Last updated:
1. Scope and who we are
This Privacy Policy applies to colitu.com and its subdomains (including docs.colitu.com), the Colitu apps for Android, Windows, Linux (beta) and iOS, and the Colitu VPN service (together, the "Service"). The Service is operated by COLITU LIMITED, a company registered in England and Wales with its registered office at 128 City Road, London, United Kingdom, EC1V 2NX, company number 17520342; COLITU LIMITED is the controller of your personal data. The account database runs on a server in Turkey; VPN servers are in many countries. The technical detail behind this policy is in our Security Whitepaper; processing records are in the Data Processing Policy.
2. What the VPN servers do not record
The VPN servers do not record:
- the content of your traffic;
- the sites, domain names and IP addresses you connect to;
- your DNS queries. Our ad-blocking DNS resolvers have query logging and statistics turned off. By default the apps use public resolvers (Cloudflare, Google), which receive the queries from the VPN server's IP address, not yours;
- your IP address. It is used in memory for the connection only;
- connection logs.
What we do record on the VPN side is the volume of traffic per user per server, in windows of about 15 seconds. These records are kept for 90 days for quotas and fair use; afterwards only totals per billing period remain. They show when an account was active and how much data it used, but not where the traffic went. Colitu therefore does not promise complete anonymity.
3. Data we store and for how long
This list is complete and matches the "Logging and data inventory" section of the Security Whitepaper.
| Data | Retention | Purpose |
|---|---|---|
| E-mail address, password hash (Argon2id), language, account dates | Until the account is deleted; deletion replaces the address with a placeholder and makes the password unusable | Account and sign-in |
| E-mail verification and password reset codes (address, hashed code, IP address) | 7 days | Verifying the e-mail address, password reset |
| Sign-in events (IP address, country, browser or app) | 180 days | Account security, abuse prevention |
| IP address and country at registration and at the last sign-in | Registration: 180 days. Last sign-in: erased after 180 days without a sign-in | Account security, regional rules |
| Sign-ups and sign-ins refused under regional rules (IP address, country) | 90 days | Enforcing regional rules |
| Web sessions (IP address, country, browser, sign-in method) | Deleted 30 days after the session ends (sign-out, expiry or revocation) | Signing in, sessions list on the account page |
| App sign-in tokens (stored only as hashes, tied to a device) | Deleted 30 days after they expire or are revoked | Keeping the apps signed in |
| Two-step verification (encrypted authenticator secret, hashes of single-use recovery codes, 5-minute sign-in steps) | Secret and recovery codes until you turn it off or the account is deleted; sign-in steps are deleted 1 day after they expire | Account security |
| Passkeys (public key, credential ID, the name you give it, signature counter, creation and last-use dates; the private key and any biometric data never leave your device; 5-minute single-use verification challenges) | Until you remove the passkey or the account is deleted; verification challenges expire and are deleted after 5 minutes | Password-free sign-in and account security |
| VPN connection credentials (random secrets per server, tied to a device or a subscription link) | While the device or link is in use; deleted 30 days after it is removed or replaced | VPN access |
| Subscription links (the name you give, creation, last-use and expiry dates, a "may be shared" flag; the link itself is stored only as a hash). The IP addresses that use a link are not stored; only a daily, anonymous, approximate count of how many different networks used each link is kept for 48 hours | Until you revoke the link or delete the account (an expired link is revoked automatically); the network count deletes itself after 48 hours | One link per device and the shared-link warning |
| TV sign-in requests (device name, IP address, country) | Deleted 1 day after the 10-minute code expires | QR sign-in |
| Devices (name, platform, app and OS version, last IP address and country, keyed hash of a hardware identifier) | Kept while the device is on the account. A removed device's name, IP address, country and hardware hash are erased after 30 days; the IP address and country of a device not seen for 180 days are erased | Device limits, account security |
| Refused device and trial attempts (IP address, device details) | 180 days | Device limits, abuse prevention |
| Free plan and trial abuse checks (HMAC-SHA256 keyed hashes of the e-mail address, hardware ID and network; the key is not stored in the database) | Network: 30 days. E-mail and hardware ID: while the account exists and for 180 days after it is deleted. Unkeyed SHA-256 hashes written before this change are deleted at the latest 180 days after they were written | Preventing repeated free accounts |
