Which VPN is best for privacy? Don’t judge by a “no-logs” label alone. A better approach is to decide what you want to protect, review the service’s terms, then check what your account, payment method, and client may disclose. A no-logs policy is a claim you can investigate, not a promise of anonymity. Sharing less data also doesn’t replace securing your device and browser.
Privacy comparison: Start with who can see what
When you connect through an encrypted tunnel, your local network can usually see that your device is connecting to a server address, but not read the requests inside the tunnel. That assumes the traffic actually goes through it. Apps excluded by split tunneling, DNS queries not handled by the tunnel, and requests that revert to a direct connection after a drop need separate checks.
Trust hasn’t disappeared; it has shifted. The VPN server must handle the connection, while destination websites may see your exit IP address, account login, and browser characteristics. HTTPS protects web content in transit, but it doesn’t make a site forget that you’re signed in or stop it from logging your activity on its own pages.
So “the public network can’t see request contents,” “the service keeps no browsing logs,” and “websites can’t identify you” are three different goals. The checks you need for reducing exposure on public Wi-Fi or sharing less personal information aren’t necessarily the same as those for resisting targeted tracking.
No-logs claims: Check the policy by data type
Search the privacy policy and terms of service for words like “logs,” “connections,” “retention,” “deletion,” and “third parties.” Don’t rely on a badge on the homepage: find out which data the claim covers, which components it applies to, and whether troubleshooting creates exceptions.
| What to check | What to verify | What you can’t conclude |
|---|---|---|
| Browsing records | Are destination domains, IP addresses, DNS queries, or request contents stored? | Saying “we don’t record browsing activity” doesn’t mean connection metadata isn’t stored. |
| Connection metadata | Are source IP addresses, connection times, or exit-server choices retained? For what purpose and how long? | A “no logs” claim doesn’t tell you its precise scope. |
| Account and usage data | How are account status, remaining data, and billing records managed? Are they linked to specific browsing activity? | Providing data-usage statistics isn’t proof that browsing history is stored. |
| Diagnostics and third parties | What information do crash reports, support attachments, and payment providers each receive? | The tunnel service’s policy may not cover external clients or payment providers. |
| Audits and policy changes | If the service claims to have been audited, can you review the report, its scope, date, and limitations? | An old report doesn’t prove that every current component meets the same standard. |
Also distinguish between data processed while you’re connected and data stored after you disconnect. Handling data packets is essential to providing the service; the details to ask about are whether information is written to persistent storage, whether it can be linked to your account, and when it’s deleted. Looking at the client alone can’t verify everything the server does.
If the policy doesn’t explain something, mark it as unconfirmed and ask support about the exact scope. Don’t assume that silence means nothing is recorded. Even when an audit is public, read its limitations instead of treating the badge as a standing guarantee.
Signup and payment: Limit unnecessary links
Start by checking which signup fields are required, not how long the form looks. B7VPN doesn’t require an email address; a username and password are enough to get started. That can reduce the direct link between your account and an email address, but a username can still reveal clues. Don’t reuse a public social handle, and don’t reuse passwords across services.
Use a password manager to create and store a unique password, and check the account recovery options actually offered in your dashboard. Not needing an email address doesn’t mean a particular recovery method is available. If you lose your credentials, recovery depends on the service’s actual process—don’t assume one exists.
Payment is a separate data trail. The merchant, payment provider, and payment method may each keep records needed to complete the transaction. Whether a payment method displays your legal name, how the charge appears on a statement, and how refunds are processed depends on the provider’s terms. “No email required” doesn’t mean a payment can’t be linked to you.
- ✅ Choose a username that doesn’t include your real name or public account handle, and set a unique password.
- ✅ Before paying, check the merchant, amount, and payment provider’s terms. Provide only the information needed to complete the transaction.
- ✅ Keep your order confirmation somewhere private. When contacting support, start with the order reference and a description of the issue.
- ❌ Don’t share unredacted payment details, account passwords, or subscription links in chat screenshots.
Data minimization doesn’t mean deleting every record. You may need an order confirmation to verify a payment or request a refund, so keep it somewhere private rather than posting it in a public forum. If support asks for more information, first confirm why it’s needed, then redact anything unrelated to the issue.
