What data we keep, for how long and why, what we don't record, the software we run and how you can check all of it yourself in a few minutes.
Last update: 05.11.2026
RoTunneling VPN has been run since 2010 by RedShift IT SRL, based in Bucharest, Romania: VAT ID RO26963888, trade register no. J2010005296403, VAT registered. The company is the controller of your data. The VPN servers are in Romania, and the service follows Romanian law and the EU General Data Protection Regulation (GDPR).
Contact: [email protected]. Data protection officer: [email protected].
For each VPN session the servers keep a short technical record, to sign you in, apply your plan's device limit and size capacity. Deletion is automatic, in a daily run.
| Data | How long we keep it |
|---|---|
| The public IP address you connect from and the internal IP you get inside the VPN, for a closed session | 14 days |
| The rest of the session record: username, server, start and stop time, traffic volume (the amount only), a technical session code and a technical device code | 30 days |
| VPN sign-in attempts | 48 hours |
| A temporary block of a device (the device code and username) | 48 hours after it ends |
| Account security events (sign-in, registration, password reset, e-mail change, deletion request), with the IP address | 30 days |
| Account data: username, e-mail, password (as a hash only), phone number if you added one | For as long as the account exists |
| The date of your last sign-in and last VPN connection (the day only, no IP or traffic) | For as long as the account exists |
| Card type, last 4 digits, expiry and country (from Stripe), plus the payment IP address and browser | 30 days |
| Invoices | 10 years from 1 July of the year after the financial year closes |
| E-mail delivery log (the address stored only as a hash) | 24 months |
| Encrypted database backups | Deleted automatically within 60 days |
An open session stays on record for as long as the connection runs. An account with no subscription, connection, sign-in or payment for 2 years is deleted, after a warning e-mail normally sent 30 days before. Deleting your account on request takes effect after 30 days, during which you can cancel it.
In short: we keep only the technical data the service needs, and only for as long as it needs it: the connection IP for 14 days, the rest of the session data for 30 days, then it is deleted automatically. We don't know which sites you visit, so there is nothing about them to hand over.
Until it is deleted, a session record shows which IP address your account connected from and when, and nothing about what you did in that time. We tell you this openly, so you know exactly what exists about you.
The RoTunneling app has no ads and no analytics or tracking tools. Your username and password stay only on your device, in the system's secure storage. We do not sell data to anyone.
We check every request and answer only those issued under the law. We can only provide what we already have; data we don't keep, such as the websites you visit, does not exist on our side. What we may have, while the periods above have not run out: the IP address you connected from, the time of the connection and the other session data.
Where a verified, case-specific order under Article 154 of the Romanian Criminal Procedure Code requires preservation, we may keep a separate, encrypted, access-restricted copy of only the specifically identified records that already exist when the order arrives. The measure lasts at most 60 days, with at most one separately justified extension of up to 30 days, and ordinary deletion continues. Preservation does not by itself authorise disclosure, which needs a separate authorisation; it does not allow interception and does not change what we keep for other users. At the end, the copy is made unavailable and deleted together with its key.
| Provider | What for | Where |
|---|---|---|
| Data centres in Romania | The VPN servers | Romania, EU |
| Oracle Cloud Infrastructure | The website and the database | Frankfurt, Germany |
| Amazon Web Services | Encrypted backups; installation files | Frankfurt (eu-central-1); Ireland (eu-west-1) |
| Cloudflare | Website delivery and protection, the Turnstile check; the 1.1.1.1 resolver, which receives the allowed DNS queries from our servers (it sees the server's IP, not yours); the public DNS 1.1.1.1 and the speed test in the app | Global network |
| Stripe | Card, Apple Pay and Google Pay payments | Global network |
| Apple, Google | Subscriptions bought in the App Store and Google Play | Under their own policies |
| Oblio | Issuing invoices and sending them to RO e-Factura | Romania |
| Mailjet (Sinch group) | Account e-mails and the newsletter | EU |
| Google Maps Platform | Address suggestions in the billing form | Global network |
| tawk.to, EmbedSocial | The support chat and the feedback form, only if you open them | tawk.to: US; EmbedSocial: Bulgaria, EU |
| Google Analytics, Google Ads, Meta | Website statistics and ad measurement, only with your consent; not in the app | Global network |
| Quad9 | The public DNS 9.9.9.9, if you turn anti-malware protection off | Switzerland |
Providers from the US or US groups take part in the EU-US Data Privacy Framework; transfers and safeguards are described in the privacy policy.
Your traffic goes only through our servers in Romania and, when needed, through Cloudflare. Every transport mode connects straight to our servers; no third-party relay or rendezvous service sees the connection. Cloudflare comes in only in WSS CDN mode, the last automatic option, for the strictest networks: it sees your public IP address and port, the time and volume of the connection and our server's address, but not the content, which stays encrypted with TLS all the way to our server. Details in the privacy policy.
