Privacy Policy
Last updated 13 November 2026.
PrivShift is a VPN service operated by JL Miratek LLC. This policy explains what we collect, why, how long we keep it and the choices you have.
What we collect
- Account: your email address and a salted hash of your password. We never store your password itself.
- Billing: Stripe processes your payment details. We keep Stripe's customer and subscription references, your plan, its status and billing history, and the country you declare at checkout.
- Devices: the device's name, which the PrivShift app takes from your computer's name, the device's WireGuard public key and the VPN address assigned to it. Your WireGuard private key is created on your device and never leaves it.
- Service operation: aggregate health of our servers (CPU, memory, bandwidth, peer counts, latency, jitter, packet loss) and sanitized error codes.
- Legal records: which version of our Terms and Acceptable Use Policy you accepted, when, and whether at signup or checkout; and, if you send them, your arbitration opt-out or a dispute notice, with its date.
- Support messages: when you use the contact form on our Support page, the reply address you enter, the topic you choose and your message, so our support staff can answer you. We do not store your IP address with it and do not link it to an account.
What we do not collect
We do not log or store the websites you visit, destination addresses or URLs, DNS queries or the content of your traffic. We do not record your IP address with your sign-ins or acceptances.
How we use it
To provide the service, bill you, secure your account, answer support requests and meet legal obligations. We do not sell personal data and do not use it for advertising.
Retention
Account data is kept while your account exists. Billing records are kept for as long as accounting and tax law requires. Once your account is deleted they are pseudonymised, not anonymised: they keep your account's internal ID and Stripe's customer and subscription references, and Stripe's own customer record also carries that ID, so they can still be linked to you through Stripe while they are kept. Sign-in tokens expire and are deleted on a fixed schedule. Support messages sent through the contact form are deleted 180 days after we receive them, or earlier if you ask us to delete them. Our data map lists every data set and its retention period. Backups age out within the documented backup period; we do not edit backups, and a restore re-applies completed deletions before service resumes. Arbitration opt-outs and dispute notices, with the email address they came from, are kept while your account exists and for 6 years after we receive them or after our yearly check finds that your account has been deleted, whichever is later, so we can show which dispute rule applies to you; we delete them at the first yearly check after that period.
Your choices and rights
You can delete your account at any time from Account > Security > Delete account. Deletion cancels your subscription immediately, revokes your devices and sessions, and removes your email and password. You can ask for a copy or correction of your data through support. Website analytics are off unless you opt in on the Privacy choices page.
Privacy requests
To ask for access to, a copy of, correction of or deletion of your personal data, email privacy@privshift.com or use the contact form on our Support page. To protect your account, we verify your identity before acting, normally by asking you to confirm the request from the email address on your account or while signed in; we ask only for what we need to verify you. We respond within 45 days. If we need more time, we may extend this once by up to 45 more days, and we will tell you within the first 45 days why we need it. If we decline your request in whole or in part, we explain why. You can appeal a decision by replying to it or emailing privacy@privshift.com with "Appeal" in the subject; we answer an appeal within 45 days and tell you the result and our reasons. If you are not satisfied with the result of an appeal, you may contact your state attorney general.
Children
PrivShift is not directed to anyone under 18, and you must be 18 or older to create an account. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we delete that data and close the account.
Do Not Track and Global Privacy Control
We do not track you across other websites, and website analytics are off unless you opt in. Because there is no cross-site tracking to switch off, our website does not change its behaviour when your browser sends a Do Not Track signal. We treat a browser Global Privacy Control signal as a refusal of optional analytics.
Processors and transfers
We use the service providers listed in our Subprocessor List. Some process data outside your country; where the law requires it, we use approved transfer safeguards.
Changes to this policy
When we change this policy we publish the new version with its date on this page. Earlier versions are available on request from legal@privshift.com. For a material change, we also tell customers by email or with a notice when they sign in before the change takes effect.
Contact
privacy@privshift.com