ExpressVPN is committed to protecting your privacy. We want you to understand what information we collect, what we don’t collect, and how we collect, use, and store information. We do not collect or log browsing history, the destination or contents of your traffic, IP addresses used to connect to the VPN, or DNS queries.
Our guiding principle towards data collection is to only collect the minimal data required to operate a world-class VPN service at scale. We designed our systems to not have sensitive data about our customers; even when compelled we cannot provide data that we do not possess.
ExpressVPN collects four types of information:
(i) Information related to your account ("personal information")
This information is collected for the purpose of administering your ExpressVPN subscription, and includes your name, email address, and payment information, which you submit on our order page when you subscribe for the Services.
(ii) Aggregate Apps and VPN connection summary statistics
The section below describes in detail which information we collect. These statistics never include anything about what the user did with the VPN: no data about the contents or destinations of VPN traffic, no DNS queries, and no IP addresses.
(iii) (User-controlled option): Anonymous VPN connection diagnostics and crash reports
VPN connection diagnostics are anonymized and cannot be tied back to individual ExpressVPN users. This feature is similar to a “send bug report” option. Users choose whether to participate in this feature when installing our apps, and can toggle this on/off at any time.
(iv) Only for users who choose to use the MediaStreamer service: IP addresses authorized to use MediaStreamer
Separately from VPN services, we also provide our optional MediaStreamer service for devices such as Apple TV that do not support VPNs. Users who opt into using MediaStreamer can choose to register specific IP addresses that should be authorized to use the service.
ExpressVPN collects personal information which you provide to us directly through the Site. We require that you provide personal information, such as an email address and payment information, in order to establish an ExpressVPN account, and so that we can email you, collect payments from you, and respond to support queries that you initiate. The specific information collected varies depending on the payment method you choose. To minimize the amount of personal information you submit to us, we recommend that you use bitcoin payments when subscribing for our Service.
ExpressVPN uses your email address for the following reasons:
- To send emails related to payment transactions;
- To provide links to our Site, including password reset emails;
- To send you updates and announcements;
- To communicate with you about your VPN services or respond to your communications;
- To send marketing information, such as ExpressVPN offers, surveys, invitations, and content about other matters in connection with ExpressVPN (“Marketing emails”). You may choose to not receive Marketing emails by following the opt-out procedure described in these emails.
Aggregate Apps and VPN Connection Summary Statistics
We ensure that we never log browsing history, traffic destination, data content, IP addresses, or DNS queries. Therefore:
- We do not know which user ever accessed a particular website or service.
- We do not know which user was connected to the VPN at a specific time or which VPN server IP addresses they used.
- We do not know the set of original IP addresses of a user’s computer.
Should anyone try to compel ExpressVPN to release user information based on any of the above, we cannot supply this information because the data don’t exist.
In order to maintain excellent customer support and quality of service, ExpressVPN collects the following information related to your VPN usage:
Apps and App versions
We collect information related to which app(s) and app version(s) you have activated. Knowing your current version of the Apps allows our customer support team to troubleshoot technical issues with you.
We collect information about whether you have successfully established a VPN connection on a particular day (but not a specific time of the day), to which VPN location, and from which country/ISP (but not from which IP address). This minimal information assists us in providing technical support, such as identifying connection problems or providing country-specific advice about how to best use our service.
Aggregate sum of data transferred (in MB)
We collect information regarding the total sum of data transfer you consume. Although we provide unlimited data transfer, if we notice that a single user pushes more traffic than thousands of users combined, thereby affecting our quality of service and other ExpressVPN users, we may contact them for an explanation.
We collect minimal usage statistics to maintain our quality of service. We may know, for example, that our customer John had connected to our New York VPN location on Tuesday and had transferred an aggregate of 823 MB of data across a 24-hour period. John can’t be uniquely identified as responsible for any specific behavior because his usage pattern overlaps with thousands of other ExpressVPN customers who had also connected to the same location on the same day.
Zero logs means that we’ve engineered our systems to categorically eliminate storage of sensitive data. We may know THAT a customer has used ExpressVPN, but we never know HOW they have utilized our service. We stand by our firm commitment to our customers’ privacy by not possessing any data related to a user’s online activities.
Anonymous VPN Connection Diagnostics and Crash Reports (Can be turned off by the user)
With your permission, we collect anonymized analytics data used for network diagnostics. We use these data in our network operations tools to help optimize network speeds and to let us identify problems related to specific Apps, VPN servers, or ISPs. The information we receive is fully anonymized and cannot be tied back to individual ExpressVPN users (i.e. we don’t store which user sent which data, and do not store IP addresses).
