Help

Psiphon VPN keeps your internet connection private and helps you reach the open internet, wherever you are. Built by Psiphon Inc., which has been helping people connect since 2006, it is used by millions of people around the world. Psiphon is available across mobile and desktop, and it is open source.

When you connect, Psiphon routes your internet traffic through its global network of servers over an encrypted connection. This means the network you are on, such as your mobile carrier, your internet provider, or a public Wi-Fi hotspot, cannot see the sites you visit or the content you send and receive. It is the everyday privacy and security you expect from a VPN, whether you are at home or on untrusted Wi-Fi at an airport or caf\u00e9.

Psiphon is also built to keep working where access is restricted. It uses a range of connection methods and obfuscation techniques that make its traffic difficult to detect and block, so it can get through network filters and firewalls that would otherwise stand in the way. This is the same technology that has connected people in some of the most heavily censored parts of the world, and it is part of every Psiphon connection.

The result is a single app that protects your privacy on the network you are using and reaches the apps, sites, and services that matter to you, including those that might otherwise be unavailable.

The internet is a vast global network of interconnected computers and devices that constantly exchange information. When you send or request something online, that information does not travel in a single straight line. It is passed from one piece of networking equipment to the next, taking a series of hops across the network until it reaches its destination, and the response makes its way back to you the same way. Because the network is built with many overlapping routes, there is usually more than one path between any two points. If one route is unavailable, traffic can often reach its destination another way. Much of the equipment that carries this traffic is operated by Internet Service Providers (ISPs). Your ISP connects you to the wider internet and passes your traffic to and from the many other networks that make it up, typically as a paid service.

Any network that carries your traffic can potentially inspect it and decide what to allow. This can happen at many points along the way: at a country's international gateway, at an ISP, within an institution such as a company or school, and sometimes even on an individual device. To restrict specific kinds of traffic, a network first has to identify it. Equipment along the route can analyze the traffic passing through and, once it can tell one kind from another, make decisions about what to permit and what to block. This is how a network can allow ordinary browsing while blocking particular apps, sites, or services. When this kind of filtering is used to control what people can reach online, the actors carrying it out are often called censors. In some cases they act on their own, and in others they filter on behalf of another body, such as an ISP blocking content under government orders. In many parts of the world, this technical blocking shapes everyday internet use.

Psiphon belongs to a category of technology known as circumvention tools, which are designed to get around technical blocking online. These tools generally work in one of two ways: by routing traffic so it avoids the equipment that filters it, or by disguising traffic so it looks like ordinary traffic that is not subject to filtering. Psiphon does both, which is part of why it stays reachable in difficult network conditions. Filtering techniques keep advancing, so circumvention has to advance with them. Psiphon's methods are updated continually to keep access open as blocking grows more sophisticated. Alongside this, Psiphon works as a VPN, encrypting the connection between your device and its network so your traffic stays private on whatever network you are using. That combination, private on the network you are on and able to reach content that might otherwise be blocked, is what Psiphon is built to provide.

As a censorship circumvention tool, the Psiphon app's primary objective is to establish a connection to the internet. The Psiphon app attempts to connect to known Psiphon servers using various methods. Sometimes the Psiphon traffic is obfuscated, meaning that it is disguised to look like a different or less identifiable type of traffic.

Because it is encrypted, censors are unable to see the content of traffic passing through the tunnel. Censors may still attempt to block encrypted traffic based on other characteristics, such as communication protocols. Communication protocols are a set of rules used to route data and ensure it arrives at the intended location.

The Psiphon app has the ability to relay traffic through various communication protocols. It attempts to connect through different protocols until a connection is made. That way, if a censor is blocking one communication protocol, Psiphon is still able to connect by using another protocol.

To ensure that Psiphon's traffic is not identifiable, it is important to make it appear as generic and normal as possible to an external observer. The Psiphon app has the flexibility to adapt dynamically to changing network conditions by trying multiple strategies to connect, even when certain types of content or traffic are being filtered.

Psiphon, like other VPNs, sends your traffic through a secure, encrypted tunnel, so the network you are on cannot see what you are doing. What sets Psiphon apart is what it adds on top of that: it is built to keep working even where VPNs are actively blocked.

Most VPNs are designed for normal network conditions. They typically connect using standard protocols that a network can recognize, and they do little to hide the fact that a VPN is being used. That makes their traffic possible to identify, and therefore possible to block. A number of countries filter or slow VPN connections, and some have been observed blocking VPNs entirely around sensitive moments such as elections or protests. Modern censorship technology has made this kind of blocking relatively straightforward.