| Automatic bot and abuse screening: for held or blocked accounts the score, the signals that triggered it, IP address, country, network (ASN) and user agent; for sign-ups refused before an account existed also the e-mail address | Held or blocked accounts: while the account exists, deleted with it. Refused sign-ups: 30 days | Preventing bots, scripted sign-ups and the harvesting of server addresses |
| Trial promo code abuse checks (HMAC-SHA256 keyed hashes of the normalised e-mail address, the device hardware ID and the network — IPv4 /32 and /24 or IPv6 /64 and /48; the key is not stored in the database) | Network: 35 days. E-mail and hardware ID: 365 days, also after the account is deleted | One trial code per person |
| Migration requests from the previous service (Telegram ID and name, notes, IP address) | Deleted 30 days after the last change. Of an approved request only a keyed hash of the Telegram ID remains, for 2 years | Moving old subscriptions; preventing the same subscription from being moved twice |
| Traffic volume per user per server (windows of about 15 seconds) | 90 days; afterwards only totals per billing period remain (deleted with the account) | Quotas, fair use, capacity planning; daily aggregate product statistics (counts only, not linkable to a person) |
| A signup source label (e.g. "github", "app:android") from the utm/ref tag of the site's entry link, the name of the site that sent you (e.g. github.com) or the app; no cookie, tracking pixel or URL is stored. The time of the first VPN connection. | Deleted with the account | Measuring, in aggregate, which channels bring real users and how long the first connection takes |
| Your invite code; the link between an account opened with an invite link and the inviting account, the invite's status (pending, earned, not valid and why) and the Premium days granted. The inviter is never shown the invitee's name or e-mail. | Deleted when either account is deleted | Granting invite rewards; preventing abuse (same IP address or device, throwaway e-mail); measuring invite signups in aggregate |
| The apps' anonymous usage statistics: connection results and the kind of failure, connect and recovery times (as range counts), unexpected disconnects, Adaptive Connect's protocol switches, latencies measured to servers and automatic mode's server choice, features used and the kill-switch state; the network type and the country and internet-provider number (ASN) of the network in use (from a signed label received while the VPN is off). The server keeps only totals per day, with networks (country + ASN) and servers in separate tables; no account, device, IP address or visited site is stored. Can be turned off in the app settings. | Totals kept indefinitely (not linkable to a person) | Measuring and improving connection quality, Adaptive Connect and feature use |
| Colitu Passport is saved to your account and follows you to every device you sign in on. Per stamp country: unlock time and pieces; achievements, collections, weekly expedition progress, nickname, title, cover, time-zone offset and collector number; day totals (minutes of use, pieces, night and early-morning minutes, and the list of countries used that day); the current run (country, its length and the last counted minute); reward events for the apps' reveal animations. Our servers count the minutes from connection time: a minute counts when one of our servers reports traffic for your account in that minute (each minute at most once, whatever the number of devices), and the country is the server's country; apps cannot add minutes. Only totals per day and per country are stored; there is no per-minute or per-session log, and no sites or IP addresses. Progress already on a device from the old version is imported once per device (capped to what is plausible, the higher value wins). | Day totals 400 days, reward events 30 days, the rest until the account is deleted | Saving the passport to your account, showing it on every device and working out rewards and weekly expeditions |
| Colitu Passport's optional anonymous counters, at most one report a day: number of stamps opened, highest open chapter, stamps per level, finished weekly expeditions, pieces earned that day and whether the passport was opened that day. Sent without authentication; the server only adds each report to per-day totals and stores no report row, account, device or IP address. Which countries the stamps came from, and when, is not sent. Only older app versions send it; new versions do not, because the passport is now kept on your account (see the "Colitu Passport" row). The setting starts off and can be turned off in the app. | Totals kept indefinitely (not linkable to a person) | Seeing in aggregate how much the passport is used and whether its rules are balanced (level and piece pace) |
| Your answers to in-app surveys: recommendation score (0–10), how you would feel without Colitu, why you did not renew Premium, an optional comment and the platform; surveys you closed (at most one survey in 30 days) | When the account is deleted the link to it and the comment are removed; only the anonymous score remains | Measuring satisfaction (NPS), product–market fit and reasons for leaving in aggregate |
