Tripod VPN Privacy Policy

Effective date: 18 October 2026

1. Responsibility and scope

1.1. Tripod Networks Inc. (Tripod, we, us or our) is responsible for personal information under its control in providing Tripod VPN, its account facilities, connection configurations and support, and the Tripod websites under tripod.sh that refer to this Policy (the Service). Personal Information means information about an identifiable individual, including information that can reasonably be linked to an individual. Our Privacy Officer is identified in section 12.

1.2. A Customer is the individual or organization contracting for the Service. A Plan is the applicable service offering; a Free Plan is supplied without charge, a Paid Plan is any other Plan. An Enterprise Customer obtains the Service for authorized users through an organization-managed account. This Policy applies to individual and organization-managed accounts, free or paid.

1.3. For account administration, security, transactions, sanctions screening and our own legal obligations, Tripod determines the purposes of processing. For particular enterprise activities we may process information on the Enterprise Customer’s documented instructions, under the enterprise terms. Responsibilities depend on the activity, not the account label. Enterprise Customers must give their users the notices the law requires.

1.4. Independently operated clients, destination websites and external identity or payment services have their own privacy practices. Their independence does not remove our responsibility for information processed on our behalf.

2. Information and sources

2.1. We process the information relevant to the functions you use:

2.2. Payments. The checkout identifies the payment provider and the payment information it collects; card numbers are handled by the provider, not stored by Tripod. Where cryptocurrency is accepted, transaction identifiers and payment addresses may be linked to an account; public blockchain records are not anonymous merely because they omit a name and cannot be erased by Tripod.

2.3. Support material. Attachments you supply may contain IP addresses, destinations or other sensitive details. Supply only what is relevant; never passwords, complete configuration links or unrelated browsing records. We ask only for what is reasonably needed.

2.4. Authentication and operational records. Login and security events may include the account identifier, source IP address, event time, result and browser or device information. Operational records describe service errors, administrative actions and their outcomes. These records contain no customer destination histories, credentials or authentication tokens. Retention is described in section 8.

3. Traffic handling and usage amounts

3.1. Information in transit. To carry traffic and apply routing rules, the Service handles source and destination addresses, ports, protocols, account-linked connection identifiers and timing. Available protocol information, including exposed hostnames, may be examined to route or block a connection. Traffic protected by end-to-end encryption stays encrypted between its endpoints; the VPN does not make otherwise unencrypted traffic end-to-end encrypted. We do not inspect the content of your traffic.

3.2. Destination information. We do not keep a history of successfully forwarded customer destinations or an archive of traffic content. Blocked destinations may be recorded under section 4. Information you supply in a support request is handled under sections 2.3 and 8. The Service is not represented as anonymous or as retaining no logs of any kind.

3.3. DNS and destinations. Domain Name System resolvers receive the queried domain and the address of the system making the query. Destination services receive the traffic sent to them, normally showing Tripod’s exit address. Information you give a destination, such as a login, can identify you independently. Traffic or DNS requests routed outside the Service expose your ordinary connection address. Independent network services keep records under their own policies.

3.4. Usage accounting. Successful Traffic means successfully forwarded customer traffic, excluding sign-in, configuration downloads and automatic connectivity checks. We keep aggregate traffic amounts and concurrent-connection counts associated with the account and the applicable usage period for data allowances, device limits, refund verification and protection against misuse. These totals contain no source or destination addresses and no per-connection history. The Plan explains what counts toward its allowance and when it resets.

3.5. Account-linked totals are Personal Information, not anonymous statistics. They are collected independently of Blocked-Destination Diagnostics and remain necessary when a Customer opts out of that feature. An absent or incomplete meter is not treated as proof that traffic did or did not flow.

4. Blocked-Destination Diagnostics

4.1. Purpose and fields. Blocked-Destination Diagnostics record connection attempts rejected by routing or filtering rules. They help investigate access problems, assess routing, protect the Service and its users, and let authorized tenant administrators understand blocked activity. A record can include the account or user identifier, tenant, destination domain or IP address, server, blocking reason, attempt count and recorded times. Collection is limited to those fields; source addresses and ports are not retained, and content never is.

4.2. Sensitivity. These are identifiable destination records, not anonymous traffic statistics, and may reveal sensitive interests. A blocked attempt does not establish that a person viewed the destination or intentionally requested it. We do not use these records to build a history of successful browsing, and we do not copy them into ordinary error logs.

4.3. Consent and controls. The feature may be available on Free, Paid and enterprise Plans. Where the law requires consent, we ask for it before collecting anything, separately from other terms; general acceptance of the Terms of Service, or receipt of a Free Plan, is not that consent. Paid-Plan Customers, including Enterprise Customers, may opt out for their accounts at any time by contacting the Privacy Officer. Opting out stops new collection for the affected account; it does not stop the usage accounting in section 3.4. Organization-managed users are told which administrative controls apply and may contact us about their own rights; administrator instructions do not override those rights.

