Privacy and Acceptable Use Policy

Effective Date: 20.02.2026

At Amnezia, we prioritize the privacy and security of your data above all else. We strive to collect the minimum amount of personal data and remain transparent about what data we collect and why. This Privacy Policy describes how we collect, use, and protect your information, and it complies with applicable data protection laws, including the General Data Protection Regulation (GDPR).

1. What We Offer and How It Works

Amnezia provides functionality for creating a VPN on your own server, as well as ready-made VPN services available in the AmneziaVPN application.

1.1 Self-Hosted VPN Setup

A user can set up their own VPN server by entering server access details (IP, login, password/key) into the AmneziaVPN client. We do not collect, store, or transmit these details—they remain only on the user’s device.

1.2 Amnezia Free

A user can obtain a VPN configuration (key) in two ways:

• Via the Telegram bot – when using the bot, we only collect the user’s Telegram ID for identification;
• Via the AmneziaVPN application.

When connecting to AmneziaFree, we collect:

• The application version and operating system (for internal statistics);
• A device ID (to link keys to the device and enable their recovery);

When connecting to AmneziaFree, we also process IP addresses. This is necessary solely to determine the regions where blocking occurs and to ensure correct server operation. The IP is not stored or used for identification.

If a user engages in actions that harm the service (for example, spam, DDoS), Amnezia may temporarily store the IP address to prevent abuse and protect the infrastructure.

1.3 Amnezia Premium

When purchasing a subscription through https://pay.amnezia.org, we collect only the user's email address. The user's IP address may be transmitted to the payment gateway by the https://pay.amnezia.org site when necessary, but it is not stored. After connecting to Amnezia Premium through the application, we collect:

• The application version and operating system (for internal analytics);
• A device ID (to link keys to the device);

Users' IP addresses are not collected or stored. The exception is temporary logging in cases of violations that harm the service, using servers for spam distribution, DDoS attacks, or traffic abuse.

1.4 Amnezia Affiliate (Partner and Referral Program)

Under our affiliate program, we collect:

• An email (user identifier);
• A cryptocurrency wallet (for commission payouts);

1.5 Websites (amnezia.org, docs.amnezia.org)

On the amnezia.org website, we use:

• Language cookies;
• Anonymized statistical data (visits, referral sources, downloads, user regions, and devices);

These data are collected via self-hosted Matomo, Plausible and Cloudflare Insights. The data are anonymized and cannot be used to identify the user. When submitting the form at https://hurgaknc-bsccljbcrq-ez.a.run.app/business, we collect:

• Email;
• Company name;
• Number of employees;

These data are processed through the Web3Forms service. For more details, see their privacy policy. On the docs.amnezia.org website, only a cookie for the interface language is used.

2. What Data We Collect and Why

2.1 Data Provided by the User

• Email – for communication, subscription, or affiliate payouts;
• Company name and number of employees – when filling out the business form;
• Cryptocurrency wallet – for affiliate payouts;

2.2 Data Collected Automatically

• Telegram ID – for issuing AmneziaFree configurations;

• Device ID and operating system – for key functionality and internal statistics;

• Application version – for compatibility and improvements;

• IP address – processed temporarily:

  • For analyzing blockages (AmneziaFree);
  • For preventing violations (in cases of abuse and for protecting Amnezia’s infrastructure and services);

2.3 What Data We Do Not Collect

We do not collect or store information about VPN usage (traffic, visited websites, etc.). We do not receive data from third-party authorizations (Google and others) as we do not use such login methods.

3. How We Use Data

We use data solely for:

• Providing access to our services;
• Maintaining and improving service stability;
• Communicating with users at their request;
• Processing payments and payouts;
• Preventing abuse and attacks;
• Analyzing anonymized statistics to improve the product;
• VPN traffic and activity are not used for analytics or advertising;
• sending offers and product news (you can unsubscribe at any time by clicking the link in the email or by contacting us). VPN traffic and activity are not used for analytics or advertising.