Psiphon is built differently. Alongside the secure tunnel, it disguises the nature of its traffic and where that traffic is going, so it is difficult to tell Psiphon apart from ordinary internet use. It can connect through a range of different protocols, each of which looks different on the network, and if one is blocked it can switch to another and stay connected. This resilience is designed to hold up even against deliberate attempts to interfere with the Psiphon network itself.

The result is a VPN you can rely on for everyday privacy and security, and one that keeps working in the places and moments where other tools stop. Psiphon connects where many other VPNs cannot.

At its core, every Psiphon connection runs an SSH session, which handles authentication and encryption. That SSH session is wrapped in an obfuscation layer applied over the handshake, transforming the traffic to defend against protocol fingerprinting and deep packet inspection. Rather than relying on a single fixed transport, the client varies how that connection is carried and obfuscated, selecting an approach dynamically based on the conditions in the user's network. This lets Psiphon evade a range of blocking techniques, including endpoint blocking and DPI-based blocking, and shift to whatever establishes and performs best where the user is.

Psiphon automatically discovers and connects to servers that are currently available. If the server you previously used is unavailable, blocked, under heavy load, or no longer offers the best connection, Psiphon may select another server.

Because each server has its own IP address, your public IP address may change when you reconnect or when Psiphon switches servers. Your apparent location may also change unless you select a specific region. This is normal and helps Psiphon maintain a reliable connection as network conditions and censorship measures change.

In some countries, a web address containing words such as "Psiphon" or "VPN" can make the site easier to identify and block. In more serious cases, an unprotected request to an obviously VPN-related domain may expose a user's circumvention activity to their network provider. To reduce this risk, links opened from the Psiphon app may use less recognizable addresses hosted on trusted infrastructure instead of a conventional Psiphon-branded domain. These addresses can look unusual, but the trade-off helps make Psiphon's content harder to identify and block.

No. Your connection to Psiphon is encrypted, so the traffic that passes through it is protected. Your Internet provider, and anyone else on your local network, cannot see the content of that traffic: the pages you visit, the messages you send, or the files you upload.

A few things are worth knowing so you can get the most out of that protection. Psiphon secures the traffic that travels through it, but it does not clear the browsing history, cookies, and other data that your browser and apps store locally on your device. If you share a device with others, clearing that data is a good habit. It also helps to stay connected to Psiphon while you browse, since anything sent before you connect or after you disconnect is not carried through the encrypted tunnel.

Like any VPN, Psiphon protects the privacy of your traffic but is not a full anonymity tool. In some cases, sophisticated observers may still be able to infer limited details about your activity.

Psiphon Browser for iOS is a browser-only application and so will only tunnel data that is loaded in the app itself, and will not tunnel your other apps (like your Instagram or X apps) through the Psiphon network. So, for example, if you wanted to use the Psiphon network to access your Instagram account, you would use Psiphon Browser to access the Instagram website. If you were to open your Instagram app, it would use your direct internet connection, and would not be tunneled through the Psiphon network.

The platforms we support are those available on the Download page. We are constantly working to expand our platform support, so hopefully we'll support your desired OS in the near future!

Get Psiphon

Psiphon applications are made available through multiple propagation strategies. If one method is blocked or unavailable in your country, there are other techniques you can use to obtain the app.

Android. Search for "Psiphon" in the Google Play store. Different regions may have different versions of Psiphon in the Google Play store.

iOS. Search for Psiphon in the App Store and click Get to download and install. You may be asked to re-enter your Apple ID and password. Find the Psiphon icon on your phone and tap it to open.

By email. Android and Windows versions of Psiphon are also available through an email responder. Send a blank email to get@psiphon3.com. Many email providers block executable attachments, so the file may not arrive.

Android. An email from noreply@psiphon3.com will arrive in your inbox momentarily. Check your spam folder if you don't see it in your inbox. Visit the download link or download the file PsiphonAndroid.ap_ attached to the email and rename it to have a .apk file extension, if necessary. Find the Psiphon icon on your phone and tap it to open.

Windows. An email from noreply@psiphon3.com will arrive in your inbox momentarily. Check your spam folder if you don't see it in your inbox. Download the file psiphon3 attached to the email and rename it to have a .exe file extension.

"Sideloading" means installing an app on your device without going through the Play Store. This is desirable for people who do not have access to the Play Store, or when the app is not available in their region.