Subscription links and clients: Check another privacy exposure
Subscription links often contain a token that grants access to your configuration, so treat them like sensitive credentials. Importing a link tells a client to fetch configuration from a specific address; it’s not like adding an ordinary bookmark. Pasting it into an unfamiliar online converter could give that service both the link and access to the node configuration it retrieves.
Prefer the import method provided by the service or a configuration format supported locally by your client. If you need to convert a link, first check where the conversion happens, whether your input is uploaded, and whether the result is made public. If a link has been exposed, see whether your dashboard lets you reset it. Deleting a chat message won’t invalidate copies someone has already saved.
Clients have their own privacy boundaries too. System network extensions, proxy settings, and traffic-routing permissions are different from access to contacts or photos. Check what each permission is for before granting it, get clients from official sources, and look for options such as cloud sync and diagnostic uploads.
Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are different protocols or protocol families; they don’t prove anything about a provider’s data-retention policy. Encryption and server authentication depend on the protocol and the actual configuration. For example, VLESS doesn’t provide encryption on its own and needs to be combined with a secure transport. A protocol name alone can’t tell you how private a service is.
Public Wi-Fi: Check routing, DNS, and what happens if the connection drops
On public Wi-Fi, first make sure you’ve connected to the network you intended to use. If a captive portal is required, complete the necessary sign-in before connecting. Don’t ignore a certificate warning just to get online, and don’t install root certificates from unknown sources.
Don’t rely on the status light alone. System proxy mode usually affects only apps that follow the system proxy settings. Tunnel mode can cover more traffic, but exclusions, routing, and permissions can still affect what goes through it. Windows, macOS, and mobile operating systems handle traffic routing differently, so switches with the same name may not behave the same way.
- Check the route for the app you care about. In the client, review the current mode and how its rules match. Rule-based mode may send some traffic directly; don’t assume every app is routed through the proxy.
- Check your exit IP and DNS. Use a trustworthy network test to check your exit IP and whether the DNS resolver is the one you expect. Test sites also receive your requests, so avoid tools that ask for personal information.
- Check whether IPv6 is covered. If the network supports IPv6, confirm that the client handles it too. Seeing your IPv4 exit change doesn’t prove that all traffic takes the same route.
- Test what happens if the connection drops. Disconnect on purpose while you’re not doing anything sensitive, then see whether the app stops connecting or falls back to a direct connection. Blocking behavior depends on the operating system and client; don’t assume protection is in place.
- Check again after reconnecting. After changing networks, waking from sleep, or updating the configuration, verify the mode and rules again. Don’t assume a previous successful connection means everything is still routed as expected.
A DNS leak is a query going outside the route you expect, potentially exposing it to the local network or an unintended resolver. A resolver in a different region from your exit server doesn’t, by itself, prove there’s a leak. Browser encrypted DNS, remote DNS resolution by the client, and system DNS can behave differently, so interpret test results in light of your configuration.
Similarly, if your browser reveals an address through WebRTC, distinguish a local address from one that’s publicly reachable. Testing tools can spot some configuration problems, but they can’t prove that the service keeps no server-side logs or rule out malware accessing data on your device.
B7VPN’s privacy limits
B7VPN’s main trust claim is its no-logs policy, and signup doesn’t require an email address. Read the first in the context of the privacy policy; the second describes a specific signup requirement. This guide doesn’t present the policy as an independent audit finding or claim that users can’t be identified.
Keep billing and privacy questions separate too. B7VPN monthly plans are ¥9.9 / 60GB, ¥18 / 250GB, and ¥28 / 500GB, with data resetting monthly on the activation date. Perpetual data plans are also available. Data allowances are used for billing and usage management; their existence alone doesn’t tell you how specific browsing records are handled.
There’s no device limit, which means there’s no device-count cap listed here—not that your devices are automatically isolated from one another. Shared configurations, synced browser accounts, or reused login identities can still create links between them. B7VPN offers a 7-day no-questions-asked refund. Before choosing a plan, check the billing details on the plans page. If anything about privacy is unclear, ask through the support page.
