Retention & Deletion · Company commitment
Surfshark says it keeps no activity logs, but stores user ID/IP and timestamps for up to 15 minutes after a session
Surfshark describes a No-logs Policy as one of the most important features of its VPN: your activities are not logged, retained, or transferred to third parties when you connect. It says it does not collect what you do online (visited IP addresses, browsing history, session information, used bandwidth, connection time stamps, network traffic or similar data), and that what it does collect is strictly necessary to provide the service. The Terms qualify this: to prevent service abuse, its servers store your user ID and/or IP address and connection time stamps, and this information is automatically deleted within 15 minutes after your session ends. Dedicated IP users are treated differently (see the Dedicated IP card).
Supporting quotations
We don’t collect logs or any other information that’d let us identify you. The only things we do collect are strictly necessary to provide you with our services.
No-logs Policy is one of the most important features of our VPN service. It means your activities are not in any way logged, retained, or transferred to third parties when you connect to our VPN service.
We do not collect any information about what you do online (your visited IP addresses, browsing history, session information, used bandwidth, connection time stamps, network traffic or any other similar data).
To prevent service abuse, our servers store your user ID and/or IP address, and connection time stamps, but this information is automatically deleted within 15 minutes after termination of your session.
Moreover, only very limited user data collected from or provided by you is processed in order to provide VPN service to you.
More information on what information is collected about you and how it is used can be found in our Privacy Policy
Qualifications & exceptions
- The 15-minute deletion applies to the user ID and/or IP address and connection time stamps stored to prevent service abuse; it is stated to run from termination of your session.
- Surfshark says it can ensure the policy because it is based in a jurisdiction that does not require data storage or reporting and because the relevant processes are automated; the Terms do not name that jurisdiction in this section.
- The Terms also say that only very limited user data collected from or provided by you is processed to provide the VPN service.
Not stated here
- This section does not say how the 'strictly necessary' collection is defined beyond referring to the Privacy Policy, which is not supplied here.
- The statement that Surfshark does not collect information that would let it identify you sits alongside the account registration described in sections 2 and 3 (email address and password); this section does not reconcile the two.