Tocoro VPN

Privacy policy

Last updated: August 8, 2026.

Who we are

Tocoro VPN is a service operated by Svex Labs LLC, a Florida limited liability company ("Tocoro VPN", "we"). Contact: [email protected].

The principle

We can't expose, sell, or hand over data that doesn't exist. The entire service is designed to know as little as possible about you, and this policy describes exactly that minimum — in plain language, because a policy no one understands protects no one.

What we keep

  • Your account number. Random, generated by the app. It contains and requires no information about you.
  • Your subscription's expiry date.
  • Total data usage per account. How much you transfer in total, to operate and size the service. Never which sites, never from where.
  • Redeemed prepaid codes. Which code was redeemed on which account, to prevent fraud.
  • If you claim the free plan: a keyed hash of your Telegram account's numeric ID. It exists so each Telegram account can claim one free plan per 30-day period — which is also why it outlives a deleted account until that period ends. It can't be turned back into your ID, and we never store your username, phone, or messages with the bot. We check channel membership only at the moment you claim; we can't re-check it afterward — that's why renewal is manual.
  • A recovery email — only if you add one. It's optional and you can delete it at any time without touching your account: in the app, Account → Recovery email → Remove.
  • If you pay by card (Stripe) or QvaPay: the processor knows your payment details under its own policy; we keep a reference — amount, date, months credited, and which account or gift code it went to. If you'd rather no payment be linked to you, redeem a code someone else bought.
  • Minimal technical logs to detect errors and service abuse (never your browsing activity), automatically deleted within days, not months.

What we don't keep

  • Your name, address, or phone number — we don't ask for them.
  • Browsing history or the content of your traffic.
  • DNS queries.
  • Logs linking your IP address to your activity or your account.
  • Device fingerprints, advertising identifiers, usage analytics.

Where the data lives

Accounts and subscriptions live on our backend in the USA (Hetzner). Your VPN traffic flows through nodes in the location you choose (today: USA, Mexico, or Spain), encrypted, and is stored nowhere.

Retention and deletion

  • Your data exists for as long as your account does.
  • Deleting your account from the app erases the number, the expiry date, the recovery email and the usage counters. If a free plan was running, the Telegram hash outlives the account until that 30-day period ends, then it is deleted too — otherwise deleting an account would hand out a fresh gigabyte on demand. It keeps no link to the deleted account: what is left is the hash and a date.
  • Accounts expired for more than 12 months are deleted automatically.
  • Payment references are kept only as long as accounting law requires.

Deleting your account

In the app: Account → Delete account. It takes effect immediately and erases everything in the "What we keep" list — the account number, the expiry date, the recovery email, the usage counters. Two things survive: payment references, for as long as accounting law requires, and — if a free plan was running — the Telegram hash, until that 30-day period ends, so that deleting an account is not a way to claim another free gigabyte. Neither still points at your account. Deletion is permanent: the account number cannot be recovered, and remaining service time is lost.

If you no longer have the app installed, email [email protected] with your account number and we'll delete the account within 30 days.

Third parties we use

Vultr (VPN nodes: USA, Mexico, Spain) · Hetzner (backend, USA) · Stripe (card payments) · QvaPay (payments) · ZeptoMail (recovery email delivery, only if you set one up). None of them receives your browsing activity. We use no analytics or advertising providers — there are no third parties beyond these.

Legal requests

We respond only to valid legal demands, and only with what exists — the "What we keep" list above. We publish a count of requests received at /transparency.

Changes

We'll publish any change on this page with its date. Substantial changes are additionally announced inside the app before taking effect.

Contact

Questions about this policy: [email protected].