What a VPN can and cannot see
While a VPN is carrying your traffic, the exit has to see where each connection is going, or it could not forward it. That is not the same thing as keeping a browsing history. Kovalink’s access history is off by default. When an administrator turns it on, the service keeps a short daily summary — connection times, counts, byte totals, and observable destination domains or IP addresses and ports — for seven days, then deletes it. Encrypted page contents, passwords, and messages are not read. The notice does not make a stronger claim than that.
What the exit sees because it forwards
The privacy notice states it directly. The Kovalink egress server carries your internet traffic while you are connected. A VPN server necessarily receives and forwards your traffic, so it sees the destination addresses of that traffic. Seeing a destination while forwarding is not the same as writing it down, and not the same as opening the packet. The full text is the privacy notice. Nothing here replaces it.
What access history keeps when it is on
Access history is defined for each access grant, aggregated by UTC day. The service keeps connection timestamps, connection counts, upload and download byte totals, and the observable destination domains or IP addresses and ports — and nothing beyond these fields.
Encrypted page contents, passwords, and messages are never read, and no TLS interception is performed. The history is destination metadata, not page contents. Domain names that stay encrypted in transit, encrypted DNS or ECH, may never appear as names at all, so it is not a complete browsing history.
Entries are kept for seven days, today plus the previous six. The service itself deletes expired days automatically. Revoking a grant deletes that grant’s history immediately.
The history is visible only to the private administrator, through an administration page served only on the server machine’s loopback address. It is not exposed publicly and is never shared with any third party. That page is served on the server machine itself, not on a public address.
The default is off
Recording is off by default and is switched on explicitly by the administrator. While it is off, none of these fields are kept. Whether it is on or off changes nothing about how the app works. The in-app notice you accept before first use, consent version kovalink-access-v1, has covered this access history since that version was introduced.
The notice then says it does not make stronger claims than this. Encrypted page contents, passwords, and messages are not read, and a complete browsing history is neither recorded nor claimed. Destination metadata for forwarded traffic is necessarily visible to the service while it forwards it, and is kept only under the access-history rule above, when recording is on. Domain names that stay encrypted in transit may not be observable as names at all.
What is not collected
The notice lists what Kovalink does not collect. Page contents, passwords, messages, or anything inside your TLS sessions. Contacts, photos, location, advertising identifiers, or device telemetry — and no contact information beyond the email address you yourself provide when signing in. Payment card or Apple ID credentials. Third-party analytics of any kind. There are no such SDKs in the app.
On the client, the same boundary is stated from the other side. The client embeds no analytics SDKs, ad networks, or third-party code beyond the networking engine. DNS requests from your device are carried through the tunnel to the profile’s configured resolvers — Cloudflare’s public resolvers by default — and are not leaked to the local network.
On your device, in the Keychain, this device only and not synced, the notice describes a random installation identifier: a UUID generated on first launch. It is not derived from your name, your Apple ID, or a hardware serial number. It is not an authentication secret, and it is never printed or logged. After access is granted, the validated connection profile is kept there too. While an invitation redemption is in flight, the one-time code and its retry markers are held and deleted once the redemption settles.
Signing in is optional. It exists so your access can follow you to another device. If you never sign in, nothing in the account part of the notice is collected. If you do, that part lists the fields, and states they are used only to sign you in and to restore your access, never for advertising or to track you across apps or services. Purchases go through Apple’s StoreKit. Kovalink never receives your card, bank, or Apple ID credentials.
Separate from access history, the pairing service keeps service request logs: method, path label, and status code per request. Those lines have no client identifiers, no invitation codes, and no query content. They are not a record of the sites you opened.
What never reaches the exit
The egress sentence is about traffic the server forwards while you are connected. Smart routing sends mainland China sites direct, by default, and does not detour them. Those packets do not arrive at the egress server, so the server does not see their destinations, and access history has nothing of theirs to keep. Your ordinary network sees that traffic, as it would with the VPN disconnected. Overseas traffic, including what you use from a hotel network, does enter the tunnel. Travel and hotel Wi-Fi is the setting where that half of the split is the one you came for.
What you can do, and what Kovalink does
You connect or disconnect at any time with the single button. On-demand connecting is an optional setting and stays off unless you enable it. You can request deletion or revocation of your grant and its access history on the support page. The administrator can disable a grant immediately, and revoking a grant deletes that grant’s history immediately. The latest app is still the same one-button VPN: Auto picks a server or you pick one from Nodes, and Smart routing stays on until you switch Routing to Global.