When you use a proxy, your traffic passes through someone else's infrastructure. What can the owner of that infrastructure technically see, and what does it record in practice? How realistic is the claim "we keep no logs"? These questions sit at the center of the relationship between proxies and privacy.
In this article we look at the types of logs, how much of it is technically unavoidable, and how to build a realistic privacy expectation.
What Can a Proxy Technically See?
What is visible depends on the protocol. The most critical distinction is between HTTP and HTTPS:
HTTPS hides the content from the proxy, but it does not hide where you are connecting . Metadata — which site, when, how much — remains visible in every case.
You can find the practical consequences of this distinction in our is a proxy safe article and in our header behavior article in detail.
Log Types
When the industry says "no-log", what is usually meant is that levels 3 and 4 are not kept; levels 1 and 2 are in practice mandatory for billing and abuse prevention.
How Realistic Is the "No-Log" Claim?
Running a service that keeps no records at all is not feasible in practice. At a minimum, the following are required:
- Billing: To charge per GB, you have to count consumption.
- Quota management: Detecting limit overruns requires counters.
- Abuse prevention: When a complaint comes in, it is necessary to determine which account is responsible.
- Debugging: For "I can't connect" support, at the very least the most recent connection attempts are examined.
- Capacity planning: Pool health and load distribution require measurement.
Instead of "Do you keep logs?", ask the following: which fields are recorded, how long they are retained, who can access them, and under what conditions are they shared with third parties? Look for the answers in writing in the privacy policy.
Retention Period and Legal Framework
The legislation of the country where the provider is based directly affects record keeping and retention periods. For service providers operating in Turkey, retaining access records for a certain period is a legal obligation; similar regulations exist in many countries.
On the personal data side, the KVKK and GDPR frameworks come into play: an IP address counts as personal data, its processing must rest on a legal basis, and its duration must be limited. We publish our own privacy practices on our privacy policy and KVKK disclosure notice pages.
A sound policy clearly defines the duration and the access authorization of each stage. The phrase "we keep it indefinitely" is a red flag for privacy.
Log Hygiene on Your Own Side
The privacy risk lies not only with the provider but also in your own system. Automation logs frequently leak credentials and personal data:
The place where proxy credentials leak most often is not the provider's logs; it is the developer's own debug output.
A Realistic Privacy Model
The privacy a proxy provides changes according to the question "who are you hiding from":
A proxy hides you from the target site ; it does not hide you from the proxy provider. That is why choosing a provider is a trust decision, not a technical one.
A free proxy run by an unknown operator can read and record all of your plain HTTP traffic. Do not carry out any transaction involving account logins, payment details or personal correspondence over such addresses. The limits are covered in our free proxy article in detail.
Questions for Evaluating a Provider
- Which log fields are explicitly listed in your privacy policy?
- How many days is the retention period, and how is destruction at the end of it verified?
- For which legal requests is data shared, and is there a transparency report?
- How many employees can access log data, and are access records kept?
- In which country is the infrastructure hosted, and which legislation is it subject to?
- Are payment details linked with traffic records?
Summary
A proxy service that keeps no logs at all is not feasible in practice; the real issue is which fields are kept, for how long, and who can access them. HTTPS hides content from the proxy but does not hide metadata. A proxy hides you from the target site, not from the provider — which is why choosing a provider is a trust decision. Don't neglect log hygiene on your own side; most credential leaks arise from your own debug output. To see what your connection actually leaks, run our DNS leak, WebRTC leak and anonymity test tools.