WE KEEP
NOTHING.

This document describes the privacy behaviour of the mobile application published by Pegora Labs (the “App”). The App is a thin, single-purpose client whose only function is to establish a connection to the public Tor network and route your device traffic through it.

The short version — and there is genuinely no long version — is this: we do not run any infrastructure that your App talks to. There is no TOR Pegora VPN server, no account system, no analytics pipeline, no advertising identifier, no crash reporter, no marketing pixel and no database anywhere in the world holding information about you. The App is a local piece of software that speaks directly to Tor relays operated by volunteers around the world.

// REDACTED SEGMENTS PRESENT — hover a block to peek, or press [DECRYPT] in the header to reveal the whole file.

This policy applies exclusively to the App binary distributed by Pegora Labs. It does not apply to the websites you visit through the App, to the Tor network itself, or to any third-party software bundled inside the App beyond the components named in §07.

The table below is exhaustive. Every category of data that a mobile application could plausibly gather is listed, together with our answer. There are no footnotes and no “except where required by law” collection clauses hidden beneath it.

We do not sell personal data, we do not rent it, we do not share it, and we do not exchange it — because there is no personal data in our possession to begin with. A sale requires an asset; we hold none.

When you tap connect, the App hands your traffic to a Tor implementation running on your device. That implementation builds an encrypted circuit through three independently operated relays and exits to the public internet from the final relay. TOR Pegora VPN is not present at any point in that path. We do not operate a guard relay, a middle relay, an exit relay, a bridge, a directory authority or a VPN endpoint.

# what leaves your device when the App is connected

[YOUR DEVICE]  ──TLS──▶  GUARD RELAY     operated by: an anonymous volunteer
                          │  sees: your real IP, encrypted payload
                          ▼
                        MIDDLE RELAY    operated by: an anonymous volunteer
                          │  sees: guard IP, exit IP, encrypted payload
                          ▼
                        EXIT RELAY      operated by: an anonymous volunteer
                          │  sees: destination, payload (decrypted if not HTTPS)
                          ▼
                     [DESTINATION WEBSITE]

TOR Pegora VPN APPEARS NOWHERE IN THIS DIAGRAM.
no proxy of ours · no logging node of ours · no account of ours

What each party can observe

• Your internet service provider / mobile carrier can see that your device is sending encrypted traffic to a Tor relay. They cannot see the destination or contents, but the fact that Tor is in use may be visible to them.
• The guard relay learns your real IP address. It cannot read your traffic.
• The exit relay learns the destination you are contacting. If the connection is not end-to-end encrypted (no HTTPS), it can also read the contents.
• TOR Pegora VPN learns nothing. We are not on the path, we receive no report, no ping, no heartbeat and no metric from your installation.

Mobile operating systems require an application to declare the capabilities it needs. Every permission below exists solely to make a local Tor circuit work. None of them is used to profile you, and none of the data they could touch is transmitted to us.

You may revoke any optional permission at any time in your operating system settings. Revoking INTERNET will simply stop the App from connecting — it will not trigger any notification to us, because there is nothing for it to notify.

• No activity logs. We do not record which sites you reach, when you connect, how long you stay connected, or how much data you transfer.
• No connection logs. No timestamps, no source IP addresses, no session identifiers, no handshake records.
• No analytics. The App contains no analytics SDK — not Firebase Analytics, not Google Analytics, not Amplitude, not Mixpanel, not Crashlytics, not Sentry, not any equivalent.
• No advertising. No ad SDK, no ad network, no attribution SDK, no install-referrer tracking, no deep-link fingerprinting.
• No cookies, no pixels, no beacons. This policy page itself is a static document. It sets no cookies, loads no third-party scripts and fires no tracking requests. The only external resources it fetches are two open-source font stylesheets from a public CDN, which are requested by your browser without any identifier attached by us.
• No fingerprinting. We do not compute, combine or infer a device fingerprint, and we have no data set against which one could be matched.

The only bytes the App writes are written into the private storage area that your operating system reserves for it. That area is sandboxed, is not readable by other applications under normal conditions, and is never synchronised to us.

