Last Updated: March 31, 2026
Psiphon Inc. ("Psiphon", "we", "us", or "our") is committed to protecting user privacy. This Privacy Policy explains how the Psiphon Conduit App (the "App"), including the Hosted Conduit feature, collects, uses, processes, and discloses information. By using the App or subscribing to Hosted Conduit, you agree to this Privacy Policy. Psiphon Inc. is incorporated in Canada, with its head office in Ontario. This Privacy Policy is designed to comply with applicable privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA), and, where applicable, the General Data Protection Regulation (GDPR) and other international laws.
The App provides two modes of operation:
Runs locally on a user's device and allows the device to act as a relay within the Psiphon Network.
A subscription-based feature providing always-on, cloud-hosted relay infrastructure operated by Psiphon on the user's behalf.
When a user subscribes: • Relay servers are provisioned in third-party cloud environments • Infrastructure operates independently of the user's device • Service includes: • A public relay supporting general Psiphon users • A private relay accessible via Personal Pairing Hosted relays remain active for the duration of the subscription and may be subject to blocking, throttling, or disruption by network operators or third parties.
Psiphon is designed to minimize data collection. We do not collect or store information about user browsing activity, content of communications, or specific websites visited.
We do not collect personally identifiable information (PII) from users operating Standard Conduit. We may process the following limited technical data:
Random Conduit Station Identifier A randomly generated identifier used for network performance monitoring. It cannot be used to identify an individual.
IP Address (Ephemeral Use) Used transiently for coarse GeoIP analysis and routing purposes. This information is not retained or logged.
Diagnostic Logs (Optional) If enabled by the user, logs may include technical performance data. These logs: • Do not intentionally include PII • Are voluntarily submitted • Can be disabled at any time
Network Performance Data Includes bandwidth usage, connection success/failure, and related metrics. This data is aggregated and not associated with identifiable users.
Hosted Conduit requires limited additional data processing necessary to operate a persistent, cloud-based service.
Authentication is handled by third-party identity providers (e.g., Apple, Google) via Clerk. Psiphon: • Does not store passwords or maintain credential systems • Does not directly store user email addresses • Receives limited data such as: • Unique user identifiers • Authentication tokens This information is used solely to: • Authenticate users • Link accounts to subscriptions • Provision and manage hosted infrastructure
Payments are processed through third-party platforms: • Apple App Store • Google Play • RevenueCat (subscription management) Psiphon does not collect or store: • Payment card details • Billing addresses Psiphon may receive limited subscription-related data, including: • Purchase status • Product identifiers • Entitlement status This data is used exclusively for subscription validation and service provisioning.
To operate network infrastructure, limited technical metadata may be processed, including: • IP addresses • Connection timestamps • Routing and protocol metadata This information is: • Used for routing, performance, abuse prevention, and system integrity • Not used to identify users • Not used to analyze content or behavior
Because Hosted Conduit runs continuously in cloud environments: • System-level logs and operational metrics may be generated • These may include uptime data, resource utilization, and error logs These logs are used strictly for: • Reliability • Scaling • Security They are not used to track individual users or inspect traffic content. Cloud providers may independently generate logs in accordance with their own privacy policies.
This feature allows users to share private relay access via a shareable identifier. Important limitations: • Psiphon does not provide subscriber visibility into individual users connecting through the relay • Only aggregate or real-time connection metrics may be displayed • Concurrent connection limits are enforced to maintain system stability
All traffic relayed through Conduit (standard and hosted): • Is end-to-end encrypted • Is not visible to: • Conduit operators • Hosted Conduit subscribers Psiphon does not log or inspect: • Websites visited • Messages or communications • Files or content Psiphon systems process only the minimum technical information required to route traffic.
We use limited collected data solely to: • Operate and maintain the Psiphon Network • Provision and manage Hosted Conduit infrastructure • Authenticate users • Validate subscriptions and enforce access control • Monitor performance and reliability • Detect abuse, fraud, or security threats • Improve system functionality We do not use data for: • Advertising • Profiling • Selling user data
We do not sell personal information. We may disclose limited data:
To trusted third parties acting on our behalf: • Clerk (authentication) • RevenueCat (subscriptions) • Cloud infrastructure providers These providers are required to process data in accordance with applicable laws and contractual obligations.
We may disclose information where required to comply with applicable laws, regulations, legal processes, or enforceable governmental requests.
We may share anonymized and aggregated data that does not identify individuals for analytical and operational purposes.
Psiphon operates globally. Data may be processed in multiple jurisdictions, including outside Canada. We implement safeguards such as: • Contractual protections • Data minimization • Technical security controls Where applicable, transfers comply with PIPEDA, GDPR, and similar frameworks.
We retain data only as long as necessary for legitimate operational, security, and legal purposes.
Diagnostic Logs Retained for up to 90 days, then deleted.
Operational Data • Aggregated and de-identified • Raw data is deleted after aggregation where feasible
Hosted Conduit Accounts • Infrastructure is deprovisioned upon subscription termination • Limited identifiers may be retained for account continuity and fraud prevention
We implement industry-standard safeguards, including: • Encryption in transit • Access controls and least-privilege practices • Infrastructure isolation • Monitoring and security reviews Authentication and payment systems are handled by specialized providers.
Standard Conduit No PII is collected; therefore, access or deletion requests are generally not applicable.
Hosted Conduit Users may request: • Access to personal data • Correction of inaccuracies • Deletion, where applicable Requests may be submitted to: conduit@psiphon.ca Users may also manage account data via their identity provider or app store. Users in the EEA may have additional rights under GDPR.
The App is not directed to individuals under 16. We do not knowingly collect personal data from children.
Third-party platforms (e.g., app stores, identity providers) may collect data independently. Users should review their respective privacy policies.
We may update this Privacy Policy periodically. Updates will be made available: • Within the App • On our website: psiphon.ca
Email: conduit@psiphon.ca
By using the App or subscribing to Hosted Conduit, you acknowledge and agree to this Privacy Policy.
