# Frequently asked questions

Short answers about what URnetwork is, what it stores, and how to use it. The
[overview](/docs/overview) explains the full architecture, and the
[threat model](/docs/threat-model) keeps the complete technical record.

## The basics

### Is URnetwork a VPN?

It does what you use a VPN for: it encrypts your traffic and changes the
address websites see. The architecture differs. A VPN concentrates everyone
into datacenters with publicly catalogued IP ranges. URnetwork exits through
members' real residential connections in 2,000+ real cities across 90+
countries. The path is you → extender → operator → provider → website. On the
relayed path the provider never learns who you are, and the apps seal traffic
to the provider by default. The [overview](/docs/overview) explains what each
party sees.

### Do I have to share my internet to use it?

No. Using the network and providing to it are separate switches. Installing an
app never turns your device into an exit for anyone else. Providing is opt-in;
see "Sharing your connection" below.

### Is it really free?

Yes. The free tier is a daily data allowance, with no card required, and it is
not a trial. Paid members (UR Pro) fund the network, and the free allowance
refreshes every day out of that. There is no ad or data-sale model. Current
allowances and prices: [ur.io/products](https://ur.io/products).

### Who is behind URnetwork?

BringYour, Inc., a Delaware, USA company, operates the network. Everything is
open source at [github.com/urnetwork](https://github.com/urnetwork): the apps,
the SDK, the protocol engine, and the operator platform. The protocol effort
is documented at [ur.xyz](https://ur.xyz).

### Has URnetwork been audited?

No independent audit covers the protocol, the connect engine, or the
operator's server code. That is the layer the privacy claim rests on. Two
third-party assessments from 2025 cover other surfaces.

**Web application and API:** a credentialed, manual penetration test by an
independent firm, April to May 2025, against the OWASP Top 10 with a review of
OWASP ASVS controls.

**Android app:** a Leviathan Security Group assessment under Google's App
Defense Alliance MASA programme, May 2025, at assurance level AL2. It passed.
Leviathan states the work "should not be read as a holistic security
evaluation or comprehensive penetration test," and it covers Android only.

Neither assessment examined logging, retention, or the data path. What
URnetwork offers instead is continuous verification: all code is public,
F-Droid rebuilds the Android app from published source, and egress is a fleet
of member devices rather than one custodian.

### What platforms can I use?

All of them: Android (Play, F-Droid, Solana dApp Store, direct APK), iPhone
and iPad, macOS, Windows, Linux, browser extensions for Chrome, Edge
and Firefox, and a web app at ur.io. Every app is open source. Each
platform has a getting-started guide in these docs.

### Does it cover my whole device, or just my browser?

The OS apps cover the whole device. Android, iOS, macOS, Windows, and Linux
tunnel everything the device sends: mail, music, games, updates, not only the
browser. The browser extension covers browser traffic. The ur.io web app is
the extension's control plane, not a separate product: sign in once on the web
and it sets up, connects, and re-points the extension for you.

### Can I run URnetwork alongside another VPN?

Not as two device tunnels. An operating system runs one system VPN at a time,
so URnetwork and a work VPN cannot both cover the whole device. The browser
extension is a proxy, not a VPN, so it can run on top of another VPN and cover
browser traffic while the other VPN holds the device.

## Privacy

### Can URnetwork itself see what I do?

No single party sees both who you are and what you do. The provider sees the
destinations it carries but never learns whose traffic it is; the operator
stands in between. The operator knows your account and which provider carried
you but cannot read what you send; the session is sealed end to end to the
provider by default.

| Mode | Operator sees | Provider sees | Default and availability |
|---|---|---|---|
| **Relayed sealed** | your account and source connection, provider association, ciphertext, timing and volume | destination traffic, device and contract id, **not** your real source IP | the native default, out of the box |
| **Relayed standard** | your account and source connection, provider association, inner destinations and packet bytes | destination traffic, device and contract id, **not** your real source IP | the browser and proxy paths, or the seal turned off; with the seal on, a provider that cannot be sealed to is skipped rather than served here |
| **Direct** | less relay involvement | **your real source IP** and destination traffic | opt-in, by turning off Strong Anonymization |

Comparing notes gets them little: the operator writes no destination to its
ledger and cannot read one through a sealed session, and the provider holds no
identity to contribute.