Uninstalling the App removes all of the above. There is no server-side copy to delete, because no server-side copy was ever made.

The App is a thin shell around well-known open-source building blocks. We list them here because their behaviour is part of your overall picture, and because transparency about a dependency chain is the only honest form of disclosure available to a project of this size.

• Tor implementation (Tor / Arti libraries). Open-source software maintained by The Tor Project and its community. It communicates directly with Tor relays. It is not a TOR Pegora VPN product and we do not modify its privacy behaviour.
• Flutter engine and Dart runtime. Open-source application framework by Google used to build the interface. The App does not enable or bundle any Google analytics, advertising or crash-reporting service on top of it.
• Platform networking stack. The sockets, TLS and permission layer provided by Android or iOS themselves.
• Open-source fonts. Typefaces served from a public CDN for this document's rendering only.

No component in the App is configured to report usage back to TOR Pegora VPN. Where a bundled library is capable of contacting its own upstream project (for example to fetch the public Tor directory consensus), that traffic goes to the volunteer Tor network — not to us — and is governed by that project's own policies.

This is the one place where somebody other than TOR Pegora VPN may see information about you, and it is worth stating plainly.

If you download the App from an app marketplace (for example Google Play or the Apple App Store), that marketplace operator — not us — processes your account details, your device information, your payment method and your download/install events under its own privacy policy. We have no access to that data, we receive no buyer list, no install attribution and no per-user download report. Aggregate, anonymous store statistics (total installs, country-level breakdowns, crash-free session percentages reported by the platform) may be visible to us as the publisher, but they cannot be traced back to an individual and they are not combined with anything else, because we hold nothing else.

If you sideload the App from a direct build, no marketplace is involved at all and no download record exists anywhere.

retention {
  personal_data_held        = NONE;
  retention_period          = 0 seconds;   // nothing to retain
  backup_copies             = NONE;
  deletion_on_uninstall     = AUTOMATIC (OS-level);
  deletion_request_channel  = NOT APPLICABLE; // no records exist to delete
  erasure_sla               = INSTANT;
}

how_to_erase_everything {
  step_1 = "Uninstall the App.";
  step_2 = "Done. The operating system wipes the private sandbox.";
  step_3 = "There is no step 3. No remote copy exists.";
}

We do not set a retention period because we do not retain. If you want the local artefacts described in §06 removed, uninstall the App; your operating system deletes the sandbox immediately. Clearing the App's cache and data from system settings achieves the same result without removing the App itself.

Tor is a powerful anonymity tool, but it is not a magic field. You should understand what it does and does not protect against before you rely on it.

What the App helps with

• Hides the destination of your traffic from your ISP or local network operator.
• Hides your real IP address from the websites and services you reach.
• Encrypts your traffic in layered fashion across the circuit.
• Removes the single most common deanonymisation vector of commercial VPNs: a trusted provider that logs everything. We simply are not in the loop.

What it does not protect against

• Exit-node observation. Traffic that is not end-to-end encrypted can be read or altered by the exit relay. Always prefer HTTPS.
• The fact that you use Tor. Your ISP can typically see that your device is talking to the Tor network, even though it cannot see inside.
• Application-level leaks. Other apps on your device, browser plugins, scripts, WebRTC, cookies you already hold, or accounts you are logged into can identify you regardless of the network layer.
• Endpoint compromise. Malware on your device, a rooted/jailbroken handset, a compromised OS or physical access to an unlocked device defeats any network anonymity tool.
• Global passive adversaries. An observer able to watch large portions of the internet simultaneously may perform traffic-correlation analysis. This is a known limitation of the Tor design itself.
• Your own behaviour. Voluntarily submitting a name, an e-mail address or a payment card to a website discloses exactly what Tor was hiding.

Practical hygiene we recommend

1. Keep your operating system and the App updated — most real-world deanonymisation comes from unpatched software, not from broken cryptography.
2. Use end-to-end encrypted protocols (HTTPS, TLS) for everything that matters.
3. Avoid signing into personal accounts while relying on network anonymity.
4. Do not share unique details, files or identifiers that could single you out.
5. Review the permissions of every other app installed on the same device.
6. Verify the App's signature and this document's digest before trusting either.

