Who operates the service
TunnelBear LLC is the operator named in the provider’s published material.
The policy lists no logging of website visitor IPs, VPN connection IPs, DNS requests, or the applications/services/websites used through the VPN. Email address, email verification, paid status, and subscription expiry; an optional Twitter ID is also listed. TunnelBear stores cardholder last name, last four digits, and the date of card use. Processors can hold billing address, expiry, and IP at payment. TunnelBear says it does not store the full card number.
Read the privacy policy ↗
What the audit covers
Cure53: Apps, backend and server configurations, public APIs/network entry points, and data-handling/encryption layers. No full 2024 report link was found in this announcement. The same article says the 2025 audit was completed and findings were being reviewed; no original 2025 report was obtained. Cure53: Clients, VPN infrastructure, PolarBear backend, public sites, AWS, Overseer, Geneva, and browser add-ons; eight work packages. Public original on the auditor’s domain. Exact ambiguous numeric report-date notation is not converted to an ISO date.
An audit concerns the systems and period described in its scope. It does not establish that a service can never log data or that every app behaves identically.
How to read an audit