**Limit:** provider independence is not measured, and the operator could
itself run providers. See the [threat model](/docs/threat-model).

### What does URnetwork log?

URnetwork's main service records do not contain a browsing history.

**It stores:** account details you provide, a keyed hash of your IP block, an
approximate city, provider associations, and byte counts.

**It does not store in the transfer ledger:** destinations, hostnames, URLs,
SNI, or ports.

**Limit:** the ingress load balancer's access logs have not been audited, and
the production destination of service stderr is not established. See the
[threat model](/docs/threat-model) for the full record.

### If police show up with a warrant, what can be handed over?

Only what is stored can be handed over, and no browsing history is stored.

**What exists:** keyed hashes of address blocks, an approximate city per
connection, client ids, byte counts, and your sign-up details. The sign-up
details are what can name you: an email or phone number if you gave one, a
wallet address, a payment record.

**Limit:** BringYour is a US company and can be compelled like any operator.
What is stored decides the outcome. The [threat model](/docs/threat-model)
itemizes the records.

### Who are the providers?

Members. A provider is anyone who runs the app and turns providing on, sharing
their connection as an exit. Assume some are curious.

**Limit:** provider independence is not measured, and nothing prevents the
operator from running providers itself. The [threat model](/docs/threat-model)
works through the hostile-provider case.

### Can a provider see what I do?

A provider sees what an ISP sees, for the slice of traffic it carries:
destination addresses and site names. It does not learn who you are; your real
IP stays with the operator unless you opt in to direct mode. It does not read
your contents; HTTPS stays end-to-end encrypted to the site.

### Can a provider tamper with my traffic?

Not by impersonating a site. Certificate checking happens in your browser, so
a provider faking your bank produces a warning, not a working copy. Running
many providers gains an attacker little; no provider learns whose traffic it
carries. The hostile-provider case is worked through in the
[threat model](/docs/threat-model).

### If everything is HTTPS already, why do I need this?

HTTPS hides what you send. It does not hide who you are or where you went.
Your ISP, your employer, and every café network still see the name of each
site you connect to, and each site sees an address that identifies your
household. URnetwork moves that trail to parties that each hold only a
fragment of it. Encryption and anonymity are different problems.

### What does my own ISP see?

An encrypted tunnel and nothing inside it. Your ISP sees that your device
holds a TLS/QUIC connection to the network, or to an extender that looks like
an ordinary service, plus volume and timing. Destinations and contents travel
inside the tunnel.

### What does "post-quantum" cover?

It seals the session between your app and the provider, on by default. The
operator in the middle carries bytes it cannot read. The key exchange is
X25519MLKEM768, a hybrid of a classical curve and the NIST-standardized
ML-KEM, so traffic recorded today cannot be decrypted by a future quantum
computer. It covers that session's key exchange; identities stay Ed25519.

**Limit:** the browser extension and the proxy endpoints have no sealed
session, and cannot: their client device runs inside the operator, which
translates the browser's or proxy's protocol into the network's. A seal
started there would begin at the operator. See the
[threat model](/docs/threat-model) for the full mechanism.

### How do I know the sealed session is on?

It starts on. The control is named Post Quantum Encryption and lives in the
connect drawer, not in Settings; a fresh install is already sealed. Every
current provider build supports the provider side.

The stronger answer is that while it is on you cannot end up unsealed without
knowing. The client refuses to send or accept your traffic in the clear, so a
provider it cannot establish a session with is skipped rather than used
unsealed — you lose that provider, not your encryption. What the app still
cannot do is show a per-connection sealed-or-not verdict; that indicator has
not been built yet.

## Using it

### How do I check it's actually working?

Open [ur.io/ip](https://ur.io/ip). It shows the address and city the internet
currently sees for you, whether that address is connected through URnetwork,
and both your IPv4 and IPv6. The IPv6 line catches a half-configured setup.
Different sites reporting different exits is normal here, not a fault.