Regulations such as the GDPR (EU/UK), the CCPA/CPRA (California), LGPD (Brazil), PIPEDA (Canada) and similar instruments grant you rights over personal data held about you. Those rights are fully respected here in the most complete way possible: we hold no personal data about you, so there is nothing for those rights to operate on.

Cross-border transfers

No personal data is transferred internationally by TOR Pegora VPN, because no personal data is transferred to TOR Pegora VPN at all. Your traffic does cross borders as an inherent property of the Tor network — relays are located worldwide and you cannot generally choose their countries. That routing is performed by the Tor software on your device, not by us, and is outside the scope of any transfer mechanism we could offer.

The App is not directed at children under the age of 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from anyone — child or adult. Since the App has no accounts, no registration flow and no data collection whatsoever, it is technically incapable of gathering information from a child.

Tor is a general-purpose privacy technology and the internet reachable through it is not filtered or curated by us. Parents and guardians should decide whether a network anonymity tool is appropriate for a minor in their care and should supervise its use accordingly. If you believe a child has provided information to a website through the App, that information went to that website's operator — please address the request to them, as it never passed through our hands.

This document carries a revision number and an effective date at the top of the page. If the architecture of the App ever changes in a way that introduces data collection — for example if a backend, an account system or a telemetry pipeline were added — this policy will be rewritten before that change ships, the revision number will be incremented, and the new version will be published in the same place as this one, bundled with the App update itself.

We will not notify you by e-mail, because we do not have your e-mail address. Continued use of an updated build constitutes acceptance of the policy shipped with that build. The SHA-256 digest in the sidebar lets you confirm that the copy you are reading is the unmodified original.

[1.0.0]  2026-11-12  Initial publication.
                      Architecture: client-only Tor front-end.
                      Servers: 0 · Databases: 0 · Trackers: 0 · Logs: 0
[-----]  no prior revisions exist

© 2026 Pegora Labs. All rights reserved.

This privacy policy document — including its text, structure, layout, source code, styling, typographic composition, graphical elements and the accompanying “TOR Pegora VPN” name, wordmark and emblem — is the intellectual property of TOR Pegora VPN and is protected by applicable copyright, trademark and international treaty provisions.

• Permitted use. You may view, download, print and keep a copy of this policy for personal, non-commercial reference, and you may link to it.
• Not permitted. Republishing, mirroring, redistributing, translating, adapting, scraping into a dataset, reselling, or presenting this document or any part of it as your own without prior written authorisation from TOR Pegora VPN.
• Trademarks. “TOR Pegora VPN”, the Pegora Labs logo and emblem are marks of Pegora Labs. No licence or right to use them is granted by this document or by your use of the App.
• Third-party marks. “Tor”, “Onion Router” and the Tor onion logo are marks of The Tor Project, Inc. They are referenced here for identification and descriptive purposes only. Pegora Labs is an independent publisher and is not affiliated with, endorsed by, sponsored by or operated by The Tor Project, Inc.
• Open-source components. Bundled third-party libraries remain under their own respective open-source licences, which are unaffected by this notice.
• Disclaimer. The App and this document are provided “as is”, without warranty of any kind, express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose and non-infringement. In no event shall Pegora Labs be liable for any claim, damages or other liability arising from the use of the App or reliance on this policy, to the maximum extent permitted by law.

$ pegora --audit --privacy --verbose

scanning binary ................. OK
network endpoints owned by us .... 0
databases owned by us ............ 0
analytics SDKs detected .......... 0
advertising SDKs detected ........ 0
crash reporters detected ......... 0
outbound calls to pegora.* ....... 0
personal data on file ............ NONE
data sold to third parties ....... NONE
subprocessors engaged ............ NONE

RESULT: THE APP CANNOT DISCLOSE WHAT IT NEVER RECEIVED.
session terminated · circuit closed · nothing retained

EOF ■

If you have read this far you now know everything we know about you, which is precisely nothing at all. That symmetry is the entire product.