If you opt in to share this information with ExpressVPN, we will collect the following information:
- Diagnostic information about how a VPN connection attempt failed.
- Speed test data
- Crash reports, also without any personally identifiable information. Depending on your platform, these are sent to these third parties:
- Android: Google Analytics. See Google Analytics’s Terms of Service.
Upon activation of any ExpressVPN App, you will be asked if you would like to share these data. You may toggle your selection on or off at any time in the App’s settings menu.
MediaStreamer is our service for consoles like Apple TV and other devices that don’t support running a VPN. Because the service doesn’t run on an app and doesn’t have an option for username/password authorization, we rely on a system which authorizes specific IP addresses that you have chosen to register with us. You can register IP addresses by logging into our website and using the “DNS Settings” page. Those IP addresses are then stored in our system in order to identify authorized devices.
If you do not wish to use this service but have devices like an Apple TV that cannot run a VPN, we suggest using the ExpressVPN app for routers. Like all of our apps and VPN service, the app for routers does not require IP address registration. Please contact us and we’ll guide you through the steps.
Jurisdiction and Applicable Law
ExpressVPN’s core mission is to keep your information private. In service of this mission, ExpressVPN’s headquarters and registered place of business is in the British Virgin Islands (BVI), which has stricter laws concerning information disclosure than most countries.
The BVI has no data retention laws, and any legal order requiring a BVI company to disclose customer records must come from the BVI High Court. Under BVI law, information requests from foreign courts or law enforcement are subject to a ‘dual criminality’ provision, meaning that the request is upheld by the BVI High Court only if the same crime is punishable by at least a one-year prison sentence under BVI law, had it taken place in the BVI. Should we receive a valid legal order from the BVI High Court, it is important to note that ExpressVPN does not collect any IP addresses, browsing history, traffic data, or DNS queries that could be used to identify any specific user.
Storing of Information Related to Email, Live Chat, and Feedback Forms
ExpressVPN keeps records of any correspondence, questions, complaints, or compliments you submit to us through our Site or Services, along with our response. Depending on how you contact ExpressVPN, we may collect your email address and any additional information you provide to us. Having full correspondence records enables our staff to provide the best possible customer support experience.
We use two different third-party platforms for support correspondence: Zendesk for emails and support tickets, and SnapEngage for live chat. When you correspond with us using these platforms, your correspondence records, including your name and email address, are stored in their systems. Both platforms utilize modern security practices and HTTPS encryption.
Security Measures to Protect Your Information
ExpressVPN uses best-in-class physical, procedural, and technical security with respect to our offices and information storage facilities so as to prevent any loss, misuse, unauthorized access, disclosure, or modification of information. Access to user information is restricted to staff who require such access to perform their job functions.
While we believe these systems are robust, it is important to understand that no data security measures in the world can offer 100% protection.
Servers are housed in data centers with strong security practices. None of these data centers require us to collect or store any traffic data or personal information related to your use of VPN Services. If any data center were to ask us to log such data, we would immediately cease operations with said data center and find alternative options.
Even if a government were to physically seize one of our VPN servers and manage to break their disk encryption, there would be no logs or information that would tie any individual user to a particular event, website, or behavior.
What is a cookie?
A cookie is a small text file used to store information about your visit to the Site. Cookies let ExpressVPN optimize and improve the user experience of the Site by helping us deliver certain functionalities, such as website login and language settings. The cookies we use may vary over time as we continuously update and improve our Site.
You are free to change your cookie preferences at any time. You can do this in the settings panel for your browser. Depending on which browser and device you use, you may be able to control which cookies you allow, which cookies you want to block in the future, and delete cookies. For more information about these settings, please refer to the “help” section of your browser. Note that ExpressVPN’s Site may not work as intended if you choose to disable cookies.
The cookie set by ExpressVPN enables us to set your language preference, attribute visitors to a marketing channel, and once you login, securely show you information that is specific to your account. The cookie contains a user identifier, but no directly personally identifying information such as your name or email address, and does not track any activity outside the ExpressVPN website.
ExpressVPN uses third-party services such as Google Analytics and Adwords. Cookies from such services are used to collect data for statistical reports. For example, we may generate reports regarding the amount of time users spend on the Site and the number of users who visit a particular page.
ExpressVPN uses Google AdWords remarketing to show advertisements on third-party websites (including Google) to users who have visited our Site. We may show such users advertisements on a Google search results page, or on a site in the Google Display Network.
The Site may contain links to external websites that do not fall under ExpressVPN’s domain. ExpressVPN is not responsible for the privacy practices or content of such external websites.
Consent and Age Restrictions
The Services are intended for adults aged 18 and above. If you believe your child has provided information to us, please let us know immediately.
How to Contact ExpressVPN