Last updated: 18 July 2026 · Operated by URSA Mobile, Inc.
The short version. Draco is a post-quantum VPN. We do
not log your browsing, the sites/apps you use, your DNS queries, your traffic content, or the
timestamps and bandwidth of your individual connections. We keep only the minimum account and
technical data needed to run the service and bill paid plans. We do not sell your data.
1. What we collect
Account. Your email address and a hashed password (your URSA account, shared
with other URSA products if you use them). Used to sign you in and tie your plan to your account.
Plan & billing. Your tier (free / personal / business / bundled). Paid plans
are invoiced through our payment processor (Intuit QuickBooks); card details are handled by the
processor, not stored by us.
Technical connection data (transient). To route your tunnel, our control
plane records the exit you enrolled on, your device's public WireGuard/Rosenpass keys, and an
internal VPN IP assigned to your device. Your private keys never leave your device. This is
connection setup data, not a record of your activity.
2. What we do NOT collect or log
No browsing history, destination sites/apps, or DNS query logs.
No traffic content (it is end-to-end encrypted through the tunnel).
No per-session bandwidth or activity timestamps tied to your identity.
No selling, renting, or sharing of personal data with advertisers or data brokers.
3. Post-quantum encryption
Draco protects your tunnel with a hybrid post-quantum key exchange (WireGuard's X25519 combined with
NIST ML-KEM via Rosenpass) so traffic captured today cannot be decrypted by a future quantum computer
("harvest-now, decrypt-later" defense). We never see your keys or your traffic.
4. How we use data
Only to: authenticate you, provision and route your VPN connection, provide support, bill paid plans,
and keep the service secure and reliable. We do not build advertising profiles.
5. Sharing
We share personal data only with service providers that operate the product (e.g. our payment
processor for billing, and infrastructure providers that host exit servers), and only as needed to run
the service, or where required by law. Exit servers run in RAM and hold no persistent activity logs.
6. Retention
Account and billing records are kept while your account is active and as required by law/accounting.
Connection-setup records are transient and are cleared when no longer needed to route your device.
7. Your rights
You may access, correct, export, or delete your account data. Deleting your account removes your
personal data except records we must retain for legal/accounting reasons. Contact us to exercise these
rights.
8. Children
Draco is not directed to children under 13 (or the age of digital consent in your region) and we do
not knowingly collect their data.
9. Changes
We may update this policy; material changes will be posted here with a new "last updated" date.