What Data Can a VPN Provider Actually See

Before answering "what is a VPN," a lot of people are really asking something more specific: once I'm connected, what can the provider itself see about me. That question deserves a real answer — using a VPN doesn't make you invisible to everyone, it just moves what's visible to a different place, into different hands.

This covers who sees what, and when: where your local network, the VPN provider, and the destination site each stand at the moment of a connection; exactly what a provider technically handles the instant a connection is made; and what stays out of its reach no matter how the policy is written.

One boundary worth setting first: this covers what the VPN provider's side sees, not the destination site's side. Which account you're logged into, what you bought, what you typed — the destination site keeps its own record of that, and it's not something a VPN reaches into. That line gets drawn more precisely further down.

Who actually handles your traffic at the moment of connection

Break a single connection into three positions: your local network (home Wi-Fi, an office network, or a phone signal), the VPN provider in the middle, and the destination site at the far end. Without a VPN, the local network can see exactly which site you're connecting to; with one, the local network only sees that you connected to the VPN — it loses sight of the actual destination. The basics of VPN encryption covers the mechanics of that part in more depth.

It helps to flip the view around: without a VPN, your ISP sits between you and the entire internet, seeing every site you connect to. With one, there's now an extra layer between you and the ISP — the ISP sees only "connected to a VPN" and loses the destination. But the VPN occupies roughly the position the ISP used to occupy, so what it sees is, unsurprisingly, similar in kind.

So "the local network can't see it" and "no one can see it" are not the same claim — what's visible moved to the VPN provider's side instead. The rest of this covers exactly what that new vantage point can and can't see, and how much of the picture each half actually covers.

What a provider technically handles the moment you connect

• Your real outbound IP — the address your device uses to reach the node. This is a precondition for the connection existing at all, and no provider, however strict its policy, skips this step. That IP only applies to that one moment with that one node — it's a different thing from whatever address your device uses on other networks, and it changes the moment you switch networks or nodes.
• When the connection started and ended — timestamps that exist naturally as part of any connection, not something collected on top of it. On their own, though, a timestamp doesn't map to what you were actually doing at the time.
• How much data moved over that connection in total — a number providers typically use for operations and rate-limiting, and a different thing entirely from content. It's a total; it doesn't tell the provider which site or app that data belonged to.
• The address you're connecting to has to pass through it at the routing level — the same logic as a courier hub: the hub needs to know which branch a package is headed to before it can forward it. Domain information can pass through briefly at this stage even when the content itself is encrypted and unreadable.
• Roughly whether a connection is one long transfer or a string of small intermittent exchanges — that coarse pattern is visible at the traffic level on its own, without reading any content, which is exactly why "the content is encrypted" doesn't mean "nothing about it is visible."

What stays completely out of reach during that same window

• The actual content inside a page or an app — what you typed, what you sent, which specific page you viewed — once the destination site's own encryption (the padlock in the address bar) has processed it, this layer can't read it.
• Which account you're logged into on the destination site, or what you filled into a form there — that's the destination site's own record, never something a VPN layer can read, and that stays true no matter which provider is in the middle.
• Whatever you do on the device after disconnecting — that's entirely outside anything a VPN touches, unrelated to the connection that just ended, and it doesn't leave a trail just because a connection happened earlier.
• Whatever other apps are installed on the device, or what files are stored on it — purely local information that has nothing to do with whether a VPN is connected; a VPN never had access to that layer in the first place.
• Any other traffic on the same device that isn't routed through this particular connection — if only some apps are set to use the tunnel, the rest was never inside this layer's coverage to begin with. That's not the VPN "missing" something; it was simply never asked to handle that traffic, and the difference is worth keeping straight so the scope of protection doesn't get overestimated.

What a no-logs policy changes is the step after seeing it

Everything listed above is what technically passes through at the moment of connection — it is not the same claim as "the provider recorded it." Those two ideas get blended together constantly, but they're not the same thing at all: passing through doesn't mean it gets written down and kept.

For example, a provider can genuinely do both at once: handle your IP the instant a connection is made, and also clear that piece of information from memory thirty seconds later, never writing it to any database. Those two things aren't in tension — they're two different stages of the same event.

Whether something gets retained, for how long, and what happens to it afterward is exactly what a no-logs policy answers, and that's a different layer from what technically passes through at the moment of connection — one is about whether something exists at all, the other is about whether it gets written down. What a no-logs policy actually means covers how to read that second part properly.

What this actually changes in practice

If the worry is "can my local network or public Wi-Fi see what I'm browsing," VPN encryption is the layer that answers it directly — that's exactly the part it covers. If the worry is instead "will this connection get recorded and leave a trail," the answer depends on how seriously the no-logs policy is written, not on encryption — two different worries, two different answers, and mixing them up tends to produce a conclusion that sounds right without actually being right.

Switching nodes changes the address the destination site sees; it doesn't change whether the provider itself knows this is your account. The same login, the same payment details — that layer doesn't disappear just because the node did. This is exactly where no-logs and "anonymous" get confused for each other.

As for whether a free product puts this data to some other use, the real cost of free VPNs covers that — a product not funded by subscriptions makes the data itself a more likely revenue source, and that's worth weighing when judging whether a product deserves trust, more so than the marketing copy. The same connection information behaves very differently depending on whether it lands with a subscription-funded product or a data-funded one, and that difference is the one actually worth caring about when choosing a provider.

In summary

A VPN doesn't make you invisible to everyone — it moves who can see what you're connecting to from the local network over to the VPN provider. The provider technically handles the outbound IP, connection timing, data volume, and destination address at the moment of connection, but it can't see the content itself, can't see which account you're logged into, and has no reach at all into anything after you disconnect. Listing these out is what turns "can a VPN protect privacy" into a specific, checkable answer instead of a vague "probably."

To start from what a VPN solves in the first place, what a VPN is covers that from the ground up. FastOrange runs a no-logs policy and doesn't turn this connection information into a long-term record tied back to an account — signing up gets free trial time every day, and testing it yourself says more about whether that promise holds up than any of this does.