Privacy Policy — RuSolv

Last updated: October 4, 2026
Effective from: May 19, 2026

1. Introduction

RuSolv (hereinafter — "Service", "we") is a VPN service providing access to modern traffic encryption protocols for users in regions with internet restrictions.

This Privacy Policy describes what data we collect when providing services, how it is used, and what measures are taken to protect it.

By using the Service, you agree to the terms of this Policy. If you do not agree with any of the terms — please do not use the Service.

2. Who we are

RuSolv is a VPN service operated by a private operator.

Legally significant requests should be directed to: legal@rusolv.com

3. What data we collect

3.1 Account data

• Email address — required for registration, password recovery, and account-related notifications; also used for messages about Service news, which you can unsubscribe from (see Section 5).
• Password hash — the password is stored only as a cryptographic hash (scrypt; for accounts that have not signed in since June 2026, bcrypt until their next sign-in). The original password is not saved and cannot be recovered.
• Technical session data — during registration, authentication, and use of the personal account, technical session data may be recorded, including but not limited to source IP address and port, and login time. This data is used to ensure account security and prevent automated abuse.
• Telegram ID, username and the name in your Telegram profile — if you use the bot or the Mini App, or sign in with Telegram.
• VLESS device data — the device identifier (HWID), operating system and model your app reports, to enforce the device limit.

3.2 Payment data

Payments are processed by third-party payment providers. The Service does not receive and does not store your payment card, bank account, or cryptocurrency wallet data.

From the payment provider, the Service receives only:

• Transaction identifier
• Payment amount and currency
• Date and time of payment
• Transaction status

3.3 Service usage data

• Subscription metadata — subscription identifier, tariff type, activation date, expiration date, status.
• Aggregated traffic counters — total bytes transferred and received per connection. Data is not broken down by request, time of day, or traffic destination.
• Personal account session metadata — authentication tokens, last login time.
• Servers given to you — which of our servers were given to your subscription or connection, the address each server had at that moment, and when it was first given. Only the first time is kept for each server address.
• Configuration downloads — when a configuration was created or downloaded again, and which server it names, by address or by name. Kept for 30 days.

3.4 Operational data

• Error and Service operation logs — recorded for diagnostic purposes and to ensure operability. Do not contain user activity within the VPN tunnel.
• Personal account authorization logs — successful and unsuccessful account login attempts.
• VLESS connection log on the server — time, source address, destination address and connection identifier. Kept about 20 minutes, only to enforce the device limit.
• Aggregated network statistics — how many connections each server receives from each provider network, per hour, with no user identifiers.

4. What data we do NOT collect

The Service does not collect and has no technical capability to reconstruct (the one exception is the VLESS connection log on the server, kept about 20 minutes — see Section 3.4):

• ❌ Browsing history of visited websites
• ❌ User DNS queries
• ❌ Source and destination IP addresses of traffic
• ❌ VPN traffic content
• ❌ Information about applications and protocols used within the VPN tunnel
• ❌ A history of your connections — when and how often you connected (only the time of the last activity of each configuration and device is kept)
• ❌ User geolocation beyond general IP-based information at authorization time
• ❌ Biometric data

The Service does not display advertisements and does not transfer user data for marketing purposes.

5. How collected data is used

Collected data is used exclusively for the following purposes:

• Account creation and authentication
• Billing and payment processing
• Monitoring service usage within paid tariff limits
• Ensuring Service operability and security
• Communication with you on account matters
• Messages about Service news (for example, new locations) — in the Telegram bot or by email. You can unsubscribe at any time: via the “Unsubscribe” link in the email or in your account settings (“Tips & news”); messages about your account will still arrive
• Referral program: if you registered through a referral link, the user who invited you sees the date you registered, the total of your top-ups and the bonuses credited to them for those top-ups (each bonus shows the time and size of the top-up), a bonus being cancelled when a top-up is refunded, and whether your account is active. Your name, email and Telegram are not shown to them
• Compliance with applicable legislation

6. Data retention periods

When you delete your account, its personal data is deleted irreversibly: from the account at once, from service logs within 30 days, and from backups as they are replaced (normally within 30 days). What remains is an anonymous record of payments and transactions, for accounting; your Telegram ID if you claimed the channel-subscription bonus, so it cannot be claimed again; and payment notifications already sent to the operator (Section 7).

