Anon eSIM logoAnon eSIM

Privacy · last updated July 2026

Privacy Policy

Anon eSIM sells anonymous mobile data. Our privacy policy is not a legal fig leaf glued to a surveillance product - it is the product. This page describes exactly what we do and do not collect, why, and where the honest limits are.

What we do not collect

  • No name, address, date of birth, or government-issued ID. Ever, for any destination.
  • No email address at purchase. Nothing gets sent to your inbox because we have no inbox to send to.
  • No phone number. We do not sell voice or SMS lines, so there is nothing to verify.
  • No user account. Your only credential is a random recovery token generated in your browser.
  • No advertising cookies, no analytics that identify you, no third-party pixels.

What we do collect, and why

Your recovery token

A random string generated in your browser at checkout. It is the only key that maps a browser to an eSIM balance. We store a SHA-256 hash of it, not the token itself, so a database leak cannot be used to hijack accounts. If you lose the token we cannot recover it - that is by design.

eSIM operational data

The ICCID of the profile we provision, the balance in USD, and the byte counters the upstream carrier reports so we can display remaining data. We do not receive URLs, DNS lookups, IP addresses, or any content of your traffic - the underlying carrier network handles routing; we are the top-up layer.

Payment metadata

For card payments (Stripe): Stripe holds the card details under its own PCI-compliant environment. We receive a payment intent ID and confirmation status - no PAN, no cardholder name is stored on our servers. For crypto (Cryptomus): we receive an invoice ID and the confirmed on-chain amount. Neither payment method links the transaction to a personal profile on our side; card payments are of course visible to your card issuer, which is why we recommend crypto for full anonymity.

Server logs

Our edge platform retains short-lived request logs (IP, user-agent, path, status code) for operational purposes - detecting abuse and debugging outages. Retention is 30 days maximum and logs are not correlated to purchases. We do not maintain a long-term access log.

No-log stance, honestly stated

We do not log the traffic on your eSIM because we cannot - packets flow between your device and the destination through the roaming carrier's network, not through us. What we do retain is limited to the operational data above: the ICCID, the balance, the byte counter, the payment reference. Nothing that describes what you did online with the data.

We are also honest about the limit: any active SIM exchanges signaling with nearby cell towers - that is how cellular works. The mobile network operator whose spectrum you are using can see the tower you are attached to. An anonymous eSIM removes your identity from the account layer; it does not make your device invisible to the radio network. For traffic privacy, use a VPN and TLS. This is the same disclosure we make on our anonymity guide.

Cookies and browser storage

We use a single first-party cookie for the site session (checkout state, cart), and we store your recovery token in your browser's localStorage after purchase so the /account page can find your eSIM. Neither leaves your browser except when you explicitly request an action against your balance (top-up, usage refresh). There are no advertising cookies, no cross-site trackers, and no analytics vendor with a profile on you.

Third parties we use, and what they see

  • Stripe processes card and Apple/Google Pay payments. Stripe sees card details and your billing information; we do not.
  • Cryptomus processes crypto payments. Cryptomus sees the on-chain deposit address and confirmation; we receive only the invoice status.
  • Citrus Mobile is our upstream eSIM provider and operates the profiles you install. They see the ICCID and network usage counters (bytes per session), not personal data - we never send them your recovery token or any identifier.
  • Cloudflare serves the site and provides DDoS protection. Cloudflare sees request-level metadata (IP, path) at the edge with the retention described above.

Legal requests

If we receive a lawful order for account records, what we can hand over is the operational data listed above: an ICCID, a balance history, a payment reference, an SHA-256 hash of a recovery token. There is no name, email, phone number, address, or usage log to disclose, because we never collected any. This is the entire point of the design.

Children

Anon eSIM is not intended for anyone under 16. Because we do not collect personal information at purchase, we cannot age-gate meaningfully - buyers are responsible for complying with the laws of the jurisdictions they use the service in.

Changes to this policy

If we materially change what we collect, this page will be updated with a new date at the top. We will not add analytics or third-party trackers without disclosing them here first.

Contact

Privacy questions: help@anonesim.io. You do not need an account to reach us - include the reference from your purchase (or an ICCID) so we can find the eSIM you are asking about.