4.4. Readers. Access is limited to Tripod’s founder and authorized support personnel who need it for the disclosed purposes, and to the relevant tenant’s authorized administrators. Ordinary members do not read other users’ records. An Enterprise Customer may keep its own exports under its own responsibilities; our retention rules do not govern a copy it independently holds.

4.5. Existing records and Plan changes. Opting out stops new collection rather than erasing earlier records, which expire under section 8 unless you ask us to delete them sooner. We explain any change to diagnostic controls before a Plan transition takes effect and obtain any renewed consent the law requires. A failed payment, expired Plan or missing entitlement does not by itself authorize new collection.

5. Purposes, authority and use restrictions

5.1. We use Personal Information to provide requested connectivity and support; administer accounts, Plans, allowances, device limits and payments; maintain security and address fraud, abuse or misuse; screen against sanctions lists; send necessary account, transaction and security notices; and fulfil privacy requests and legal obligations. Blocked-Destination Diagnostics are limited to the purposes in section 4. Information collected for one purpose is not used for an unrelated one without notice and, where required, consent.

5.2. We obtain consent where the law requires it and explain which information is necessary for a requested function. Necessary processing rests on implied consent; optional or sensitive processing rests on express consent. Where the EU or UK General Data Protection Regulation applies, the grounds are performance of a contract; compliance with a legal obligation; legitimate interests in necessary and proportionate security, administration and fault resolution, subject to your rights and interests; or consent where required.

5.3. Use restrictions. We do not sell customer information, use it for advertising or advertising profiles, or use or permit its use to train artificial-intelligence models. Technical support may involve automated analysis, but we do not submit customer information to an artificial-intelligence service unless its terms, settings and handling comply with this Policy’s purpose, security, retention and no-training requirements. If we run a referral program, its cookies identify the referring partner for commission purposes only, are disclosed before they are set, and are not used to profile you.

5.4. Automated checks apply account permissions, sanctions screening and disclosed Plan and traffic limits. You may challenge an error and ask for human review. These checks do not independently authorize a purchase. We provide the explanation and safeguards the law requires for any qualifying automated decision.

6. Recipients and international processing

6.1. Providers. Hosting, network, storage, identity, payment, sanctions-screening, email, security and communications providers receive the information needed for their functions. Operational logs and metrics are processed on our own monitoring server in the European Union; they may carry the account email address and the connection user name. Browser error and performance reports from our web applications are processed by Sentry; they may carry the account identity. Both are kept for 30 days. We remain accountable for processing on our behalf and use contractual and other safeguards. A provider’s independent legal or payment functions are distinct from its work on our instructions.

6.2. Enterprise accounts. An Enterprise Customer receives the account, membership, configuration and usage information necessary to administer its Service. Diagnostic access is limited as described in section 4. We may coordinate requests concerning information processed on an organization’s behalf with that organization while addressing information for which we are independently responsible.

6.3. Legal disclosures. We may disclose relevant information where a binding legal obligation requires it or a specific legal exception permits it, such as a qualifying emergency or a lawful production or preservation order. We assess the authority and scope of every request; a private complaint or an authority’s request does not itself justify unrestricted disclosure. We notify affected individuals where the law permits and it is practicable. Preservation obligations concern information we already hold; they do not require us to create records.

6.4. Business transactions. Information may be disclosed in a proposed or completed business transaction only under the conditions the law sets, including necessity, safeguards, restricted use, return or destruction where the transaction does not proceed, and notice after completion. This is not permission to sell a customer database.

6.5. Locations and safeguards. The Service uses globally distributed infrastructure. Information may be processed outside Canada and outside your province or country, including through remote administration, and while it is in another country it may be accessible to the courts, law-enforcement and national-security authorities of that country under its laws. Choosing an exit-server location does not choose where account, payment or support information is processed. We do not promise Canadian-only storage. We apply the transfer safeguards, agreements and assessments the law requires, and use a recognized transfer mechanism where one is required. Information about processing locations and safeguards is available from the Privacy Officer.

7. Browser storage and optional tools

7.1. Account interfaces use browser session storage for sign-in state and session tokens. Browser restoration can extend a storage session; closing a tab does not necessarily end a separate identity-provider session or revoke connection credentials. Sign-in services may also use authentication cookies.

7.2. Browser local storage retains interface preferences such as appearance, navigation and refresh settings. You can clear or restrict browser storage, which may interrupt sign-in or reset settings. Where a technology requires prior consent, browser controls alone do not replace it.

7.3. We use no analytics, advertising or tracking cookies. Before introducing website analytics, diagnostic uploads or referral cookies, we disclose the information, purposes, recipients, retention and choices involved and obtain any consent the law requires, including the consent that applies to storing information on your device where you are. Account registration is not consent to promotional messages; any optional marketing we send carries sender identification and a working unsubscribe, and we stop within the period the law sets.

8. Retention and deletion

8.1. Principle. We keep Personal Information only as long as its disclosed purpose or a specific legal requirement needs it, then delete it or reduce it to a form that no longer identifies you. Our internal retention schedule sets a maximum period for each category below; the current period for any category is available on request from the Privacy Officer.

