VPN privacy policies decoded: StrongVPN

This post is part of a series reviewing the privacy policies of popular VPN services. The aim is to find out whether the VPN takes customer privacy seriously. This is not intended as a review of a VPN service, which would need to take into account a number of other factors. For more privacy guides and our criteria for reviewing them, click here.

StrongVPN is one of the bigger VPN services on the market. It’s based in the US and has servers across Europe and Asia. But how does its privacy policy stack-up?

Logging practices

When it comes to logging data StrongVPN follows a similar policy to Hide My Ass and records the following:

“1.time, date and location vpn connection was made 2. duration of the vpn connection 3. bandwidth used during the connection”

StrongVPN says it does not monitor the websites you visit or the files you download “in normal course of duties”. But it states that “if there’s a violation” it will use its logs “to determine which account is in violation.”

“After lengthy analysis of this data, we will terminate the service and/or take further action."

So while StrongVPN doesn’t necessarily log websites, it’s likely that it will use connection logs to highlight suspicious accounts, and then start logging your browsing activity to confirm if you are in violation of its terms. This is why it adds the “normal course of duties” disclaimer. This also leaves open the possibility that StrongVPN spies on your web browsing based on erroneous suspicions.

More importantly,  as far as well can tell, StrongVPN does not say how long it holds onto its customers’ data, which is a pretty serious oversight for a privacy service and should set alarm bells ringing.

StrongVPN is very clear about its policy on DCMA. It says it maintains a log of DMCA Notices and will “identify customers or account holders who may be engaging in repeated copyright infringement.” 

Cookies and ad data

StrongVPN participates in the Truste privacy program, which is welcome. But it also admits to collecting information on customers through various means for advertising purposes. It says is willing to hand this data over to anyone it likes. Here’s what the policy says: 

“StrongVPN.com may use personally identifiable information collected through our Web site to contact Users regarding products and services offered by StrongVPN.com and its trusted affiliates, independent contractors and business partners, and otherwise to enhance Users’ experience with StrongVPN.com and such affiliates, independent contractors and business partners. StrongVPN.com may also use information collected through our Web site for research regarding the effectiveness of the Web site and the marketing, advertising and sales efforts of StrongVPN.com, its trusted affiliates, independent contractors and business partners."

“Trusted affiliates, independent contractors and business partners” could mean pretty much anyone. Of course many websites happily hand over data to third parties for advertising purposes. What StrongVPN is doing is not uncommon at all. But is this really appropriate behaviour for a company that is offering a privacy service?

To sum up…

StrongVPN’s privacy policy leaves a lot to be desired. It’s written clearly,  but there’s no information on how long it stores your data, which is big problem. There’s also no information on what happens if law enforcement requests data, or if laws in its jurisdiction regarding VPNs change. Also, while StrongVPN says it does not log the websites your visiting, it leaves open the possibility it will log your web browsing if you come under suspicion. 

Comments icon
We invite you to discuss this post in our Reddit community or on Twitter. You can also send your feedback to blog@ivpn.net.
Tags: Privacy

Comments

Wanter

30.07.2015

StrongVPN no longer keeps any logs, article needs updating

Most people don't need a commercial VPN to work from home securely

Posted on April 7, 2020 by Nick Pestell

Many small businesses and their employees are concerned about the security of their data whilst working from home during the coronavirus pandemic. We see a lot of confusion surrounding this topic, even from fairly technical folk and there is unfortunately a lot of misinformation being spread by commercial VPN providers themselves.

You can't always get what you want: the eternal conflict between lawful access and privacy

Posted on April 19, 2018 by mirimir

In late March, the US Clarifying Lawful Overseas Use of Data Act (CLOUD Act) took effect. And predictably, the US Supreme Court just dismissed United States v. Microsoft Corp. In that case, Microsoft was fighting a subpoena for data stored in an Irish data center.

Protect yourself today and get peace of mind

Shut out hackers, identity thieves and the global government surveillance apparatus — every time you go online.