VPN Service — How It Works

What it is

A VPN — short for virtual private network — is a private tunnel between your device and a server you have chosen to trust. What you send goes into the tunnel, scrambled so that only the two ends can read it, and it comes out the far end looking as though it started there rather than at your house. “Scrambled” is the same idea as the padlock in your browser’s address bar, applied to the whole connection instead of a single website.

I run WireGuard gateways in datacentres in Montréal and in Mexico, with more nodes being added over time. Your traffic exits in Canada or Mexico — a local hop from Québec and Ontario on the Canadian node, and in each case a jurisdiction a court can reach. That is the point rather than a side effect.

You would want this for three ordinary reasons:

• Your internet provider stops keeping a list. It can already see every site and service you connect to without ever reading your email. Inside a tunnel, there is no list to keep.
• Public Wi-Fi stops being a special case. On a network you do not own, the names you look up and the sites you visit are no longer readable by whoever runs it.
• You are harder to pick out of a crowd. Sites see the tunnel instead of your home address, your neighbourhood and your provider.

What it does not do

Being plain about the limits matters more than the pitch:

• It is not anonymity. If you sign in to your email, your bank or Facebook, you are still you — the site knows exactly who you are, and the tunnel changes nothing about that.
• It does not replace anything else. Keep the password manager, keep the updates, keep the padlock.
• It moves your trust rather than removing it. Your internet provider stops seeing your traffic — but the VPN now sees it instead. So everything rests on one question: who runs the tunnel, and can you check them?

Who runs it

YMRTECH LLC is a Wyoming company run by one person. The gateways your traffic leaves from are my own boxes in datacentres in Canada and in Mexico, and the infrastructure that runs them is declarative Nix under version control at git.ymrtech.com — nothing is hand-edited on a running machine, so what is published is what runs.

There is no chain of owners between you and the person who answers the email, and the claims are tests rather than adjectives: the infrastructure audit tests the no-log behaviour instead of asserting it, and what we log names the exceptions instead of hiding them. All of it is checkable before you pay.

What you get

You get a WireGuard tunnel from your devices to one of my gateways — Montréal or Mexico, with more nodes being added over time — plus a DNS resolver that answers inside it — no client app, no bundled browser, no telemetry SDK. You get a configuration or a QR code and your operating system’s own WireGuard client does the rest: client setup guide.

What DNS is

Every time you open a site or an app, the first thing your device does is turn a name — a bank, a shop, this page — into the numeric address of the machine that answers it. That translation is DNS, the Domain Name System: the internet’s contacts list. It happens before the page loads, on every request, and almost nobody sees it.

Your device rarely does the lookup itself. It asks a resolver — and unless you have changed something, the resolver it asks is your internet provider’s. That is the part worth knowing: the resolver, and the network it sits on, can read every name you look up. Which bank. Which clinic. Which forum. The padlock in your browser hides the content of a site, but the name is asked for separately, usually in the clear.

That is why the tiers exist. There are only two ways to fix a name lookup, and this service is built around the second:

• Encrypt the lookup. Secure DNS — the kind your browser may already be doing — hides the name from the network in the middle. It still hands the name to somebody’s resolver, just not to the local network’s.
• Move the lookup into the tunnel. The name is asked for inside the encrypted connection, so the network you are on sees neither the names nor the addresses, and your provider’s resolver is no longer the one answering.

So the three tiers below are not three speeds or three products. They are three answers to one question — what happens to your name lookups.

The three tiers

The tiers differ in DNS only — never in speed. All three run through the same gateways with the same shaping: up to 1 Gbit/s per connection.

How a tier gets assigned

The tier is chosen per device when you add it in the portal, so one subscription can run a laptop on privacy, a phone on security and a work machine on pipe — three devices, each its own lane. To move a device between tiers, remove it and add it again under the new one: each device gets its own tunnel configuration, so switching means a new config file or QR code rather than editing the existing one.

Your own devices, one private network

A tunnel can do more than point every device at the internet. In the portal’s device-to-device page you decide which of your own devices may reach which — one direction at a time, either all traffic or a named protocol and port list. Reach a home server from a laptop without exposing it to anything else, let a phone pick a file up from a desktop, or open exactly one port between two machines. A device you add reaches the internet and nothing else of yours until you say otherwise, and only your own devices on the same account can ever be joined.

The price

The monthly plan is $10/mo, or $80/yr for the year — both in USD, billed by card through Stripe. One subscription covers every tier, with no data cap, no per-gigabyte billing, no usage-based fees — the price is the price. Choose the plan when you create the account, cancel any time, and your access runs to the end of the paid period. The details live in terms & fair use.

What this is not: a geo-unblocking service. It is a small, fixed set of gateways, with no rotating exit addresses and no residential proxy pools.

What we do not keep

• No browsing history. No DNS query records. No connection times — on any tier: the resolvers run with query logging and statistics disabled.
• What I do hold is your email and password hash, your Stripe record, your device records and aggregate byte counters per account for fairness. The full list, with retention, is on the what we log page.

Verify it, don’t trust it

Every claim on this page is a test you can read — the full dossier is there: who runs the tunnel, the tier mechanics, what is and is not logged, and the signed infrastructure audit that tests the no-log behaviour instead of asserting it.

The dossier spells the checks out in full. In short: read the signed audit, read the infrastructure source, read the what we log list, run the portal’s DNS leak test, and watch service status to tell a blip from an outage before anyone opens a support thread.

Questions

Which devices can I use it on?

Three devices per account, each with its own tier, on any client that speaks WireGuard — the official apps for Windows, macOS, Linux, iOS and Android, open-source clients such as wg-quick and WG Tunnel (Play Store) on Android, or a router that supports WireGuard imports.

Can my devices reach each other through the tunnel?

Only if you say so. The portal’s device-to-device page is where you link your own devices — one direction at a time, either all traffic or a named protocol and port list.

Can I bring my own DNS?

Yes — that is the pipe tier. Your device keeps whatever resolver it already has, including in-browser DNS-over-HTTPS.

How do I know my DNS is going through the tunnel?

The DNS leak test mints a unique probe name, has your browser look it up, and then checks whether that lookup reached YMR’s resolver inside the tunnel.

What happens if I cancel?

Access stops at the end of the paid period, and the device records are gone with the account.

Still want the detail? The technical dossier is the full version, nothing trimmed. Ready to try it?