Traffic between your device and our server is encrypted. Along the way it is not readable by the owner of the Wi-Fi, by other devices on that network, or by the network you went online through. Site content is protected on top of that by the sites' own HTTPS: it is encrypted from your browser all the way to the site and stays closed inside the tunnel too.
A VPN protects the channel; it does not make you anonymous. If you sign in to an account, the service knows you by that account whatever address you arrived from. Nor does a VPN cure viruses, phishing emails or weak passwords: two-factor authentication and care with links matter just as much.
For the subscription to work and payments to arrive, a minimum of service data is needed: your account, the access period, payment history, the token of your subscription link and the list of devices connecting through it. Some of that you can see yourself: devices and their last activity on the My devices page, access status and payments in your account.
We do not sell this data and we do not use it for advertising. To be straight with you, though: the service cannot run blind. The server your traffic passes through can technically see the addresses you reach, although not the page contents inside HTTPS. That is how any VPN works, and promises of "we know nothing at all" are worth reading with that in mind.
A link of the form https://subscription.obfsn.com/c/<token> opens access on its own, with no password. Hence a few simple rules:
Payments go through the payment services themselves: SBP via YooKassa and Telegram Stars. You confirm an SBP transfer in your bank's app and a Stars invoice inside Telegram. You enter the payment details there, and they never reach us. Internal balance and promo codes do not go through payment services at all: balance pays for the subscription inside your account, and a promo code simply adds days.
The easiest way to check that the connection really goes through our server: open any IP-detection service with the VPN on and with it off. The address and region should differ. And if you are unsure about the servers themselves, look at server status, which shows availability and latency per location.