| The 1–5 rating and optional comment you give a resolved support conversation; when it was first answered and resolved | Deleted with the support conversation | Measuring support quality (satisfaction, response and resolution time) in aggregate |
| Which transports worked for a device on which server, and how fast (no IP address) | Overwritten with each report; deleted 35 days after the last report | Trying working transports first |
| Plan, payments and orders (amount, payment method type, provider transaction ID, the provider's notification; for Rialit payments, a fixed payer number tied to the account) | As long as accounting and tax law requires, also after the account is deleted; automatic deletion at the end of that period is not implemented yet | Billing, refunds, legal obligations |
| Colitu Business company account: company name, billing e-mail, country, tax number, number of seats and their term; membership (role, invitation, joining and leaving dates, who added the member); company invoices and the company activity log. The company's owner and admins see each member's e-mail address and role and their devices' name, platform, app version and last-seen time; they cannot see traffic or visited sites | Until Colitu closes the company account; company invoices as long as accounting and tax law requires; password set-up links are valid for 7 days. When a member deletes their account, the membership is closed and the seat returns to the company | Managing company seats, company billing, renewal reminders |
| Businesses and content creators we send Colitu Business partnership offers to: company or channel name, the e-mail address they publish for business contact on their website or channel description, country and language; the mails we sent and when; the subject and first 300 characters of replies, and bounces | Sending and reply records in the panel are deleted after 12 months. The contact list is kept until the contact asks us to stop or the address is no longer needed; an address that replies "don't write to me" is never mailed again | Offering Colitu Business reseller and white-label partnerships (legitimate interest; every mail says how to object and links this policy) |
| Support conversations and attachments, including app logs the app attaches (addresses, site names and secrets masked) | Closed conversations: deleted 2 years after the last message | Support, handling complaints |
| Security reports: the text of the vulnerability you report (title, description, steps, impact) and the messages with the team; if you ask to be credited in the Hall of Fame, the name you choose (published publicly with the month and severity) | Until the account is deleted; deletion removes the reports, the messages and the Hall of Fame entry | Fixing vulnerabilities and paying rewards (optionally: crediting you in the Hall of Fame) |
| Connection report: when support looks into a connection problem, your app sends app and device details, connection events and app logs the next time it opens; site names and addresses are masked on the device and on the server, the sites you visit are not sent | Deleted after 90 days | Fixing connection problems (support) |
| Colitu Bot conversations (text, IP address, "was this helpful" feedback) | 180 days | Answering questions |
| E-mail delivery records (recipient address, type of e-mail) | 90 days | Solving delivery problems |
| Newsletter subscription (e-mail address, language, time of confirmation); only if you confirm through the link in the e-mail | Until you unsubscribe; unconfirmed sign-ups are deleted after 7 days | Announcement, release-note and offer e-mails (with your consent) |
| Website and API access logs (IP address, address requested, browser) | 14 days | Operating and protecting the Service |
| DNS leak test on our website | 10 minutes, in memory only | Showing the test result |
| Audit log (admin actions, and some account actions such as deleting the account, by account ID) | Indefinitely; the optional reason you give when deleting your account: 180 days | Accountability for actions |
Payment records exist only for customers who buy a paid plan. Card numbers, CVV codes, bank account details and crypto wallet keys never reach Colitu; they are entered on the payment provider's page.
4. Account deletion, backups and remaining gaps
Expired records are deleted by an automatic job that runs every hour, using the periods in section 3. We state the remaining gaps openly; fixing them is on our roadmap:
- Plan, payment and order records and the audit log have no automatic deletion yet.
- Database backups are encrypted with age to a public key, so making a backup needs only that key. The decryption key is kept offline, not on any server. A daily backup stays on our server for 3 days, and an encrypted copy is kept at Backblaze B2 (EU Central, Amsterdam), locked against deletion for 30 days and deleted after at most 36 days. Until then, backups may still contain data you have since deleted. Database snapshots taken before a deployment are not encrypted and are deleted from our server after at most 7 days.