7. Third parties

To ensure Service operation, a minimum set of third-party services is used:

• Payment providers — for processing payment for services.
• Encryption and obfuscation services — for ensuring VPN protocol functionality.
• Hosting providers — for hosting infrastructure servers.
• Email delivery provider — Resend (resend.com), for sending the Service's emails.
• Telegram — the bot, the Mini App and support run on Telegram; Telegram sees your messages to the bot and to support. Notifications to the Service's operator (about payments, code activations and the like) go to the operator's Telegram channels and contain the buyer's email or, if there is none, their Telegram username or ID.
• Cloudflare — bot protection on the registration form (Turnstile) and the site's DNS.
• Lava — card and SBP payments; for autopay, Lava receives your email.

These services are not provided with identifying personal user data (email, full name, etc.), with these exceptions: the email delivery provider receives the recipient's email address and the message content, solely to deliver that email; when paying with cryptocurrency, the payment provider Cryptomus (cryptomus.com) receives the buyer's email address, if the account has one, for the payment invoice; for autopay, Lava receives the buyer's email; and the operator's Telegram notifications contain the buyer's email or Telegram identifier (see above). Otherwise, only technical data minimally necessary to provide the corresponding functions is transferred.

The Service uses the Google Analytics and Yandex.Metrika web analytics systems. The content of personal-account, partner and admin pages is not sent to them.

The Service does not use:

• Advertising trackers and pixels
• Third-party cookie tracking systems
• Social widgets (like, share buttons, etc.)

8. Government requests

In case of receiving an official request from law enforcement or other authorized bodies:

• The Service transfers only the data it possesses at the time of the request
• Data disclosure is made only under a legally binding request in the applicable jurisdiction
• The Service does not transfer data in response to informal requests or requests without sufficient legal grounds

9. Your rights

You have the right to:

• Access — request a copy of your data held by the Service
• Deletion — demand deletion of the account and associated data
• Rectification — request correction of inaccurate data
• Export — receive your data in machine-readable format
• Withdrawal of consent — stop using the Service at any time
• Unsubscribe from news — opt out of messages about Service news at any time: via the “Unsubscribe” link in the email or in your account settings (“Tips & news”); messages about your account will still arrive

Direct requests to: privacy@rusolv.com

A response is provided within 30 calendar days from receipt of the request.

10. Data security

The Service applies generally accepted technical and organizational data protection measures:

• Encryption of data transmission (TLS 1.2+)
• Cryptographic password hashing
• Encryption of sensitive data in the database
• Protection against automated attacks (login attempt rate limiting, brute-force protection)
• Regular server software updates
• Minimization of collected data volume

Despite the measures taken, no service on the internet can guarantee absolute security. By using the Service, you acknowledge this risk.

11. Minors

The Service is not intended for persons under 16 years of age (or the age of majority in your jurisdiction, if higher).

If we become aware that data of a minor has been collected without proper consent — such data will be deleted immediately. Report any suspicions to privacy@rusolv.com.

12. Changes to this Policy

The Service may make changes to this Policy.

For material changes, you will be notified via email to your account or via notification in your personal account at least 30 calendar days before the changes take effect.

Non-material changes (clarifications, contact information updates) may be made with an update to the date at the beginning of the document without separate notification.

Continued use of the Service after changes take effect means agreement with the updated Policy.

13. Contact us

This Privacy Policy is drafted in Russian and English.
In case of discrepancies between language versions — the Russian version takes precedence.