### Will my bank lock me out?

It shouldn't: your bank sees one steady residential address for the whole
session, which raises fewer fraud flags than a shared datacenter IP. The
client pins each site to one provider, so the address does not change
mid-session. Banks react to sudden country jumps more than to addresses. Pick
a location near you, or keep the bank off the tunnel with a split rule.

### Why do different sites see different IP addresses for me?

Because your traffic exits through several providers at once, commonly three
to eight. Per-site affinity keeps each site on one provider, so any single
site sees one steady address. The variety is across sites, not within one.

### What do I do when a site blocks me or floods me with CAPTCHAs?

Disconnect and reconnect, which draws a fresh provider window and fresh exit
IPs, or pick a different city. Residential addresses attract fewer wholesale
blocks than datacenter ranges, but none is pristine: a home IP can carry
history from whoever held the lease before. For one stubborn site, add a split
rule that routes it around the tunnel.

### Can I keep one app, like my banking app, off the tunnel?

Yes. Per-app split tunneling is available on Android and Windows: pick the
apps that bypass the tunnel, and everything else stays inside it. Split rules
by domain or IP address are available on Android, Apple platforms, Windows,
and Linux, so you can exempt one bank's domain without exempting a whole app.

### Is there a kill switch?

Yes, on every platform: a toggle in each app on Android, iOS, macOS, Windows,
and Linux, plus the extension's own. When no provider is reachable, the client
refuses to fall back to your ordinary local route, so traffic stops. The app
toggles start off; the extension's starts on. Android adds an OS-level mode
that holds even if the app dies (Always-on VPN plus Block connections without
VPN).

**Limit:** on iOS and macOS, enforcement is client-level. Kill the tunnel
process outright and the system restores normal networking.

### Which location should I pick?

"Best available" picks the highest-scored providers near you and is the right
default for speed. Browsing the list shows countries. To land somewhere
specific, type a place name and a Cities section appears in the results. The
provider count shown per location is live.

### Can a provider fake its location?

Not by declaring one. The operator works out where a provider is from the
connection it observes, so a provider cannot type in a city it is not in. A
location is listed only while a member's device is online in it.

**Limit:** this is an address-derived estimate. An address that looks like a
datacenter, a VPN, or a re-announced range is demoted rather than trusted, not
excluded outright.

### How fast is it?

URnetwork puts average streaming speed on the network at 40 Mbps+. Speed is a
design goal: the path stops at four legs instead of chaining hops, to keep
latency down. Your own figure varies, because traffic rides through another
member's real connection; their uplink and their distance from you both count.
The client replaces slow providers automatically, so a member closing their
laptop usually means a brief stall, not a dropped session.

### How do I make it faster?

Reconnect, or pick a nearer city. The remaining speed setting is a trade:
Strong Anonymization, on by default, is what keeps the operator between you
and the provider. Turn it off and the client connects directly to the
provider. That is faster, and that provider then sees your real IP address.
Make the trade knowingly.

### Does it drain my battery?

The battery cost is that of any VPN tunnel. The Android service also backs off
under battery-saver and thermal pressure.

### Can I torrent through it?

No. BitTorrent is dropped deliberately: a member's home connection would
receive the complaint, and no filter can tell a Linux ISO from a movie.
Connecting first does not get around the check; it also runs on your own
device before anything reaches a provider.

### How is torrenting detected without recording what I do?

By signature checks at the edges, not by central monitoring. The check runs on
the provider's device where traffic exits, past the end of the sealed session,
so the operator inspects nothing. A file-sharing match drops the packet and
raises a flag carrying only the peer's device id and a yes/no: no destination,
no domain, no contents. The operator has no handler for that flag today, so
nothing is stored on arrival. Other drops raise nothing at all. See the
[threat model](/docs/threat-model).

### Does URnetwork work where VPNs are blocked?

It is designed to. The extender leg is community-run relays on their own
addresses, answering on believable service ports, plus a DNS-shaped transport
for networks where only DNS gets out. Blocking the platform's name does not
block the way in, because each extender forwards from its own address. The
client races direct routes first and falls back to extenders; there is no
promise against every censor. An extender cannot read what it carries, and as
your first hop it does see your address.

