PureVPN

The VPN tunnel collects almost nothing identifiable — day of connection, ISP name, aggregate bandwidth — but Facebook Pixel sits in the in-app analytics stack alongside Google Analytics and Firebase, the optional Dark Web Monitoring feature collects Social Security numbers, passport numbers, and credit card numbers, and the Dedicated IP add-on retains a linked VPN IP address for 25 days after subscription ends.

No selling or renting of data; BVI jurisdiction means legal data demands require demanding process; but SpyCloud receives highly sensitive identity documents for dark web scanning, Facebook Pixel and MixPanel are embedded in the app stack, and a roster of marketing and support platforms including UseInsider, Intercom, Mailchimp, SendGrid, and Twilio all receive personal data.

GDPR and CCPA rights are documented and users can opt out of dark web monitoring at any time; but data retention is vaguely defined as 'until you remain a subscriber and actively use the app' with no post-cancellation window or specific periods stated for any data category, and the email address is retained until an explicit deletion request is received.

BVI jurisdiction, no-logs audit (referenced by link rather than named in the policy text), 72-hour GDPR breach notification, and anonymous payment are genuine positives; but the audit firm and scope are not named in the policy document itself, no specific encryption standards are disclosed, and Facebook Pixel in the app stack creates a structural tension with the privacy brand.