Do VPNs log your IP address? Seeing it is not the same as keeping it

Some VPNs retain your connection IP, at least temporarily. Others explicitly say they do not log it. A “no-logs” label alone does not answer the question: you need the policy’s wording about your incoming IP, what is retained and when it is deleted.

A VPN server can see the address connecting to it without creating a historical log. Conversely, a provider can promise not to record browsing activity while temporarily retaining an IP address for connection management. Surfshark’s privacy policy provides a concrete example of that distinction.

Policy record checked: November 1, 2026. The examples below describe published policies, not firsthand verification of server behavior.

Seeing an IP address is not the same as logging it

For an ordinary direct connection, the VPN’s entry server receives traffic from your public IP address. Encrypting the tunnel does not conceal that connection endpoint from the server receiving it. For example, WireGuard’s technical overview explains how a receiving peer learns and remembers the sender’s most recent internet endpoint so it can send packets back.

Three addresses should not be confused:

• Your connection IP: the public address from which you reach the VPN, usually supplied by your ISP or mobile network.
• Your VPN exit IP: the address used for traffic leaving the VPN toward websites.
• Destination IPs: the addresses of services you visit.

A promise not to record visited IP addresses is therefore not necessarily a promise not to retain your connection IP.

The practical distinction is between live connection state, temporary retention and historical logs. Live state enables the connection to work. Temporary retention keeps specified details for a limited period, possibly after disconnection. Historical logs let someone look back at previous connections. These can overlap: a short retention period does not mean no data is kept. None should be assumed from the word “no-logs” alone.

What actual provider policies say

These are examples, not a ranking or an exhaustive provider list.

Provider	Published handling of connection data	Retention wording
Mullvad	Says it does not log IP addresses or connection timestamps. Its simultaneous-connection checks operate in temporary memory.	Says those checks are not permanently stored to disk, and it cannot report an account’s connection count from five minutes earlier. Policy
Surfshark	Says servers temporarily keep details such as user ID and/or IP address, plus VPN connection timestamps, for service functionality.	Automatically deleted within 15 minutes after the session ends. This is not a 15-minute limit measured from the start of a connection. Policy, section 1
Astrill	Says its system tracks connection time, IP address, device type and app version during an active session.	Says this information is generally permanently removed on disconnection. Separately, it keeps the last 20 connection records; that list includes connection time, duration, country, device type and app version, but does not list IP addresses. Privacy notice, sections 2.3–2.5

Astrill’s section 2.5 also permits longer retention of the connection-record information in cases of irregularities, such as suspected misuse, for as long as required to protect the company’s interests and service security. That clause does not explicitly identify IP addresses as part of those retained records.

Surfshark illustrates why a short disclosure needs to be read alongside the full policy. Its July–September 2026 transparency report says it does not collect online-activity information, including IP addresses, and has no such information to disclose on request. Its privacy policy nevertheless expressly describes temporary connection-IP retention. The narrower retention clause matters when the question is “Does it ever keep my incoming IP?”

A VPNRadarLab review dated October 16, 2026 likewise classified 22 of 303 services making a no-logs claim as storing connection IPs, and another 25 as keeping them temporarily or partly. Those are the publisher’s policy classifications within its own dataset—not independently verified server behavior or a representative estimate of the whole VPN market.

VPN logs and website records are separate

A VPN’s no-logs promise may concern tunnel activity, not every interaction with the company.

IVPN’s privacy policy, for example, says it does not log customer IP addresses while connecting or connected to the VPN. Separately, its website analytics receives an IP address and discards the last two octets. Those are different systems and different commitments.

Payments can create another record. Surfshark’s policy says its payment partners collect details that include the payer’s IP address. That does not establish a VPN browsing log, but it means “no VPN logs” should not be read as “no IP-related records anywhere.”

What to check before relying on a no-logs claim

Search the full policy for IP address, connection, timestamp, retention, fraud, abuse and diagnostics. Establish:

1. Which IP? Your incoming address, a destination address, an exit address or an address collected at checkout?
2. What is kept alongside it? Account identifiers and timestamps matter when assessing whether a record could associate a connection with an account.
3. When is it deleted? Look for a defined deadline and its starting point. “Temporary” without a duration leaves an important question unanswered.
4. What exceptions apply? Read any security, troubleshooting or legal-retention clauses, including whether they apply to VPN data or only other account records.

An IP-check website can show the address exposed to that website; it cannot reveal the provider’s internal retention practices. Likewise, “RAM-only” describes a storage design, not by itself a complete logging policy.

Use audits as supporting evidence for the specific systems and period examined—not as a substitute for identifying the IP-retention clause. For that separate task, see how to read a VPN no-logs audit. If the policy never addresses incoming IP retention, record it as not stated, not as “not logged.”