Privacy Policy

Last updated: July 2026

This Privacy Policy explains what information Kabayan VPN collects, why, and how it's handled. We built this service to give people a private, secure connection — protecting your privacy is the point, not an afterthought.

1. Information We Collect

Account information: When you sign up, we collect your email address and a securely hashed password, handled through our authentication provider, Supabase.

Payment information: We never see or store your card details. Payments made via GCash or other supported methods are processed by PayMongo according to their own privacy policy and applicable payment industry standards. If you pay via direct GCash transfer, we only see the transaction reference you provide us, not your GCash account details.

VPN connection data: We do not log, monitor, or store the content of your internet traffic — what sites you visit, what you download, or what you do while connected is not recorded or reviewed by us. Our VPN server retains minimal technical data (such as connection timestamps) only where necessary to operate, maintain, and troubleshoot the Service, and this data is never sold or shared with third parties.

2. How We Use Information

• To create and manage your account;
• To provision and maintain your VPN access;
• To process payments and manage subscriptions (via PayMongo, for GCash and other supported methods);
• To respond to support requests;
• To detect and prevent abuse of the Service.

3. Third-Party Services

We rely on a small number of trusted providers to run Kabayan VPN:

• Supabase — authentication and account data storage
• PayMongo — payment processing for GCash and other supported local payment methods
• Railway — application hosting
• AWS — VPN server infrastructure

Each of these providers processes data according to their own privacy policies, in addition to this one.

4. Data Retention

We retain your account information for as long as your account is active. If you cancel your subscription, your VPN certificate is immediately revoked. You can request full account deletion at any time by contacting us.

5. Your Rights

Depending on your location, you may have rights to access, correct, or delete your personal data, or to object to certain processing. Contact us to exercise these rights.

6. Security

We use industry-standard practices to protect your data, including encrypted connections (TLS) for all traffic to our website and API, and encrypted VPN tunnels for your connection traffic. No system is perfectly secure, but protecting your privacy is core to why this service exists.

7. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

8. Contact

Questions about this policy or your data? Reach out via the contact details provided on our website.