Law Enforcement Requests

This page explains how Ghostunnel handles requests for user data from law enforcement and other authorities, and — just as importantly — what data we simply do not have. It is part of our General Privacy Policy.

1. Our approach

We respect the rule of law and the privacy of our users. We disclose user data only in response to valid legal process that is binding on [ENTITY NAME] under [GOVERNING LAW]. We review every request for legal validity and scope, and we push back on requests that are unlawful, overly broad or unclear.

2. What we cannot provide

Our systems are built not to keep this information, so we cannot produce it under any request:

• the websites, apps or content a user accessed through the VPN;
• DNS lookups;
• a history of a user's connections — when they connected, for how long, to which server, or how much data each session used;
• the IP address a user connected from;
• which user was using one of our IP addresses at a given time.

A request that asks us to identify who was behind one of our IP addresses at a particular moment cannot be answered: many users share our server addresses, and we keep no record that links them.

3. What we may provide

If we receive valid legal process for a specific account, the data we could produce is limited to:

• the account's email address, name (if the user added one), and when it was created;
• plan, subscription and billing status, and invoices — payment details themselves are held by our payment processor, Stripe;
• the names, platforms and app versions of the account's registered devices;
• only for a tunnel that is connected at the time of the request: the server it is connected to and when it was connected. Once released, this record no longer exists.

4. What a request must include

• The requesting authority, the case reference and the legal basis for the request.
• The specific account it concerns, identified by email address.
• The specific data requested, limited to what the investigation needs.
• Legal process issued or recognized under [GOVERNING LAW]. Requests from other countries generally need to go through an international legal assistance process.

5. Notifying users

We will tell the affected user about a request before disclosing their data, so they can seek legal advice, unless the law or a court order forbids it, or notice would create a risk of death or serious harm.

6. Emergencies

If we believe in good faith that there is an imminent risk of death or serious physical injury, we may voluntarily disclose the limited data described above without waiting for legal process. Emergency requests must explain the nature of the emergency.

7. How to send a request

Send requests to [email protected] or by post to [ENTITY NAME], [REGISTERED ADDRESS]. Reports of abuse of our network, such as copyright or spam complaints, go to [email protected] — see our Acceptable Use Policy.

8. Transparency

We intend to publish a periodic transparency report showing the number of requests we receive and how we responded to them.