What a VPN protects — and what it doesn't

If your safety depends on your connection, you deserve the exact boundaries.

What tocoro does

• Encrypts your traffic against whoever watches the network: your internet provider, the network at work, school, the café, the hotel. They see you use tocoro; they don't see what you do.
• Hides your real IP from the sites and services you visit — they see the server's, not yours.
• Helps get past blocking and throttling: censored sites and deliberately degraded connections. Our protocols are chosen for lossy networks and hostile environments.

What no VPN does

• It doesn't make you anonymous. Sites you log into know who you are, VPN or not. How you write, when you're online, and who you talk to also speak about you.
• It moves trust — it doesn't remove it. With a VPN, your provider stops seeing your traffic — and the VPN operator becomes able to. That's why tocoro is designed to know as little as possible, published in detail. But it's only honest to say it: you are trusting us with your traffic.
• It doesn't protect a seized or infected device. If someone has your unlocked phone — or has put spyware on it — a VPN changes nothing.
• It doesn't unpublish what you post. What you say under your name stays said.

If you're at high risk

For most people a VPN is enough and convenient. If a state is targeting you, add layers:

• Use Tor for the truly critical: it's slower, but anonymity is its specialty, not ours.
• Talk over Signal with disappearing messages.
• Keep your system updated and your device encrypted; use unique passwords and two-factor authentication.
• Think about your patterns. When you connect and with whom can say as much as what you say.

Free, specialized help

• Access Now — Digital Security Helpline — 24/7, for activists, journalists, and civil society.
• Front Line Defenders — Digital Protection — for human rights defenders.

Need tocoro and can't pay for it? Sponsored access program.

Our part

We minimize what we know about you (what we keep, exactly), we publish our commitments and every data request we receive (transparency), and every app release is published once, immutable and verifiable (verify your download). On the horizon: an external audit and opening the source, once the project can sustain it.