The RoTunneling apps and servers use the SoftEther VPN protocol, an open-source protocol developed at the University of Tsukuba in Japan, whose code anyone can read.
For a long time the site used the name UT-VPN. UT-VPN is the open-source edition (GPLv2 license) that the University of Tsukuba in Japan published in 2010, written by Daiyuu Nobori. The project continued at the same university as SoftEther VPN, open source since 2014 and released under the Apache 2.0 license since 2019.
| Component | What it does | License and code |
|---|---|---|
| SoftEther VPN Server | The VPN servers. It also provides OpenVPN, L2TP/IPsec and SSTP compatibility. We added: the plan's speed and device count from RADIUS, a record of each session's protocol, remote disconnect, R-UDP on fixed ports and the WSS CDN transport. | Apache 2.0. Our changes are not published. |
| SoftEther VPN Client (Windows, Linux) | The app's engine on Windows and Linux, built by us from the SoftEther source, with changes for remote disconnect, transport selection and a browser-like TLS handshake | Apache 2.0. Our changes are not published. |
| VPN engine for Android, macOS and iOS | Written by us, compatible with the SoftEther protocol | Our own code, not published |
| The RoTunneling VPN 6 app | The interface, the choice of server, port and transport, the kill switch | Our own code, not published. Built with Flutter (BSD-3) |
| OpenSSL 3.5 | TLS encryption on the servers and in the desktop client | Apache 2.0 |
The full list of open-source components in the app, with their licenses, is in the app under Settings > Licenses. On iPhone and iPad you use the OpenVPN Connect app or the L2TP/IPsec profile with our servers.
| Mode | Ports | When it is used |
|---|---|---|
| TCP + UDP acceleration | TCP 443, then 24 other ports (80, 8080, 993, 995, 465, 22, 53 and more) | The main mode. Up to 32 parallel TCP connections, with a fast UDP channel alongside when the network allows it |
| UDP (R-UDP) | The UDP ports published by our own server directory; our own NAT traversal, with no third-party service | When TCP is slow or filtered |
| DNS | UDP 53 | Networks that let little more than DNS through |
| ICMP | Ping packets | Networks that block TCP and UDP; not on macOS |
| WSS CDN | TCP 443, secure WebSocket through a CDN network | Automatically, as the last option |
In every mode the VPN session is encrypted with TLS all the way to our server, with the certificate checked.
You can check the IP, DNS, IPv6 and kill switch yourself in a few minutes, with the steps below. No third-party leak test has been published yet.
| Plan | Top speed | Devices at once | Romania, VAT included | Before VAT |
|---|---|---|---|---|
| Big | 16 Mb/s | 2 | 3.63 EUR (19.38 lei) | 3.00 EUR |
| Omega | 50 Mb/s | 2 | 8.47 EUR (45.23 lei) | 7.00 EUR |
| Gyga | 250 Mb/s | 3 | 12.10 EUR (64.61 lei) | 10.00 EUR |
| Terra | 500 Mb/s | 4 | 19.36 EUR (103.38 lei) | 16.00 EUR |
| Plan | 12 months | 24 months | 36 months |
|---|---|---|---|
| Big | 183.76 lei, 15.31 lei/month (-21%) | 288.43 lei, 12.02 lei/month (-38%) | 348.90 lei, 9.69 lei/month (-50%) |
| Omega | 428.76 lei, 35.73 lei/month (-21%) | 672.99 lei, 28.04 lei/month (-38%) | 814.11 lei, 22.61 lei/month (-50%) |
| Gyga | 612.52 lei, 51.04 lei/month (-21%) | 961.42 lei, 40.06 lei/month (-38%) | 1,163.01 lei, 32.31 lei/month (-50%) |
| Terra | 980.03 lei, 81.67 lei/month (-21%) | 1,538.27 lei, 64.09 lei/month (-38%) | 1,860.81 lei, 51.69 lei/month (-50%) |
Every plan has unlimited traffic, P2P and anti-malware protection. The speed is the plan's maximum; the real speed also depends on your connection. Other EU countries pay their local VAT (17%–27%), in EUR; EU companies with a valid VAT number are invoiced with reverse charge. Outside the EU no VAT is added. You see the exact total before you pay.
Full text: Terms and Conditions. If the Romanian and English versions differ, the Romanian version prevails.
We have not published an independent audit yet of the servers, the apps or the way we keep and delete data, nor a third-party security test. Until then, we give you everything you can check without taking our word for it:
When any of this changes, we update the page and the date at the top.
If a test does not come out as described here, write to [email protected] with your operating system, the app version and the transport mode shown.
Not yet: no independent audit of the RoTunneling infrastructure, apps or logging policy has been published. What RoTunneling publishes instead: the exact retention periods, enforced by a daily automatic deletion job, the list of providers, and step-by-step checks on the transparency page that let anyone verify the IP address, DNS and IPv6 leaks and the kill switch themselves. The tunnel protocol comes from the open-source SoftEther VPN project, whose code is public.