If you cannot reach the Play Store, or Psiphon is not available there in your region, you can install the app directly from a download file (an APK) that you get from us. To do this, you give your device permission to install the app. On current versions of Android this permission is granted per app rather than through a single setting, and you usually do not need to find it in advance. When you open the downloaded file to install it, Android will ask whether to allow installations from the app you downloaded it with, such as your browser. Tap the option to open settings, turn on the permission for that app, then go back and finish installing.

If you would rather set it up manually first, the location depends on your device:

• On most phones (Pixel and stock Android): Settings > Apps > Special app access > Install unknown apps, then choose your browser or file manager and turn on "Allow from this source."
• On Samsung Galaxy devices: Settings > Security and Privacy > More security settings > Install unknown apps, then choose the app and turn on the permission.

The exact wording varies a little by manufacturer and Android version, but you are always looking for the "Install unknown apps" permission and granting it to the app you are installing from.

Psiphon 4 needs Android 7.0 or higher. As of October 2026, Psiphon does not support Android 4 to 6 with the current app. A legacy build of Psiphon 3 is available for download that will work on those versions for the foreseeable future, but it gets no further updates, so users are strongly encouraged to upgrade to a recent version of Android.

Psiphon offers different Android versions to keep the app accessible in as many regions as possible. Because Android recognizes these versions as separate apps, they can be installed on the same device and may both appear with the name "Psiphon."

The white icon is used for the Google Play version available in regions where subscription payments are not supported. It is also used for versions that can be downloaded and installed directly, known as sideloading.

The coloured icon identifies the Google Play version that supports subscription plans where they are available.

Both are official Psiphon apps and use the same core circumvention technology. You only need one for normal use, and only one can be connected as your VPN at a time.

Android. If you have installed Psiphon for Android through the Google Play Store, it will be automatically updated by the Play Store when an update is available. If you have sideloaded Psiphon for Android, the Psiphon client will download updates as they are available, and a notification will appear asking you to install the update.

iOS. It will be automatically updated by the App Store when an update is available.

Windows (Legacy). The Psiphon for Windows client will download and install updates as they are available.

Manually updating. If the Psiphon self-updating mechanism isn't working (for example, if it's been blocked), you can find information about getting a fresh copy of Psiphon from the Download page.

On Android and iOS, your Psiphon version number can be seen at the bottom of the settings panel.

Psiphon servers are located across the globe. The app automatically chooses the server with the best connection performance. There are more than 30 countries to choose from should you wish to change server location.

By default, the Psiphon app will automatically open in your selected device language (the language on your phone or computer). There are more than 20 languages available to choose from if you would prefer to use the Psiphon app in another language.

Under certain network conditions, Psiphon might take up to a few minutes before finding the best way to connect. Do not interrupt it by pressing the start or stop button.

Psiphon uses a variety of protocols and they differ regionally. Not only does the Psiphon app have a variety of connection techniques, it will learn from previous attempts and the successful connection method will be used the next time the app is run.

Use the latest version. The most current version of the Psiphon app has the most up to date connection capabilities, so update Psiphon whenever a new version is available. For how updates work on each platform, see Keeping Psiphon up to date.

If Psiphon is connected while an upgrade is installed, it may not be able to connect afterwards and will show the error start_tunnel_failed application is not prepared or revoked. This is due to an Android OS bug. This condition can be fixed by rebooting your device.

This is VPN On Demand doing its job. When it's enabled, iOS automatically restores the Psiphon VPN whenever the connection is interrupted, including when you switch the VPN off in Control Center, so your traffic is never left outside the tunnel.

It helps ensure that your internet traffic remains protected by automatically restoring the VPN whenever possible. It reduces the risk of your device sending data outside the encrypted VPN tunnel due to restarts, network changes, or unexpected VPN interruptions.

To disconnect, turn Psiphon off from inside the app rather than from the Control Center.

Outbound connections via the Psiphon network can only be made to a restricted set of server ports including: 53, 80, 443, 465, 587, 993, 995, 8080.

Mail clients cannot establish outbound connections on port 25.

Not directly. Psiphon protects the traffic of the device it is running on. When you share that device's connection with another one over a hotspot or tether (Wi-Fi, Bluetooth, or USB), the shared connection takes a separate path that does not pass through Psiphon. This is a limitation in how mobile operating systems handle hotspot and tethering, on both Android and iOS, and it is not something an app can change.

