60GB, ¥18 for 250GB and ¥28 for 500GB; data packs from ¥158/300GB, use them up whenever you like, they never expire.

The order matters because the first four items can't be fixed after the fact, while price can be changed at any time. A service that demands an email to register and writes vague terms isn't worth handing over long-lived, correlatable information to, however low the monthly fee.

All four figures can be checked on the plans page and the global network page — no extra testing required. The price tiers map to data allowances, and which one fits depends on your actual monthly usage: for occasional research and email, 60GB is plenty; if several devices are online at once or you watch a lot of video, step up a tier.

Three common misconceptions and a self-check list

Myth 1: no email means anonymous

Anonymity is a matter of degree, not a switch. Even when sign-up doesn't ask for an email, payment records, connection times and device characteristics can still form links. What you can do is cut the correlatable fields to a minimum — not believe that one step makes you invisible.

Myth 2: stronger encryption means more privacy

Encryption addresses interception on the link; a logging policy addresses retention on the server. Two different things. However strong the link encryption, privacy won't hold up if the server stores visited domains tied to an account for months. Quantum-resistant encryption is a link-side safeguard and can't substitute for judgement on the terms side.

Myth 3: free options are "cleaner"

A free option's running costs are usually covered elsewhere: speed limits, data caps, ad slots, or coarser logging granularity. The test isn't the price tag but whether the terms are specific enough — and on that count, free and paid have no inherent difference.

Run this list before you commit — all four before you pay:

• ✅ The sign-up form has no email field, only username and password.
• ✅ The privacy policy states which categories are recorded and how long they're kept — not a slogan.
• ✅ At least one payment channel doesn't depend on a bank card.
• ✅ The refund window states a number of days, and you can actually complete it through a ticket.

None of these four needs specialist knowledge, and the whole pass takes about ten minutes. If you're still unsure afterwards, look at the refund terms first — the point of a 30-day refund with no reason needed is that a wrong call can still be undone. Route and pricing details are on the plans page, common questions about sign-up and payment are answered one by one in the FAQ, and server locations are on the global network page.