Only the technical data the service needs, for as long as it needs it. It does not record traffic content, visited sites or apps, or DNS queries made through its protected DNS, so there is nothing about them to hand over. For each VPN session it keeps username, server, source IP, assigned VPN IP, start and end time, traffic volume and technical session and device codes. Source and assigned IPs of a closed session are deleted automatically after 14 days, the rest of the session record after 30 days. VPN authentication attempts are kept 48 hours, account security events 30 days.
Both versions now state the same terms (14 days for IPs of closed sessions, 30 days for other session data). The Terms say the Romanian version prevails if they ever differ. The periods are enforced by a daily automatic deletion job.
Per plan: Big 2, Omega 2, Gyga 3, Terra 4 simultaneous devices. The number comes from the plan settings that also enforce the limit on the VPN servers.
Big, the cheapest plan with 2 devices, covers both: up to 16 Mb/s for 19.38 lei/month in Romania with 21% VAT (3.00 EUR before VAT; in other EU countries the local VAT of 17%–27% is added, outside the EU no VAT). Longer periods cost less per month: -21% for 12 months, -38% for 24, -50% for 36. The speed test on the website recommends a plan for the user's line.
Big 19.38 lei (3.63 EUR) with Romanian VAT, 3.00 EUR before VAT; Omega 45.23 lei (8.47 EUR) with Romanian VAT, 7.00 EUR before VAT; Gyga 64.61 lei (12.10 EUR) with Romanian VAT, 10.00 EUR before VAT; Terra 103.38 lei (19.36 EUR) with Romanian VAT, 16.00 EUR before VAT. Romanian VAT is 21%; other EU countries pay their own VAT (17%–27%); EU companies with a valid VIES VAT number are invoiced with reverse charge.
No. There is no introductory price: a card subscription renews at the plan's list price for the same period (the 12/24/36-month discount stays), with a reminder e-mail 4 days before. A coupon discount, if one was used, lasts only for the number of periods the coupon states. The subscription can be cancelled from the account at any time and stays active until the end of the paid period.
Yes, within 14 calendar days of the first payment. Support first tries to fix the problem; if the user still wants a refund, the money goes back to the card used, in the currency paid.
The apps send all IPv4 traffic through the tunnel. The kill switch is an option in Settings, off by default; once the user turns it on, it blocks traffic outside the tunnel while the app reconnects (Windows Firewall rules on Windows, nftables on Linux, the VPN interface on Android). macOS keeps the tunnel routes while the app reconnects, but if the system stops the VPN network extension, traffic is not blocked until it starts again. The WSS CDN mode turns the kill switch on by itself only on Windows, for that session; on the other platforms it stays the user's choice. The servers have no IPv6, so the apps route IPv6 into the tunnel or block it instead of letting it leave outside. DNS goes to the RoTunneling protected DNS inside the tunnel, or to 1.1.1.1 / 9.9.9.9 if the protection is turned off. These are design statements from the app source; no third-party leak test has been published.
It is a DNS filter that RoTunneling built and runs on its own servers, on by default in the apps. Every DNS request is checked on the spot against more than 3 million domains and IP addresses known for malware, phishing, ransomware and command-and-control servers, plus some tracking domains chosen so apps and sites keep working; it is not an ad blocker. If the destination is dangerous, the connection never starts. The lists update every hour, and new phishing sites are picked up from Certificate Transparency logs from the moment they get an SSL certificate, sometimes before they appear on other lists. The lists combine our own system with alerts published by CERT teams in several countries, well-known malware-domain lists and Vatra Sentinel (vatra.vakyn.com), a Romanian system that uses AI to spot malicious and phishing sites the moment they go live. Allowed queries are resolved through Cloudflare 1.1.1.1 as a plain resolver, which sees the RoTunneling server's IP, not the user's. Queries are not logged. It complements an antivirus and does not replace it.
No. An account needs an e-mail address, and every payment gets a fiscal invoice with billing details. Payment is by card, Apple Pay or Google Pay (Stripe) or through the App Store and Google Play.
No proprietary protocol: the tunnel uses the SoftEther VPN protocol, open source since 2014 and under the Apache License 2.0 since 2019. UT-VPN was the University of Tsukuba's 2010 open-source edition under GPLv2, based on PacketiX VPN 3.0. The RoTunneling server is a fork of SoftEther VPN Stable; the RoTunneling apps are not open source, and the changes to the server, the transport selection and the server configuration are not published.
RedShift IT SRL, Bucharest, Romania (VAT ID RO26963888), running the service since 2010. Romanian and EU law (GDPR) apply; the VPN servers are in Romania and the website database in Frankfurt, Germany.
Last update: 05.11.2026. The contractual documents are the Privacy Policy and the Terms and Conditions.
High-speed European VPN since 2010. Servers in Romania (EU), open internet on restrictive networks, support in English and Romanian.
Support: [email protected]
Support chat is off. Turn on chat or write to [email protected].
© 2010-2026 RedShift IT SRL. All rights reserved.