In practice, the connected device usually still reaches the internet, but its traffic is not protected by Psiphon. On some Android devices, the connected device may also have trouble connecting at all.

To protect another device, run Psiphon on that device directly rather than sharing the connection from your phone.

Psiphon includes malware detection, which notifies you if your tunnelled device attempts to communicate with IP addresses or domains documented to be involved with the distribution, or function of malware. If you receive an alert in the Psiphon app, traffic tunnelled through the Psiphon servers contacted, or attempted to contact, IP addresses or URLs associated with known malware.

How does Psiphon protect my device security?

Unfortunately, there are bad actors on the internet who have designed malicious applications and web services with intentions such as stealing user data, locking up your device and data, or using your device for other purposes without your consent.

Psiphon already protects your device from sending and receiving potentially malicious traffic. Once connected to the Psiphon network, your network traffic is tunnelled through Psiphon servers. These servers have been configured to identify malicious IP addresses or domains documented to be involved with the distribution, or function of malware, according to threat intelligence feeds updated daily.

When tunnelled, Psiphon servers are able to block these connections, and notify you in real time if a malicious connection is attempted.

Important: Psiphon is not scanning your device for malicious applications, nor is Psiphon able to remove malicious applications.

What should I do if malware is detected?

If you receive a Malware Detection Alert, be very cautious. Use a third party service to scan your device for malicious software before using it further.

There are many resources and applications available that contain additional information about prevention and mitigation of malware attacks. Security In A Box provides recommendations to protect your device from malware and what to do if malicious activity is detected.

Do I need to turn it on?

No. Malware detection is always on and there is nothing to configure. You will only see an alert if a connection is blocked.

How do I get the best coverage?

For the best performance on Android, use the "Tunnel all apps" option found under the "Split Tunneling" feature in the settings menu. This ensures that the network activity for applications installed on your device will also be tunnelled, and subject to network-level malware detection.

As of December 2019, Psiphon does not support Windows XP or Vista. A legacy build is available for download that will work on those platforms for the foreseeable future, but users are strongly encouraged to upgrade to a recent version of Windows.

As of April 2024, Psiphon does not support Windows 7, 8, or 8.1. A legacy build is available for download that will work on those platforms for the foreseeable future, but users are strongly encouraged to upgrade to a recent version of Windows.

When Psiphon starts, it displays the Client Version on the first line of log output.

Only in VPN mode. After a successful connection is established in VPN mode, your entire computer's traffic will pass through the Psiphon network. When VPN mode is not enabled only applications that use the local HTTP and SOCKS proxies will be proxied.

Psiphon uses the L2TP/IPsec VPN protocol.

Your network's firewall may not allow the use of VPNs. Your home router may not be configured to pass through this VPN protocol; check your firewall settings to see that IPsec or L2TP pass-through is enabled. Your system's IPsec Services may be disabled; check your service settings and enable these services to start automatically.

Certain networking hardware or Internet connections may cause performance problems for L2TP/IPsec which is the protocol used by Psiphon in VPN mode. Try disabling VPN mode.

When Psiphon for Windows connects it modifies your computer's proxy settings, and when it disconnects it restores them to their original state. If Psiphon for Windows does not exit properly, it may not properly restore the original proxy settings, and this will result in you being unable to connect to the Internet.

The easiest way to fix this for most people is to connect with Psiphon again, and then cleanly disconnect.

To manually fix your proxy settings, open Internet Explorer, then go to the Tools menu (or gear icon), Internet Options → Connections tab → LAN Settings button. Then remove the checkmark beside "Use a proxy server for your LAN".

Psiphon for Windows (Legacy) is never distributed as an installable package. Each Psiphon for Windows (Legacy) client is a single executable file (".exe") that is digitally signed by Psiphon Inc. Windows automatically checks this signature when you run the client. You can also manually inspect the signature before running the client by invoking the Properties dialog for the file and inspecting the Digital Signatures tab. The SHA1 thumbprint for the Psiphon Inc. certificate public key is displayed in the Certificate dialog Details tab.

