Best No-Logs VPNs: What Their Privacy Policies Really Collect

The three highest page scores

The three privacy scores (9.3, 8 and 9) sit close together, and the distance in page score comes from the other pillars: IVPN trails on value and network, while X-VPN's weak spots are security and censorship bypass.

Which logs we track: connection IP, session times, bandwidth

A VPN server sees your real address for the whole session, so the policy decides whether it gets written down. Our cards read each of the 389 policies for three items.

The first two feed the privacy score, and admitting to a stored source address deducts three extra points beyond the missed items. Bandwidth shows on the card but earns nothing: a byte counter reveals how much you used, not what you did, while an IP paired with timestamps can be matched back to one subscriber. Surfshark illustrates a partial answer: its policy keeps a user ID, IP and timestamps temporarily and deletes them within 15 minutes after the session ends.

A policy claim versus a checked claim

A policy is the company assessing itself. An audit means an outside party inspects the code and server configuration, though the result reflects a single point in time. Just 37 of 389 services here have one, listed separately in our audited no-logs ranking. Three have proven the claim under pressure in court or through a server seizure; OVPN won such a case over an information injunction. RAM-only servers (24) wipe data on reboot, limiting what a seized machine holds. Transparency reports and canaries show whether the provider discloses the requests it receives; 19 and 21 services respectively do, and our warrant canary page explains the limits of an absent one.

Why "not stated" is not the same as "logs"

When a policy says nothing about timestamps, our card files it as not stated. Read that literally: silence is not an admission of logging, and not a clean bill either. Before paying, search the text for the terms IP, timestamp and retain; a provider that answers each in a sentence leaves nothing to guess. The EFF guide to choosing a VPN offers a solid checklist for this.

What a no-logs VPN still knows about you

Traffic can stay unlogged while the account side stays chatty. Across the list, 195 policies admit to collecting an email, 171 device info, 161 app analytics and 121 crash reports. 24 services offer account-number login and 15 accept cash. Jurisdiction matters too: it sets which governments can compel the provider. 143 services here sit outside any surveillance alliance, 89 in Five Eyes countries, 17 in Fourteen Eyes, 11 in Nine Eyes, and for 129 the alliance status is unknown.

How the page score is weighted

Privacy takes 45% of the score, security 15.7%, value and censorship bypass 11.8% each, network and apps 7.9% each. Within the 15-point privacy scale, an independent audit is worth 3, the no-logs policy 2, no surveillance alliance 2 and no stored connection IP 1.5; proof in a court case or incident earns 1, and a stored connection IP brings a −3 penalty.

FAQ

Short answer: picking a no-logs VPN

Filter for providers whose policy plainly excludes storing the connection IP and session times, then require an independent audit, since only 37 of 389 have one. Treat missing statements as questions to resolve before paying, not as evidence either way. Paid plans here start at €0.36 a month with a median of €2.99; check the refund terms before committing to a long plan, and if the account side bothers you, pay in a way that doesn't trace to your main card.