### What are the HTTPS/SOCKS5/WireGuard endpoints?

They are bridges for software that cannot run the apps or SDK: a router, a
stock WireGuard client, a tool that only speaks SOCKS. The apps remain the
most private path.

The WireGuard bridge shows the trade. The tunnel address is one the platform
allocates, not your home address. But it stays fixed for the life of the
profile and is reused with every provider, so providers could link those flows
to one client. The bridge has no sealed session and cannot have one: your
endpoint of it runs inside the operator, which translates WireGuard into the
network's own protocol. One public DNS resolver
is hard-coded into the profile. Profile export is a Pro feature, created in
your ur.io account. See the [overview](/docs/overview).

## Sharing your connection

### Can I earn by sharing my connection?

Yes. Turn on providing in the app, or run the provider CLI on a spare machine.
Public traffic you carry is metered under signed contracts, and providers
participate in the UR protocol; [ur.xyz](https://ur.xyz) documents how rewards
work. You can also restrict providing to your own devices, unpaid.

### What does providing cost me?

It costs uplink and ISP data, within limits you control. Providing uses your
uplink and counts against your ISP's data cap, so it suits a device on a
charger. It never spends your own URnetwork allowance. It is set to Wi-Fi only
out of the box, so it will not spend your mobile data.

### If someone does something illegal through my line, do police come to me?

Sharing is engineered so the traffic that draws complaints never leaves your
connection. The connect engine's ip_security layer runs on your own device and
drops copyright-class file-sharing and intrusion-class attack traffic at your
egress. The categories that produce DMCA notices and abuse reports are removed
at the source. Its threat lists are rebuilt from public malware, abuse and
botnet feeds with each release, so keeping the app updated keeps the filter
current.

The full mechanism is in the [threat model](/docs/threat-model), and the
[terms of service](/terms) cover providing.

## Accounts and billing

### How do I pay?

Card via Stripe, or USDC on-chain. USDC is a dollar-pegged stablecoin; Solana
Pay handles it today, and x402 lets an agent pay in-band on any quoted chain.
Card numbers stay with the payment processor. Current prices:
[ur.io/products](https://ur.io/products).

### How anonymous is payment?

You can pay without attaching a name. One tap creates an email-free Instant
Account backed by a recovery phrase, the mechanism numbered-account VPNs use.
Wallet sign-in works by signature only; URnetwork never asks for a wallet's
seed phrase or private key. Card payments identify you to the payment
processor. On-chain payment is public by nature: the transaction reference is
kept against your account, and a public ledger leads back to the paying
wallet.

**Limit:** support cannot recover a secret account. Write the recovery phrase
down.

### What happens when I hit the free daily limit?

Traffic through URnetwork stops until the allowance refreshes the next day. It
is a stop, not a slowdown: a transfer in flight fails rather than crawls, and
the app reports that the balance is out. Your device's own connection is
untouched; disconnect and you are back on your ordinary line. Upgrade to Pro
for the monthly multi-terabyte allowance, or top up with a one-time data
balance code, no subscription required.

### How do I delete my account?

Settings → Delete account in the Android, iPhone/iPad, and macOS apps, or in
your account settings at [ur.io](https://ur.io). The web app is the place to
do it if you use Windows, Linux, or the extension. Deletion removes your
account and associated personal information.

## Troubleshooting

### What do I do if it won't connect?

Try three things first.

1. Toggle the connection off and on. The client draws a fresh provider window.
2. Check that the OS granted VPN permission. Android: accept the first-run
   consent dialog in the app, not the quick tile. iOS and macOS: approve the
   VPN profile in Settings.
3. On a hostile network, give it a minute while the client rotates through
   transports and extenders. On a hotel or airport portal, disconnect, sign in
   to the Wi-Fi, then reconnect.

Each platform's tour in these docs has a full troubleshooting section.

### Where do I get help?

Use the Support tab in any app, which files a report and can attach client
logs, or [feedback.ur.io](https://feedback.ur.io). One quick triage: if you
can sign in at ur.io, your account is fine and the problem is client-side.
Security reports go to [security@ur.io](mailto:security@ur.io) under the
[vulnerability disclosure policy](https://ur.io/vdp).