For the certificate valid for the period 2026-06-28 to 2027-07-28 the SHA1 thumbprint is:

f9 30 b4 b4 3e bf 60 f2 6b 07 07 58 be 99 26 34 e5 f8 2f 7a

For the certificate valid for the period 2023-05-01 to 2026-07-28 the SHA1 thumbprint is:

1a 20 0c f5 cb 19 e7 2b fc cf 02 17 fd 4d 78 33 81 2d 3a 42

For the certificate valid for the period 2020-09-09 to 2023-11-02 the SHA1 thumbprint is:

07 89 b3 5f d5 c2 ef 81 42 e6 aa e3 b5 8f ff 14 e4 f1 31 36

For the certificate valid for the period 2017-07-05 to 2020-10-03 the SHA1 thumbprint is:

89 fd cd 09 65 f4 dd 89 2b 25 7c 04 d5 b4 14 c7 ac 2b 5f 56

For the certificate valid for the period 2014-05-08 to 2017-09-06 the SHA1 thumbprint is:

9b a0 bd 1c e4 ca f6 20 41 0d 46 47 ae 40 b0 7c 83 c7 31 99

For the certificate valid for the period 2012-05-21 to 2014-07-30 the SHA1 thumbprint is:

84 c5 13 5b 13 d1 53 96 7e 88 c9 13 86 0e 83 ee ef 48 8e 91

For the certificate valid for the period 2011-06-16 to 2012-06-21 the SHA1 thumbprint is:

8f b7 ef bd 20 a9 20 3a 38 37 08 a2 1e 0a 1d 2e ad 7b ee 6d

Psiphon for Windows auto-updates itself, and this process automatically verifies that each update is authentic.

The first thing to check is that you have an authentic copy of Psiphon. If it is not authentic, please send us an email with information about how you obtained the copy and, if possible, with the Psiphon executable attached.

If your copy of Psiphon is authentic, then this is an instance of a false positive report. Although most antivirus/firewall programs have added Psiphon's digital signature to their whitelist rules, some may still erroneously identify Psiphon's executable file as a virus or threat. In this case, please send us an email, specifying the AV/firewall program you use, and we will contact the AV/firewall vendor to solve the problem.

Yes. Check your browser settings and make sure that it is configured to use the system proxy settings.

Psiphon Windows (Legacy) will automatically configure your system to use a local HTTP/HTTPS proxy and a local SOCKS proxy. The port numbers for these proxies are chosen randomly, unless specified in the Psiphon settings. Windows applications that use the System Proxy Settings will automatically be proxied. You may manually configure other applications to use these local proxies. Both Psiphon for Windows and Psiphon for Android run these local proxies.

Click Run, and type regedit to open the Registry Editor. Find and open HKEY_CURRENT_USER\Software\Psiphon3, and on the right side you will see SkipProxySettings. Set this value to 1 and Psiphon will not automatically configure the system proxy settings.

Psiphon for Windows stores some data locally under the user's profile. It is located at a path like C:\Users\YourName\AppData\Local\Psiphon3; or, more generally, %USERPROFILE%\AppData\Local. You can delete the local data by going to that path in Windows Explorer and deleting it, or entering this command at a command prompt: rmdir /s "%USERPROFILE%\AppData\Local". There is also information stored in the system registry at HKEY_CURRENT_USER\SOFTWARE\Psiphon3. You can use the Windows regedit tool to delete those registry keys.

Psiphon for Windows (Legacy) does not get installed, and won't appear in Windows' "Add or Remove Programs" list. The executable file can be run from your "Downloads" directory, or it can be copied to a different directory and run from there. If you want to remove the program, you can simply delete the executable file.

The automatic update process in Psiphon for Windows (Legacy) renames its old version to psiphon3.exe.orig. Old files with the ".orig" suffix can safely be deleted.

This error will occur on Windows XP if Internet Explorer 6 is installed. Psiphon for Windows requires Internet Explorer 7 or higher to be installed. The best way to install higher versions of Internet Explorer is via Windows Update.

If you can't use Windows Update and want to install Internet Explorer 7 or Internet Explorer 8 directly, you can get them via these links:

• Internet Explorer 8 for Windows XP (64-bit)
• Internet Explorer 7 for Windows XP (64-bit)

For general questions, or anything not covered in the Help Hub, email us at help@psiphon.ca.

If you continue to experience connection problems, send us feedback from within the Psiphon app. Open Send Feedback, and include any details that may help us understand the problem. You can also add a contact email if you would like us to follow up.

Your report includes diagnostic data that helps us investigate connection failures and performance issues.

Android: If it has been less than 48 hours since you made the purchase, you can get a refund through the Play Store. After 48 hours, email us at refund+android@psiphon.ca. Please include your name, the email address of your Play Store account, the date of the purchase, what was purchased, the amount of the purchase, and the reason you are requesting the refund.

iOS and macOS: Please request the refund through the App Store.

Please see our security.txt file for contact information and details.

