What we promise, and what we don’t claim

This matters more than any badge, so we’ll lead with it. Darkmatter VPN LTD provides your account, billing and support. The VPN network itself, meaning the servers your traffic actually passes through, is operated by a third-party network partner whose service we resell under our own brand.

That split decides who holds what. We hold the information that identifies you as a customer. Our network partner handles the connections. Neither of us holds the whole picture, and we think you should know which half is which before you read anything else on this page.

Because the network isn’t ours, your browsing never reaches our systems: we can’t produce it, sell it, or lose it. But we do hold a real identity and billing trail, and pretending otherwise would be the exact dishonesty this page exists to avoid.

Darkmatter VPN LTD is a UK company, and our terms are governed by the law of England and Wales. UK law governs us and every record we hold about you: your account, your billing, your support history. We are the data controller for that data, and a valid UK legal demand would be served on us.

The VPN network we resell is operated by our network partner, outside the UK. In practice that means a request for what you did online would have to go to the network operator, and a request for who you are would come to us. We think stating both is more useful than advertising a favourable jurisdiction that doesn’t actually govern the data identifying you.

This part is entirely ours, and it’s where most of our engineering effort has gone.

• Opaque server-side sessions. Your sign-in cookie carries only a 256-bit random identifier, not a token containing your details. All session state stays on our servers, so a stolen cookie can be revoked instantly.
• Hardened cookies. HttpOnly and SameSite, and Secure in production. Nothing sensitive is kept in browser storage.
• Timeouts and rotation. Sessions expire after 30 minutes idle and 24 hours absolute, and the session identifier is rotated whenever your privilege changes (sign-in, re-authentication) to prevent session fixation.
• You can see and revoke sessions. Every active session is listed in your account, and you can sign out everywhere.
• Two-factor authentication available on every account, not reserved for a higher tier. Your 2FA secret is encrypted at rest with AES-256-GCM, and recovery codes are stored only as one-way hashes and shown to you once.
• Re-authentication for sensitive actions. Revealing your VPN credentials or changing 2FA requires proving it’s you again, even mid-session.
• CSRF protection on every state-changing request, plus rate limiting across sign-in, account, checkout and support.
• Sign-in doesn’t leak who has an account. Sign-in, registration and password reset return the same response whether or not an address is registered.
• Your data isn’t addressable by guessing. Invoices, services and tickets use opaque signed identifiers, and ownership is re-checked on every single request rather than trusted from the URL.

Card details are entered directly into our payment providers’ hosted fields and never touch our servers: there is no route in our system that accepts a card number. We keep only what’s needed to show you the method: card brand, last four digits, expiry, and a gateway token. That design keeps cardholder data out of our infrastructure entirely, rather than merely protecting it once it arrives.

Traffic is protected with modern, standard cryptography: AES-256 encryption, and ChaCha20-Poly1305, the cipher built into WireGuard. Nothing proprietary or unreviewed. Protocols available on the network: WireGuard, OpenVPN, IKEv2, IPSec. These are provided by the network we resell, not implemented by us. More about encryption.

The third parties that touch your data, and why. Full detail, including your rights, is in our privacy policy.

Rights only matter if you can use them. These are the ones you can act on yourself from your account, without having to ask.

You can cancel at any time from the subscription area of your account. Cancelling stops future renewals; it doesn’t, by itself, refund the term you’ve already paid for.

• Your first purchase is covered by a money-back guarantee. Ask within 30 days if you bought a plan of 3 months or longer, or within 14 days if you bought a monthly plan, and you don’t need to give a reason. One money-back refund is available per customer.
• Renewals: cancel before your renewal date if you don’t want to continue. If a renewal charge wasn’t wanted, cancel within 14 days of it and we’ll refund the unused part.
• App Store and Google Play purchases follow the store’s own refund rules.App Store purchases follow the App Store’s own refund rules.
• To ask for a refund, email billing@darkmattervpn.com or open a request from your account.

The refund policy has the full terms, including how renewals work. None of this affects your statutory rights.

Legal demands to Darkmatter VPN LTD are reviewed before any response. We disclose data only where we’re satisfied a request is legally valid and properly served, and we push back on requests that are broader than they need to be. Because we don’t operate the VPN network, the only data we can produce is the account and billing data listed above; requests for network activity would have to go to the network operator. Where the law allows it, we’ll tell you if your account is the subject of a request.

We don’t publish a warrant canary. A canary is only meaningful if it’s backed by a maintained legal-request register, named accountability and a reliable publishing cadence, and one that lapses by accident tells you something alarming and untrue. We’d rather build that process first than publish a signal we can’t commit to maintaining.

If you believe you’ve found a security issue in our website, apps or billing systems, email support@darkmattervpn.com with enough detail to reproduce it. We’ll acknowledge you, keep you updated while we investigate, and we won’t pursue or support legal action against anyone who reports a genuine issue in good faith, gives us reasonable time to fix it, and doesn’t access or destroy other people’s data while testing. Please don’t run automated scans that degrade the service for other customers.