8.2. Short-lived records. Blocked-Destination Diagnostics are kept only as long as needed to troubleshoot the blocked attempt and are deleted on a short rolling schedule measured from each attempt; a later attempt does not extend an earlier record. Login and security events are kept as long as needed to detect and investigate unauthorized access, then deleted. Other operational and error logs, including the operational logs and Sentry records in section 6.1, are kept for at most 30 days, then deleted. Copying a record into a support ticket or another system does not extend these periods.

8.3. Usage totals. Aggregate traffic amounts are kept for the applicable usage period and for the time needed to verify a refund request or resolve a payment dispute for that period, then deleted. We do not keep an indefinite account-activity archive.

8.4. Other records. Account, credential and configuration information is kept while needed to administer the account, then deleted or reduced. Transaction and tax records are kept for the periods that financial and tax law require, in Canada where the law requires; this does not justify keeping unrelated traffic records. Support correspondence is kept to resolve the matter and for necessary follow-up or claims handling. Notice, consent and request records are kept as needed to respect and substantiate the choices and obligations in effect.

8.5. Specific preservation. A legal obligation, a valid preservation demand or order, a pending access request or a necessary investigation or claim can require particular information to be kept longer. We limit that information to the particular purpose, restrict access to it, review the need and delete it when the ground ends. Where Canadian law requires it, we keep a record of each breach of security safeguards for at least 24 months after determining that the breach occurred; that record does not require keeping the underlying logs.

8.6. Closure and remaining copies. You may request account closure and deletion through section 12, together with cancellation of renewal. We explain what we retain and why, subject to lawful restrictions. Deleted information may remain in access-restricted backups until their scheduled expiry and is not returned to ordinary use if a backup is restored. Closing a Service account does not close an independently held identity-provider account or erase an organization’s own records.

8.7. We treat information as anonymous only when no individual can reasonably be identified from it. Hashing, substituting an identifier or combining traffic amounts does not by itself meet that standard.

9. Safeguards and incidents

9.1. We use organizational and technical safeguards appropriate to the sensitivity of the information, including restricted access, authentication, credential protection and controls over transmission and storage. No company can guarantee absolute security; that does not reduce our obligation to maintain appropriate safeguards. Protect your account and connection credentials and report a suspected compromise to us.

9.2. We assess suspected breaches, keep the required records and make legally required reports and notifications. Where Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) requires notice of a breach presenting a real risk of significant harm, we act as soon as feasible after determining that it occurred. Other applicable reporting deadlines remain effective.

10. Individual rights and complaints

10.1. You may ask for access to information about you and an account of its use and disclosure, correction, withdrawal of consent, or deletion where applicable. Where the governing law provides them, you may also object to processing, restrict it, receive your information in a portable form or ask for review of a qualifying automated decision. Rights are subject to lawful exceptions; there is no unconditional entitlement to erase every record.

10.2. Verification and limits. We verify identity and authority before acting, normally through the signed-in account or the registered contact address, and do not routinely ask for government identification or account secrets. An authorized representative may act where the law permits. We may refuse a request only on a ground the law allows, and we explain the ground and your recourse. We may charge a fee only where the law permits and only after telling you the approximate cost and confirming that you wish to proceed.

10.3. Timing. Where PIPEDA applies, we respond to an access request within 30 days unless a lawful extension applies and we have given the required notice. Other applicable deadlines govern where the law requires.

10.4. Consequences. Withdrawing consent does not make earlier lawful processing unlawful. If we cannot provide a function without particular information, we explain the effect. Withdrawal from optional processing does not cancel a Paid Plan. Deleting your records may prevent us from verifying a later refund request or recovering a lost account; we tell you this before acting.

10.5. Complaints. You may complain to our Privacy Officer or to a competent privacy regulator without first exhausting an internal process. The Office of the Privacy Commissioner of Canada can be contacted at https://www.priv.gc.ca/. Where EU or UK data-protection law applies, you may also complain to the competent supervisory authority under that law.

11. Age eligibility and Policy changes

11.1. The Service is intended for adults aged at least 18 or the applicable age of majority if higher. If we learn that information has been collected from an ineligible user, we assess the circumstances, restrict inappropriate processing and take the deletion or other action the law requires.

11.2. We identify this Policy’s effective date and notify affected users directly of material changes, by email for accounts with an email address and in the account portal otherwise. Any additional notice or consent that new processing requires is provided or obtained beforehand. A revision does not retroactively authorize an undisclosed purpose or cancel an opt-out. Continued use is not treated as consent where a separate affirmative choice is required.

12. Privacy contact

Privacy Officer, Tripod Networks Inc.
Privacy requests and complaints: privacy@tripod.sh
Business address: 151 Charles St W, Suite 100, Kitchener ON N2G 1H6, Canada

Customer service and cancellation contacts are listed in the Terms of Service. Abuse and copyright concerns may be sent to abuse@tripod.sh.