Psiphon is one of the most widely used censorship circumvention tools in the world. For close to two decades, people have relied on it to reach news and services, and to stay in touch with friends and family, when their networks try to block access.

Many of those people live under conditions where simply reaching the open internet can draw attention, and where surveillance is real and growing. That is the most important reason we do not collect personally identifiable information about our users. We do not know who you are, and we are not interested in finding out. There is no account to create and no identity to verify, and nothing in our systems ties a connection back to a person.

Staying ahead of censorship is difficult, and it gets harder as blocking methods grow more advanced. What keeps Psiphon resilient is our ability to see how the network is behaving and adapt to it. The operational data we collect, none of which identifies anyone, is the backbone of that work. It shows us where connections are failing, which methods are being blocked, and how conditions are shifting, so we can respond and keep people connected. The same visibility keeps the network fast and reliable for everyone who uses Psiphon, whether to get around blocking or simply as an everyday VPN. For example, when Brazil blocked WhatsApp and when Turkey blocked social media, usage surged as much as 20x within a day. Watching for shifts like these is how we see blocking happen and respond to it. Collecting this limited, non-identifying data is not at odds with protecting our users. It is part of how we protect them.

In short, we collect a small amount of non-identifying network data about how Psiphon is performing, and nothing about who you are or what you do online. Specifically:

• we do not log your IP address;
• we do not record the sites and services you connect to, or the content of your traffic;
• we do collect network and session statistics that help us run the service and counter censorship.

A few principles guide us:

• We collect only what we need to keep Psiphon working against censorship, and nothing that identifies you.
• We are specific about what we collect and how long we keep it, rather than hiding behind broad categories.
• Because Psiphon's core services are open source, you can verify these claims in the code rather than take our word for them: Psiphon-tunnel-core, Psiphon-automation, Psiphon-windows, Psiphon-android, Psiphon-ios-vpn.

A VPN cannot make you anonymous, and we will not pretend otherwise. What Psiphon can do is keep your connection open and unreadable to the networks between you and the site you are visiting, while knowing as little about you as possible. The rest of this section explains, in detail, what that means for your data.

There are three kinds of data to describe: what we never collect, the operational data we do collect, and data you choose to send us.

What we never collect:

• Your IP address. It is never written to a log or a database. During a connection it is used briefly, in memory, to look up your approximate region and to protect the network from abuse, and then it is discarded.
• The services you access. We do not record the websites, applications or services you connect to.
• The content of your traffic. What you send and receive through Psiphon is not stored.

Operational data we collect. To run the network and respond to censorship, we collect a small amount of data that does not identify you:

• Approximate location. When you connect, we derive a coarse location from your IP address (your country, and your city) along with your internet provider, for example New York City on Verizon, and then discard the IP address. We keep this coarse location and provider, never the address itself.
• Session statistics, such as how long a connection lasted, how much data moved, and which protocol carried it.
• Technical details about the connection: your Psiphon client version, the platform you are on, how you obtained Psiphon, and which of our servers you connected to. None of these identify you.

We use this to keep the network fast and reliable, monitor the network, respond to censorship, and improve the service. It is deleted on a rolling 90-day schedule, with the limited exceptions described under "Data retention and deletion" below. Aggregated statistics that cannot identify anyone are kept longer.

We do not share user-specific data. We share aggregated, anonymized statistics with sponsors, partner organizations, and researchers who study internet freedom. Concretely, here is how one connection becomes a statistic we can safely share:

• One connection (kept up to 90 days): a connection from New York City, on Comcast, lasted two hours and moved 300 MB in total.
• Aggregated: that day, 250 connections from New York City on Xfinity moved 500 GB in total. Individual records become counts that are no longer tied to any one connection.
• Shared only when it cannot single anyone out: if 500 connections came from New York City, we may share that city-level figure. If only 2 came from Los Angeles, we do not share at city level; those are counted only in the US total, because two people are too few to anonymize.

Data you choose to send:

• Diagnostic feedback is optional. If you send it, it is encrypted on your device first. See "Diagnostic and feedback data" below.
• Subscription information comes from the Apple App Store or Google Play when you subscribe. We receive an identifier to confirm your subscription is active. We do not see your payment details.

We do not log your IP address. It is never written to a log, a database, or any other storage.

When you connect, your IP is used for two things, both in memory and neither stored:

• Region lookup. We translate your IP into an approximate location so we can understand where the network is being used and blocked. We keep the region and discard the address.
• Network protection. For a short period of time, your IP is used in memory to limit load and defend against attacks. It is not kept and cannot be recovered afterward.

