How the tunnel is encrypted
Once you are connected, all traffic from your device goes through an encrypted tunnel to a VPN Club server. Your provider or the owner of the Wi-Fi network can see a VPN connection, but not the pages you load or the data you send. OpenVPN and IKEv2 use AES-256-GCM, and WireGuard uses ChaCha20. The encryption is the same on every plan.
Each plan supports WireGuard, OpenVPN (UDP or TCP) and IKEv2. WireGuard connects quickly and is the right choice for most people. OpenVPN TCP is useful where UDP is blocked, and IKEv2 handles a phone switching between Wi-Fi and mobile data. Change it under Settings > Connection > Protocol. Switching protocol affects speed and stability only. It does not change what we log.
Protection against DNS leaks
Before your device opens a website, it asks a DNS server for the site's address. If that question goes to your provider outside the tunnel, the provider ends up with a list of the sites you visit, even though the traffic is encrypted.
When you are connected, VPN Club routes every lookup through the tunnel to its own DNS servers, which do not log queries, and blocks lookups that try to go anywhere else. This is on by default, with nothing to configure.
Kill switch
Connections drop sometimes: a weak signal, a laptop waking from sleep, a phone changing networks. Without a kill switch, apps carry on over your normal connection and expose your real IP address.
With the kill switch on, internet access is blocked until VPN Club reconnects. We suggest switching it on once and leaving it on, particularly if you use public Wi-Fi.
- Windows, macOS, Linux, iOS: Settings > Connection > Kill switch
- Android: turn on the kill switch in the app, then turn on Always-on VPN and Block connections without VPN for VPN Club in the Android VPN settings
Requests from authorities
VPN Club follows the law that applies to it. A valid legal request can only reach the data we actually hold, which is the account and payment data listed at the top of this page.
Browsing history, DNS logs, original IP addresses and connection times are never recorded, so there is nothing of that kind to hand over.
Paying without a card
You add a dollar balance with crypto on the PayGate checkout page and buy plans from that balance. VPN Club takes no cards and no PayPal, so we never see card numbers or bank details.
Our records hold the amount, the coin, the date and the plan. Most blockchains are public, though, so anyone who knows your wallet address can see transfers from it.
Protecting your account
Your ID and password are the only way into your account. There is no email on file, so a forgotten password cannot be reset and we have no way to hand the account back to you.
Some simple habits help:
- Pick a long password you use nowhere else
- Save it in a password manager at sign-up
- Sign out of the dashboard on shared or public computers
- Never share your ID or password

