Privacy policy
This is a draft and will change. Before the final version takes effect, it will be announced on this site and in the anoni.net newsletter.
Last updated: 2026-10-29
Vessel is made up of the portal (vessel.anoni.net) and nodes in several cities, and keeps only the data the service needs to run.
What we keep
| Data | Purpose | How long |
|---|---|---|
| A hash of the account number (Argon2id), which cannot be turned back into the number | Checking it at sign-in | Until the account is deleted |
| The account's creation date and the last day it opened the portal (day only) | Deciding when devices expire | Until the account is deleted |
| A hash of each invite code, the date it was redeemed and the account that redeemed it | Making sure each code is used once | The link to the account is removed when the account is deleted; the code's record is kept for now, and the final version will set a limit |
| Each device's name, public key, city, tunnel IP address, DNS filter option, expiry date, and whether it has ever connected (yes or no only) | Letting the node recognize the device and listing it for you | Until the device is deleted or expires |
| The account's monthly traffic total | Counting the allowance | Until the account is deleted |
| Each device's traffic this month, and how many lookups the malware filter blocked (a count only, no names) | Helping you notice something wrong with a device | Until the month ends or the device is deleted |
| Daily totals per city: how many devices connected that day, the traffic, and how many devices expired (totals only, not tied to any account or device) | Understanding how the service is used and how much the nodes can take | 400 days |
| A hash of the sign-in session | Keeping you signed in | Until you sign out, or after 30 days without opening the portal |
You choose the device names, so please avoid your real name or anything that identifies you.
Your browser also keeps a few settings: whether it has signed in before (so a reload shows “My devices” at once), the language you picked, whether you closed the bar that offers another language, and whether you chose in the footer not to be counted in the statistics. They stay in your browser and are never sent to the server.
What we do not keep
- Email addresses, phone numbers or any other contact details
- Device private keys. They are generated in your browser and never sent to our servers
- Which sites you visit, or when you connect
- Your IP address. Neither the portal nor the API keeps access logs, and the connection check only compares it with the Vessel nodes' addresses at that moment
- DNS queries. The node's resolvers do not log them
What a node handles while you are connected
While you are connected, the node holds your current IP address in memory, since it needs it to send data back to you. It also handles the domains and IP addresses you connect to, but not the contents of HTTPS connections. This exists only in memory while you are connected, and is never written to disk or to any log.
During the test the terms forbid P2P file sharing, but connections are not blocked. To decide whether blocking will be needed, each node counts how many of the first few packets of each connection look like BitTorrent (an unencrypted handshake, a DHT query, a tracker request). Only the node's total is kept: nothing per device, and no record of where connections come from or go.
DNS filtering
When creating a device you can choose to block malicious sites and ads. Filtering happens on the node's resolver, which does not log what it blocks. Blocking malicious sites uses HaGeZi's Threat Intelligence Feeds (mini), and blocking ads adds HaGeZi Multi (Normal). The lists are updated every 8 hours and published on HaGeZi's GitHub.
Statistics
Views of public pages, and the result of each step of redeeming, signing in and creating a device, go to the Umami instance anoni.net hosts, so problems along the way show up. Each record holds only the page path, the language, the screen size rounded to hundreds and the step's result. Account numbers, device names and settings, and keys are never sent. Umami works out the country and city from the IP address but does not keep the address.
Nothing is sent when your browser has Do Not Track or Global Privacy Control turned on, and you can turn it off in the footer.
What you send from the feedback page is stored on the form server anoni.net runs itself, with only the country and browser type of the submission, not your IP address, and it is never linked to your Vessel account. Contact details you leave are deleted once we are done.
Third parties that handle data
- Cloudflare: the portal goes through Cloudflare, which can see visitors' IP addresses and the pages they view, under Cloudflare's privacy policy. Cloudflare's analytics script is turned off for the portal. Cloudflare's Page Shield adds a reporting policy to a sample of pages, so the browser reports the scripts the page loads and the addresses it connects to back to Cloudflare, to detect injected malicious scripts. The reports hold addresses, not anything you type. VPN connections do not go through Cloudflare
- DigitalOcean: the Singapore node runs on DigitalOcean servers. As the network provider it can see traffic in and out of the node, but cannot decrypt the connections
- Vultr: the Tokyo node runs on Vultr servers, which can see the same as DigitalOcean
- Amazon SES: invite codes for the test are sent with the newsletter, so the mail service handles their contents. The list of which subscriber got which code is deleted after sending, so the portal's database cannot tell which account came from which subscriber
Backups
The database is backed up daily, and backups are kept for 14 days. Deleted data stays in backups for that period before it is gone. The key used to hash account numbers is stored separately from the database backups.
Requests from law enforcement
We can only provide what is listed under “What we keep”. With no connection logs, we cannot trace an exit IP address and a time to an account.
Deleting your account
You can delete your account at any time on the account page. The account, its devices, its monthly traffic and its sessions are deleted together, and copies in backups are gone within 14 days.
Changes to this policy
We have no way to contact you, so changes are announced on the Vessel site and in the anoni.net newsletter.
Contact
The anoni.net anonymous network community: [email protected]