Scope by platform
The Windows and Android applications create a system-level VPN tunnel. Extensions are available for Chrome, Edge, Firefox and Brave, but protect only the relevant browser. Chrome’s documented implementation uses an authenticated HTTPS proxy; internal pages, the FuzeVPN API and deliberately excluded sites remain outside it. Settings for the other three extensions are not inferred from Chrome.
This protects transport. It does not repair a compromised device, recover a disclosed password, neutralise a malicious website or protect data voluntarily supplied to a third party.
Protocols and encryption
On Chrome, the proxy connection is encrypted with TLS over TCP. HTTPS sites use a CONNECT tunnel and retain their encryption to the website; an HTTP site does not provide end-to-end encryption. The TLS version and cipher suite are negotiated, so FuzeVPN does not promise TLS 1.3 or AES-256 for every connection.
On Android, WireGuard uses UDP/51820, Curve25519 and ChaCha20-Poly1305. OpenVPN uses UDP/1194, certificates, server verification and tls-crypt-v2; its negotiated cipher is AES-256-GCM, AES-128-GCM or ChaCha20-Poly1305.
On Windows, WireGuardNT 1.1 uses UDP, Curve25519, ChaCha20-Poly1305, BLAKE2s and HKDF; private keys are locally protected by DPAPI. OpenVPN 3 Core with DCO uses UDP/IPv4 on port 1194 without TCP fallback, with certificates and tls-crypt-v2. Its cipher is negotiated from the server-provided list and cannot be described as always using AES-256.
Account and authentication
Passwords are stored in hashed form. Email verification, password reset and session mechanisms use limited and revocable tokens.
The session cookie is HttpOnly, Secure and SameSite=Lax. Sensitive operations are protected against requests from another origin.
Devices and technical credentials
FuzeVPN keeps the device name, a public key or certificate, internal VPN address and assigned server to configure and revoke access.
Private keys remain on the device. Deleting or revoking a device makes its credentials unusable and frees its place within the 5-device limit.
DNS
On Chrome, proxied website names are resolved by the proxy. The proxy hostname, API, excluded sites and some speculative resolutions use the normal Chrome or system DNS path. The extension imposes no resolver, DNS-over-HTTPS or DNS-over-TLS and therefore cannot guarantee the absence of every local DNS resolution.
On Android, DNS servers come from the VPN configuration and their requests travel through the tunnel. The application adds no DoH or DoT; a browser using its own secure DNS may select another resolver while still remaining subject to VPN routing.
On Windows, configuration-provided DNS travels through the tunnel. OpenVPN enables block-outside-dns and WFP blocks IPv4 DNS outside the tunnel on ports 53 and 853; IPv6 is covered by its separate block. A limited DNS exception exists before connection to reach the API and is then removed. Without the kill switch, an application using DoH on port 443 may bypass the DNS-specific block.
IPv6
On Chrome, public IPv6 web destinations pass through the proxy except for exclusions. IPv6 is not disabled on the computer; local, loopback and link-local IPv6 addresses are blocked while protection is active.
On Android and Windows, a validated dual-stack configuration routes IPv4 and IPv6 through the tunnel. When no VPN IPv6 configuration is available, IPv6 is blocked while the tunnel is active, with no silent fallback to the physical interface. Transport to the VPN server currently remains IPv4.
WebRTC
On Chrome, the default-enabled option applies disable_non_proxied_udp to prevent WebRTC UDP from bypassing the proxy. This global setting may degrade some calls, also applies to excluded sites and does not cover privileged Chrome pages or other extensions.
On Android, WebRTC follows VPN routing but is not disabled in the browser and no dedicated WebRTC filter is added. On Windows, the option blocks non-loopback UDP outside the VPN interface; with the kill switch disabled, TURN over TCP or TLS/443 may still operate outside the tunnel. Local ICE candidates displayed by a browser do not by themselves prove an Internet leak.
Kill switch
On Chrome, the kill switch is enabled by default and blocks new web requests until the connection is verified. Excluded sites and internal API requests remain allowed; voluntarily disconnecting removes the block.
On Android, the kill switch relies on the system “Always-on VPN” and “Block connections without VPN” settings, which the user must enable.
On Windows, the native WFP kill switch covers IPv4 and IPv6. It installs blocking before the connection call, then allows only the VPN service and tunnel interface. After a failure, traffic remains blocked until explicit disconnection. Filters remain if the graphical interface closes, but disappear if an administrator stops the privileged service.
No VPN activity logs
FuzeVPN does not retain visited websites, content, DNS queries, source IP addresses linked to sessions, connection times, durations or the history of VPN servers used.
Servers process traffic in memory only for as long as needed to route it. FuzeVPN creates or centralises no application connection log.
Technical logs and monitoring
The VPS infrastructure is self-managed and deployed from a shared configuration that the publisher checks at every deployment; no independent audit has been carried out to date. These checks confirm the absence of persistent system logs; any transient in-memory events contain neither traffic content, browsing history nor a durable association between a person and a VPN session.
Providers separately retain certain platform logs described in the Privacy Policy. FuzeVPN monitoring uses only aggregate infrastructure metrics rather than an individual browsing history.
Infrastructure and backups
Accounts are hosted by OVH SAS in France. Backups are encrypted and the remote copy is limited to Cloudflare R2’s European Union jurisdiction.
IONOS SARL, OVH SAS provide virtual private servers hosted in physical data centres associated with a region. The location list is published on the home page; the country shown for each one is the country of its exit IP address.
Availability and response
The service may be interrupted for maintenance, incidents, security updates or provider failures. No location, speed or access to a third-party service is permanently guaranteed.
During an incident, access may be revoked, services isolated and backups restored. Personal data breaches are assessed under the applicable GDPR procedure.
What depends on you
Use a unique password, keep devices updated, revoke lost devices and check that the VPN connection is active before sensitive use.
Report unusual activity promptly to contact@fuzevpn.com. A VPN does not replace updates, strong authentication available on other services or vigilance against fraud.