4. Transfer of Data to Third Parties:

We do not transfer your data to third parties, except in the following cases:

We do not transfer your data to third parties, except in the following cases:

• data submitted through the business form at https://hurgaknc-bsccljbcrq-ez.a.run.app/business are transferred to the Web3Forms service (see their privacy policy);
• data provided through the https://pay.amnezia.org/ may be transmitted directly to payment providers during checkout (such as the user’s email address and IP address, where required by the payment processor);
• authorized government authorities only upon a valid, official, and lawful request, and only to the extent required by applicable law. Only requests submitted through official legal channels (for example, pursuant to a court order, a request from a competent governmental authority, or within the framework of an international legal assistance procedure) are considered legally valid. We comply only with requests that are consistent with the laws of Romania and the European Union. Requests from foreign authorities without proper legal basis in Romania or the EU cannot be fulfilled. We adhere to a strict no-logs policy and do not store connection logs, traffic data, or VPN session metadata. Therefore, we are technically unable to provide information about which user was connected to a specific server at a particular time. No other data is transferred to third parties.

5. Cookies and Analytics

We use cookies only for the proper functioning of the websites:

• Language settings (cookies);
• Anonymized analytics via Plausible (self-hosted) and Cloudflare Insights; Only aggregated statistical data are collected. We do not track users’ personal activities. You can disable cookies in your browser settings—this will not affect access to the functionality.

6. Security

We implement modern technical, organizational, and physical security measures to prevent unauthorized access, alteration, or loss of data. The service infrastructure is built using decentralized elements, reducing reliance on a single point of failure and increasing overall network resilience. Access to systems and data is granted strictly based on a role-based model and the principle of least privilege, ensuring clear separation of permissions and minimizing internal risks. All critical components undergo regular security checks, monitoring, and audits to maintain a high level of protection and user confidentiality.

7. International Data Transfer

Sometimes data may be transferred outside the EEA. In such cases, we:

• Use Standard Contractual Clauses (SCC) approved by the European Commission;
• Employ data minimization, encryption, and anonymization; You can contact us for more details.

8. Data Retention

We store data only as long as it is necessary to provide our services or as required by law. After that, the data are deleted or anonymized.

9. Your Rights

You have the right to:

• Access your data;
• Correct or delete your data;
• Withdraw your consent;
• Restrict or object to processing;
• File a complaint with a supervisory authority; To exercise your rights, email us at privacy@amnezia.org.

10. Children

Our services are not intended for individuals under 16 years of age. If we become aware that a child has provided us with personal data, we will delete them immediately. Parents or guardians can contact us directly.

11. Limitation of Liability

Our services are provided “as is” and “as available.” We make no express or implied warranties regarding uninterrupted operation, speed, security, or fitness for any particular purpose. Amnezia is not liable for:

• any indirect or consequential losses, including loss of profit or data;
• service disruptions caused by external factors, technical limitations, or actions of third parties; consequences arising from the use of the service for purposes that violate applicable law. To the extent permitted by law, our liability is limited to the minimum extent required by applicable legislation. Nothing in this Policy excludes or limits liability where such exclusion or limitation is prohibited by law (for example, in cases of intent or gross negligence).

11.1 Acceptable Use

Users agree to use the VPN service only for lawful purposes and not to engage in:

• illegal activities (such as hacking, malware distribution, or fraud);
• sending spam, phishing, or deceptive messages;
• distributing, storing, or transmitting prohibited content (including content that infringes copyrights);
• attacks on networks or services of third parties (such as DDoS); actions that harm other users, our infrastructure, or our partners. We do not keep activity logs, monitor, or record user traffic. However, if we receive credible abuse notifications (for example, from hosting providers, network operators, or copyright holders), we may take necessary measures to protect our infrastructure and comply with legal requirements.

11.2 Content and Third-Party Resources

Amnezia is not responsible for materials posted or transmitted by users or third parties through our services. We do not continuously monitor or control such content but may take action where required or permitted by law. Amnezia is also not responsible for the content of third-party websites linked from our resources; such links are provided solely for user convenience.

12. Updates

This Policy may be updated from time to time. All changes will be posted on this page with a new effective date.

13. Our details

ANARCHY LAB S.R.L. is responsible for personal data processing as the data controller. Company is registered in Romania under registration number J2026000670007, address: Bucureşti, Sector 3, Bulevardul Unirii, No. 61, Bl. F3, Staircase 4, Floor 2, Apt. 208, Romania.

If you have any questions about our Privacy Policy, please contact the data controller at privacy@amnezia.org.