You can delete your account yourself in the account settings on the website. Deletion takes effect at once:
Deleted at once: your e-mail address (replaced with a placeholder) and password; the two-step verification secret and recovery codes; passkeys (public key and name); the IP address, country, signup source label, first-connection time and admin notes on the account record; sign-in events; web sessions, app tokens and subscription links; VPN connection credentials; device names, keys, IP addresses, countries and hardware hashes; refused device and trial attempts; verification and reset codes; e-mail delivery records; Colitu Bot conversations; TV sign-in requests; migration requests; per-period traffic totals, server and transport preferences, transport reports; your Colitu Passport (stamps, achievements, collections, day totals and reward events); free-plan membership, a pending promo code, the invite code and invite records, account bans, and your security reports with their messages and Hall of Fame entry. Survey answers are detached from the account and kept only as anonymous scores without comments.
Kept, and why:
- Plan, payment and order records: as long as accounting and tax law requires (the emptied account record and device rows they refer to — ID, dates, platform, app version — stay with them).
- Colitu Business membership: the membership is closed at once and the seat returns to the company; the closed membership row (role, dates) and the company's invoices and activity log stay while the company account exists. A pending password set-up link is deleted.
- Keyed abuse-check hashes: e-mail and hardware ID for 180 days, network for 30 days, so a deleted account cannot immediately claim a new free plan.
- Traffic volume records: deleted 90 days after they were written.
- Support conversations: open ones are closed; deleted 2 years after the last message (for complaints and disputes).
- Audit log entries (by account ID, for example the deletion itself): indefinitely; the optional deletion reason for 180 days. The Telegram ID hash of an approved migration: 2 years. The delivery record of the deletion confirmation e-mail: 90 days.
Backups: Encrypted database backups made before the deletion keep the data for at most 36 days; unencrypted snapshots taken before a deployment for at most 7 days. The backups' decryption key is kept offline.
If you want remaining records erased sooner, where the law allows, write to privacy@colitu.com.
5. Legal basis
We process data to conclude and perform our contract with you (account, VPN access, billing), on the basis of our legitimate interests (security of the Service, preventing abuse and fraud, improving the Service), to meet legal obligations (accounting records) and, where required, with your consent. Newsletter e-mails are sent only with your consent: you are not subscribed until you confirm through the link in the e-mail, and every newsletter has a one-click unsubscribe link; unsubscribing deletes your address from the list.
6. Apps, telemetry and traffic outside the VPN
- No Colitu app (Android, iOS, Windows, Linux) contains analytics, advertising or crash-reporting libraries; the iOS app has had none since version 5.4.1.
- The Colitu apps and the browser extension may send anonymous usage statistics, which you can turn off in the settings (in the Firefox extension they stay off until you turn them on): only numbers such as connection success, timings and the features used. The server keeps them as totals per day, platform and version; no account, device, IP address or visited site is sent or stored. This is not a third-party analytics library. Connection results and Adaptive Connect events are collected the same anonymous way, with networks (country and internet provider) and servers kept in separate tables. Details: Anonymous usage statistics.
- All apps report to Colitu which transports worked on which server and how fast, tied to the device, so that working transports are tried first.
- When you open a support request, the app attaches recent app logs with addresses and secrets masked.
Regional sites outside the VPN. Some regional sites (domains and IP ranges on a built-in list) open directly, outside the tunnel, so that services which refuse foreign IP addresses keep working; some of these services refuse connections from foreign IP addresses. This does not apply when you are connected to a server in that region. In the Windows, Android, iOS and Linux apps this rule applies only when privacy mode is off. Privacy mode is on by default for new installations (Windows and Android 2.7.0, iOS 5.6.0, Linux 1.3.0 and later), so by default regional sites go through the VPN; installations from before those versions keep their previous setting. While privacy mode is off, the site and your internet provider see your real IP address for this traffic.
