Key takeaways
Define the log categories
Separate account identifiers, payment references, support messages, authentication events, connection timestamps, source IP data, assigned endpoints, bandwidth counters, DNS queries, and traffic content. A no-log VPN can use the phrase while retaining some categories for billing or security.
Read the policy for each field. Look for purpose, retention, access, processors, and deletion. A blanket statement without definitions cannot support a privacy comparison.
Understand the VLESS privacy boundary
Xray-core implements VLESS at The profile defines a proxy route and authentication data. It does not impose a provider database schema or retention policy.
Traffic leaving the server remains protected by application encryption such as HTTPS where used. The server operator controls infrastructure and can observe operational signals. A private VLESS VPN therefore requires trust in software, configuration, and operator practice.
Review evidence and governance
Check the provider identity, privacy contact, policy version, update history, legal jurisdiction, subprocessors, security controls, and response process. Independent audits can add evidence only when scope, date, system, and findings are public.
Do not treat a logo, protocol name, or unsupported "military-grade" phrase as proof. Compare the stated policy with product needs such as device counters, support, and abuse handling.
Protect the user side
Use current clients from or protect the device, and keep profiles private. A provider policy cannot protect a key exposed in a screenshot or a phone infected before encryption.
Use HTTPS, strong passwords, and multi-factor authentication. Clear shared clipboards after import. Rotate the profile after disclosure and review active account sessions.
Create a repeatable privacy scorecard
Score account, payment, support, network-operation, DNS, and traffic categories separately. Mark unknown fields as unknown rather than assuming zero collection. Add retention, deletion, security, and disclosure columns.
Recheck the policy before renewal. VPN privacy terms and infrastructure can change. Save the policy date and link, not a permanent conclusion based on one reading.
Trace each privacy statement to evidence and an owner
Turn the policy into a data inventory rather than one no-log checkbox. For account, payment, support, authentication, connection, DNS, traffic, and device data, record the named fields, purpose, storage location, retention trigger, recipients, deletion path, and team that controls the system. If the policy does not answer a field, mark it unresolved; do not infer absence from silence.
Separate evidence types. describes protocol implementation, while and document client software. Those projects cannot verify a provider's production databases, payment processor, support exports, administrator access, or response to legal demands. Provider-specific claims need the current privacy policy, product behavior, processor disclosures, and an audit or other evidence whose scope includes the system being discussed.
Compare statements with visible features. A device limit implies some enforcement state, a support history implies message retention, and an invoice implies payment records even when traffic content is not stored. A mismatch is a question for the provider, not proof of misconduct or proof of no collection. Preserve the policy version and review date so later changes can be identified.
Document residual privacy risk before choosing a provider
Write a short threat model for the person using the service. Local-network observation, provider access, payment linkage, destination tracking, device compromise, and account takeover require different controls. VLESS changes a network route; it does not erase browser cookies, destination accounts, transaction records, or malware already present on the device.
For each unresolved data category, decide whether the task can proceed, needs a mitigating action, or requires another service model. Mitigations may include a separate profile per device, shorter retention requested through account deletion, reduced support disclosure, stronger device security, or self-hosting when the operator can manage it responsibly. Do not describe any option as anonymous without a bounded definition and supporting evidence.
Recheck the inventory after a policy update, new payment method, account feature, client telemetry change, or infrastructure migration. Record corrections openly. A credible privacy conclusion states what was verified, what source supported it, what remains unknown, and the date through which the conclusion applies.
Continue reading