One thing worth noting, separate from the VPN itself: our website uses Cloudflare to deliver pages, and Cloudflare's analytics record visitors' IP addresses under its own privacy policy. That is ordinary for any website and has nothing to do with the Psiphon service, which does not log your IP.

We do not record the websites you visit. That means no full URLs, paths, query parameters, cookies, request or response headers, or the contents of your requests. None of it is captured or stored.

It is worth being precise about what passes through our servers:

• Encrypted (HTTPS) traffic, which is most of the web today, is encrypted between your device and the site you are visiting. Psiphon carries it but cannot read it.
• Unencrypted (HTTP) traffic is sent in the clear by the website itself, so it passes through our servers the way it would through any network. We do not inspect it and we do not store it.

What our servers can see is the same however you run Psiphon. How much of your device's traffic goes through the tunnel is a separate question, covered under "Connection security" below.

Looking up a domain (turning example.com into a network address) is just part of your traffic, and Psiphon tunnels it like everything else. We don't log the domains you look up.

Those lookups are resolved by third-party DNS services, which can see the domain names but not who you are; the requests reach them through Psiphon, not from your own IP address.

If something goes wrong, you can choose to send us a diagnostic report from inside the app. This is the one place where more detailed information can leave your device, so we want to be clear about it. It is optional and never automatic.

Before a report leaves your device it is encrypted (RSA-4096 key wrapping with AES-128-CBC and an HMAC-SHA256 integrity check). It is uploaded to storage we run on AWS as an encrypted package, so AWS cannot read it, and we decrypt it only on our own systems.

What it contains. Fields differ slightly by platform; an iOS report is representative:

• Your message, plus an optional email address if you add one so we can reply.
• A log of Psiphon's recent activity (connection events, errors, and timestamps). This is the main diagnostic content and can run to hundreds of entries. It is truncated if very long.
• App and build details, such as the Psiphon version and build you are running.
• Distribution identifiers (a sponsor ID and a propagation channel ID) that show how and where you obtained Psiphon. These identify the distribution, not you.
• Device and system details, such as your device type (for example, iPhone, not an exact model or serial number), operating system and version, interface language, network type (for example, Wi-Fi), and whether the device is jailbroken or rooted.

Worth knowing: taken together, the details in a report can be specific enough to tell one device from another, and two reports from the same device could be linked. If you add an optional email address so we can reply, it is stored with the report. For these reasons we treat feedback very carefully, and we suggest sending only what you are comfortable with.

No hidden crash reporting. We do not use Sentry or any similar automatic crash-reporting tool, and we do not collect activity telemetry from the app in the background. A crash may prompt you to send feedback, but sending is always your choice. Any crash information collected by the app stores or your operating system is handled by Apple, Google, or Microsoft, not by us.

We keep operational data only as long as we need it.

• Connection data. Raw operational data is stored in our analytics database and deleted on a rolling 90-day schedule. When a significant censorship event happens, we may keep a filtered subset of this network data for that event beyond the usual 90 days, sometimes indefinitely, so it can be studied in detail later. This is how we understand and counter large-scale blocking. When we do this, we publish an entry in our Privacy Bulletin describing what was retained, why, and for how long.
• Aggregated statistics. These are counts and trends that cannot be traced back to any individual or connection. We keep them indefinitely because comparing data across longer periods of time helps us understand how censorship changes over time and share those trends with sponsors and researchers who study it.
• Backups. Backups and other processes may extend the time some data exists. We take reasonable steps to keep those periods bounded and minimal.
• Diagnostic feedback. Reports, including any optional email address you include with them, may be kept indefinitely. They help us identify and fix problems that affect many people. Older reports can also help us recognize patterns months later, especially when a previously seen blocking technique reappears. If you included an email address, you can ask us to delete your report at any time by contacting privacy@psiphon.ca.
• Website and discovery logs. Access logging for the storage that hosts our download pages and server lists is turned off.
• Email auto-responder logs. When you email our auto-responder for download links, we can see your email address. Your message is saved to the server's disk while it is processed and deleted as soon as the reply is sent, usually within seconds, and your address may appear in system logs that are deleted after one week. The responder is hosted on Amazon Web Services, so Amazon can see your message and our reply. For each request we also keep when it arrived, when it was answered, its size, and the general domain of the sending mail server, for example ne1.example.com rather than web120113.mail.ne1.example.com.