The apps also send update checks, update downloads and latency measurements to the servers outside the tunnel, and the Windows app resolves server host names through Cloudflare or Google DNS-over-HTTPS. In their default proxy mode the Windows and Linux apps do not cover apps that ignore the system proxy, the system DNS resolver, browser UDP traffic (QUIC/WebRTC) or IPv6; TUN mode covers them. Details: Security Whitepaper.
7. Sharing with third parties
We do not sell your data or share it for advertising. These parties receive data:
| Party | What it receives |
|---|---|
| A payment provider (only for customers who bought a paid plan) | Order number, amount, currency, plan description and payment method. Card or bank details are entered on the provider's page. We do not send your e-mail address or IP address. When you pay with Rialit (Shetab cards in Iran) we also send a fixed payer number tied to your account (not your e-mail address or name); Rialit uses it to offer your saved cards on later payments and for anti-money-laundering checks, and keeps your card details itself. |
| Resend (e-mail) | Your e-mail address and the content of account e-mails (codes, receipts). |
| Brevo (e-mail relay) | Replies sent from our support mailbox, including the recipient's address and the reply text. |
| Backblaze B2 (backup storage, EU Central, Amsterdam) | Encrypted copies of our database backups. Backblaze cannot read them: the decryption key is kept offline. |
| DeepSeek (Colitu Bot) | Your question and the last few messages of the bot conversation. No account details are sent, but anything you type is passed on. |
| Cloudflare | Hosts our DNS records and proxies docs.colitu.com (so it sees the IP addresses and requests of docs visitors). It also provides the default DNS resolvers in the apps and is the exit for a small, fixed set of domains on two VPN servers, where it sees the same metadata as a VPN server would. |
| Hosting providers | Run our servers and have technical access to them; server disks are not encrypted. |
When we receive a legally binding request we can only hand over data we hold, which is the data listed in section 3. We hold no traffic content or browsing history. Traffic volume records could show when an account was active on a server.
8. International transfers
The account database is on a server in Turkey. VPN servers are in the countries shown on the servers page, and the providers above may process data in other countries. Data is encrypted in transit, and access to our servers is limited to the Colitu team.
9. Security
- Passwords are hashed with Argon2id; they are never stored in plaintext.
- When you sign up or set a new password, we check whether it appears in known data breaches: only the first 5 characters of the password's SHA-1 hash are sent to Have I Been Pwned (Pwned Passwords); the password itself, its full hash, your e-mail address and your IP address are never sent. Sign-ups with temporary (disposable) e-mail addresses are refused; that check runs on our server against public domain lists, and no personal data is sent out.
- Connections to the website and API use TLS; the control plane and the VPN servers use mutual TLS.
- Payment, e-mail and AI provider credentials are encrypted in the database with AES-256-GCM. VPN connection credentials and server keys are currently stored unencrypted in the database; encrypting them is planned.
- The admin panel is on a separate address with role-based permissions and an audit log. Two-step verification (TOTP) is mandatory for admin accounts.
- Abuse checks store only HMAC-SHA256 hashes keyed with a server secret that is not stored in the database.
- Server disks are not encrypted, and there has been no independent security audit yet.
Full detail: Security Whitepaper.
10. Your rights
You have the right to access your personal data, to have it corrected or deleted, to object to processing and to receive a copy in a portable format. There is no self-service data export yet; we handle these requests manually. Write to privacy@colitu.com from your account's e-mail address so that we can verify you; you can also use the Support section of the app. We answer within 30 days. You can delete your account yourself (section 4).
11. Children
The Service is not intended for people under 16. If we learn that we process data of someone under that age, we delete the account and the data.
12. Cookies
The website uses only cookies needed for sign-in, security and your language choice, plus a few browser-storage entries for features such as Colitu Bot; on docs.colitu.com Cloudflare may set a security cookie. We use no advertising or tracking cookies. Details: Cookie Policy.
13. Changes
We may update this policy. We announce significant changes on the website or by e-mail before they take effect. The current version is always on this page.
14. Contact
Privacy questions: privacy@colitu.com. Security reports: security@colitu.com
Questions? Write to support@colitu.com.