Transparency
How tocoro runs, what sustains it, and every data request we receive. Last updated: July 2026.
Who runs this
tocoro is an independent project: no ad investors, no data sales, no hidden parent companies. We don't publish who operates it — the same protection we build for you, applied to the person who maintains it. What we do publish is what matters: what we keep, how the service is sustained, and every data request we receive.
How it's sustained
tocoro's real cost isn't the servers: it's development and maintenance time. Subscriptions fund that work, the infrastructure, and the sponsored access program.
Protocols
Shadowsocks-2022 and Hysteria2, with automatic switching between them. Chosen for a concrete reason: they perform on packet-loss networks and resist detection and throttling better than classic VPN protocols.
Data requests
| Period | Requests received | Data handed over |
|---|---|---|
| Since July 2026 | 0 | — |
This counter updates with every legal request we receive. We can only hand over what exists: what we keep, exactly.
Commitments
- No analytics or trackers, on the site or in the app.
- Every app release is published once, immutable, with a verifiable fingerprint (verify your download).
- Policy changes are announced with a date, here and in the app.
- The security page lists what tocoro can't protect, alongside what it can.
On the horizon
- More server locations, as demand grows.
- An independent security audit, once the project can sustain it.
- Opening the source, evaluated after the audit.