Here's how Psiphon protects your connection.

Ciphers. The tunnel uses strong, modern authenticated encryption: AES-GCM, ChaCha20-Poly1305, or AES-CTR. Which one is used is varied on purpose, because looking the same every time would make Psiphon easier to detect and block.

Key exchange and forward secrecy. Key exchange uses ephemeral Diffie-Hellman, ECDH, or Curve25519, again varied for the same reason. All of these provide forward secrecy, so a recorded session cannot be decrypted later even if a long-term key were exposed.

Server authentication. Your client checks it is connecting to a genuine Psiphon server using pinned public keys delivered through trusted channels, so it cannot be steered to an impostor.

Obfuscation. Psiphon disguises its traffic to get past blocking. That is a circumvention measure, not an added layer of secrecy, and we do not describe it as one. The security of your data comes from the encryption above.

We would rather be straightforward about what protects you and what does not.

Kill switch. Psiphon does not yet have a built-in kill switch for now, however you can get the same effect using built-in operating system settings:

• Android: turn on "Always-on VPN" and "Block connections without VPN" in system settings. Psiphon links you to that screen.
• iOS: use the "Connect on demand" system setting.
• Windows (Legacy): this is not available.

If the connection drops. On every platform, your traffic is paused while Psiphon tries to reconnect. It does not quietly fall back to an unprotected connection. Apps that respect the system proxy stay covered through a reconnection.

Leak protection:

• IPv6: Psiphon protects against IPv6 leaks. On Android it blocks all IPv6 traffic while the VPN is active.
• WebRTC: not a concern on full-device Android and iOS. It is a known issue in the standalone Psiphon Browser for iOS and in Psiphon 3 for Windows (legacy).

Subscriptions. Paid plans are sold through the Apple App Store and Google Play. We do not process your payment and do not see your card details. To confirm a subscription is active, our purchase verifier handles the store's transaction identifiers and receipt data and logs non-identifying details such as your region, platform, client version, and how you obtained Psiphon. If you arrive through an install link, we may record a non-identifying campaign source.

Ads. The free version shows ads through Google AdMob, which operates under its own privacy policy. See "Third-party services and data processors" below.

We use a few outside services. Each operates under its own privacy policy, and we note any change to this list in the Privacy Bulletin.

• Amazon Web Services — infrastructure, backups, and encrypted feedback intake. Stores data we place there; feedback arrives encrypted and is unreadable to AWS.
• Google AdMob — ads for free-tier users (Android and iOS). Operates under Google's policy, which governs ad data.
• Google Analytics — website usage statistics. Website analytics only.
• Cloudflare — website content delivery and analytics. Sees website visitor IPs; analytics kept about 7 days under Cloudflare's policy.
• Apple App Store / Google Play — app distribution and subscriptions. Collect install and purchase data under their own policies.

When you get Psiphon through a platform like Google Play or the App Store, that platform collects and stores data under its own policy, not ours.

Psiphon Inc. is a Canadian company based in Toronto, Ontario, and we operate under Canadian law.

We receive roughly 20 requests for user data each year, and we have complied with none of them. We hold no data that ties a connection to a person, so there is nothing to hand over. Canadian law lets us ask a court to revoke or narrow a production order before we comply, and we use that to challenge requests we consider overbroad or unlawful. Canada has no equivalent of a US national security letter; where gag orders exist, they are issued by a court, not administratively.

Psiphon's software is open source and available for public review. We also commission independent security audits and publish the results. You can find the latest reports and open source libraries in our Trust Center.

Transparency also means being clear about Psiphon's purpose and limitations. Psiphon is designed primarily to circumvent internet censorship; it is not an anonymity tool. Our policies explain what information we collect, why we collect it, and what Psiphon can and cannot protect.

EU (GDPR). Because Psiphon needs no account and holds no data that identifies you, in almost all cases there is no personal data attributable to you for us to provide, correct, or delete. That is by design. If you have sent optional diagnostic feedback and want to ask about it, contact privacy@psiphon.ca.

California (CCPA). Psiphon does not collect personal information about app users — there's no account, and nothing in our systems identifies you. We do not sell or share personal information. Because of this, there is effectively no personal information for us to disclose, delete, or stop selling at your request.

Children. The Services are not intended for anyone under 18, or under the age of majority where they live. Because we do not collect personal information from users, we also do not knowingly collect personal information from anyone below that age.

Questions about anything here: privacy@psiphon.ca