How RetuVPN works
How the app finds a way through a network, how your account and subscription work without personal details, and why there's no connection history to keep.
Finding a way through
Networks decide what to block by how traffic looks: the port it uses, the shape of its handshake, and the size and timing of its packets. A VPN that speaks one protocol stops working on any network that blocks that protocol.
RetuVPN carries the same encrypted tunnel inside 21 different connection methods. When you connect, the app tries several at once and uses the first one that answers. It saves that choice for the network you're on, so next time it starts with the method that worked and usually connects in under a second.
- TLS
- QUIC
- WebSocket
- WireGuard
- OpenVPN
- Shadowsocks
- Trojan
- obfs4
- SSH
- DNS
- DNS over HTTPS
- STUN
- and 9 more
Every plan can use every method, including Free. A network that blocks the common methods shouldn't lock anyone out.
Your account is a key
When you first open the app, it generates a key pair on your device. The private key never leaves the device. That key is your account, and nothing in it identifies you.
The app then shows your 16-digit account code, once. You need it to add another device or to set up the same account on a new phone. We store only a hash of the code, so we can't look it up or reset it.
If you lose the code and every device signed in to the account, we can't recover the account itself, because nothing links it to you. A paid subscription can still be moved to a new account.
Moving or recovering a subscription
A subscription is attached to one account at a time. You can move it to another account, for example after losing your code or setting up a new phone without it:
- App Store or Google Play. Install RetuVPN, make sure your device is signed in to the Apple or Google account you paid with, and choose Restore purchases in Settings.
- Card, through Stripe. Choose Restore purchases, then Paid by card, and enter the email address on your Stripe receipt. We send a confirmation link to that address, and opening it moves the subscription to the account on your device. You can also ask [email protected] to send the link.
Restoring moves the subscription, and the account it came from returns to Free. Before you can buy, the app checks whether your Apple or Google account already has a RetuVPN subscription and offers to restore it instead. If you still end up paying twice, see duplicate subscriptions.
Checking your plan without calling home
Your plan's limits (speed, data, devices and locations) are written into a pass that our account server signs and your device keeps. A pass lasts a few hours. It says what you may use, not who you are.
Exit servers check the pass's signature themselves and never ask our account server about you. The pass also keeps you online if our account server can't be reached: you can keep connecting until your current pass expires, and the server list is signed and cached the same way.
Why there's no connection history
Exit servers run with logging for VPN connections turned off. The state they need to route your traffic is held in memory and discarded when you disconnect.
Our account database has no table for sessions. Because exit servers check passes themselves, a connection never produces a record on our side that would need one. The records we do keep are listed in full in our privacy policy.
Encryption
Traffic is encrypted from your device to the exit server, with forward secrecy and replay protection, whichever connection method carries it. The method changes only what the traffic looks like to the network in between.
Locations
At launch, exit servers run in Germany and the United States. The app always shows the current list. Free uses a set of free locations; Premium can use every location.
What a VPN does not do
RetuVPN hides your traffic from the network you're connected to, and websites see the exit server's IP address instead of yours. It does not:
- make you anonymous to services you sign in to;
- block tracking cookies or browser fingerprinting;
- protect you from someone who can watch both your network and the exit server;
- make something legal where it isn't. See the acceptable use policy.
Independent audit
After launch, we will have the no-logs design and our server configuration audited by an independent firm and publish the full report on this page.