Disclosure: VPNFin is reader-supported. If you buy a VPN through links on this page, we may earn a commission at no extra cost to you. This never affects our ratings — here’s our full disclosure.
Every review of this provider praises the same thing. Greece sits outside the Five, Nine and Fourteen Eyes arrangements, and Greek law does not require a VPN company to identify its customers.
One published account adds a detail the others omit. The company is incorporated in Greece and headquartered in Ukraine, where most of its staff work.
That is not a criticism of either country. But where a company is registered and where it actually operates are separate questions, and only the first one appears in the marketing.
Is ZoogVPN Any Good?
The free tier is among the safer ones. Ten gigabytes a month, three locations, one device, and no advertising. That is more than most free services offer honestly.
Paid plans start around $2.49 a month on a two-year term, with three months added — though the renewal is what decides the total. Apps cover Windows, macOS, Android, iOS, Android TV and Fire TV.
⚠️ And nothing has ever been verified. No audit, no warrant canary, no transparency report. Lookups leave through Google’s resolvers rather than the provider’s own.
Where It Is, and Where It Is Run From
Greece is a genuinely favourable jurisdiction. It sits outside the intelligence-sharing arrangements, and European data rules apply.
The registration also moved recently. Published accounts describe the company relocating from the Isle of Man to Greece — the third provider we have reviewed this month that changed jurisdiction.
⚠️ But one review reports the operation sits in Ukraine. Headquarters and most employees, according to that account. No other source we found mentions it, and the company’s own pages lead with Greece.
We have seen this shape before. PureVPN is registered in the British Virgin Islands and reportedly operated from Pakistan. The registration decides which courts apply, not where the work happens.
On the same ten-gigabyte allowance, PrivadoVPN offers thirteen locations against three — compared here.
Windscribe gives the same allowance and has been tested in court — the comparison is not close.
The Audit Nobody Can Point To
This is the part worth reading carefully, because three accounts give three answers.
One reviewer was told an audit was underway. Asked who was conducting it, support could not say.
Another reviewer was told it was planned, as soon as the company finds a partner it trusts.
A third account reports no audits at all. We found no published report from any firm.
⚠️ And the provider’s own site describes a Play Store badge as following an independent audit. A store verification badge and a no-logs audit test different things. Only one of them examines the claim at issue — the distinction our page on no-logs claims turns on.
The DNS Problem
One leak test found Google’s resolvers in use while connected. So the provider does not run its own DNS, and lookups leave its network.
That is not a full exposure. Your requests mix with an enormous number of others, and Google does not see your address as the origin.
⚠️ It is still a gap. One of the causes of DNS leaks is a provider not running its own resolver, and paying for a tunnel that hands lookups to a third party undercuts the point.
An older test also found a WebRTC leak on Windows. That account dates from 2021, so treat it as historical rather than current.
The Free Tier, and One Detail Inside It
Ten gigabytes a month, three locations, one device. Those locations cover the United States, the United Kingdom and the Netherlands.
⚠️ The free tier uses 128-bit encryption rather than 256. One published account states this, and few others mention it. A data cap is visible to the user; an encryption downgrade is not.
Streaming largely fails on the free plan. One reviewer could not reach BBC iPlayer with it at all.
Even so, it belongs in the honest half of the free market. Our free VPN guide explains why so few qualify, and a capped tier funded by paying users is the model that works.
Everything Else, Briefly
Refunds run seven days. Every other provider in our refund table gives at least thirty — and a refund is a separate request from cancelling.
No RAM-only servers. Disk-based infrastructure keeps data across a reboot by design, so the no-logs claim rests on policy alone.
Torrenting runs on servers marked for it, and a Shadow protocol provides obfuscation — which no laboratory tests anywhere.
Streaming results disagree sharply. One account reached Prime Video, iPlayer, Disney+, HBO Max and ITVX. Another found the experience unpredictable — which is normal for every provider we cover.
| Provider | No-logs audits | Auditor | Jurisdiction |
|---|---|---|---|
| NordVPN | 6 | PwC, Deloitte | Panama |
| Surfshark | 2 | Deloitte | Netherlands (9 Eyes) |
| ExpressVPN | 3 | KPMG | British Virgin Islands, Kape-owned |
| CyberGhost | 3 | Deloitte | Romania, Kape-owned |
| PureVPN | 4 | KPMG | BVI, operated from Pakistan |
| IPVanish | 2 | Leviathan, Schellman | United States (Five Eyes), Ziff Davis-owned |
| Windscribe | 1 | Packetlabs, production infrastructure | Canada (Five Eyes); Greek case dismissed, no data to give |
| Proton VPN | 5 | Securitum | Switzerland, moving infrastructure to EU |
| Private Internet Access | 3 | Deloitte | United States (Five Eyes), Kape-owned |
| Mullvad | 10+ | Cure53, Assured AB | Sweden (14 Eyes) |
| TunnelBear | Annual since 2017 | Cure53 | Canada (Five Eyes), US parent |
| Norton VPN | 2 | VerSprite | United States (Five Eyes) |
| Hotspot Shield | 0 | protocol audited, policy not | United States (Five Eyes) |
| AirVPN | 0 | none — the client is open source instead | Italy (14 Eyes) |
| IVPN | 8, annual since inception | Cure53 | Gibraltar (status disputed) |
| Hide.me | 1 modern, in 2024 | Securitum, though one source names Altius IT | Malaysia (outside the alliances) |
| PrivadoVPN | 0 | none in six years of operation | Iceland (moved from Switzerland, 2026) |
| TorGuard | 0 | none; settled a lawsuit without disclosing records | United States (Five Eyes) |
| FastestVPN | 1, in 2023 | Altius IT | Cayman Islands (outside the alliances) |
| StrongVPN | 0 | none in over two decades | United States (Five Eyes), Ziff Davis-owned |
| VyprVPN | 1, in 2018 | Leviathan Security, before the 2023 sale | United States (Five Eyes), Certida-owned since 2023 |
| PrivateVPN | 0 | none; support says there is nothing to audit | Sweden (14 Eyes), ownership disputed |
| ZoogVPN | 0 | none; support describes one as planned | Greece (outside the alliances), run from Ukraine |
Who It Is For
Take the free tier for occasional use. Ten gigabytes covers a trip, and it does not sell you to anyone.
Take the paid plan if the price is the point, and test it fast. Seven days is not long.
⚠️ Do not take it on the jurisdiction argument. Our privacy ranking excludes unaudited providers, and a favourable registration with an operation elsewhere is a weaker claim than it sounds.
How We Research
DianaVPN reported the incorporation in Greece, the Ukrainian headquarters and the Google DNS finding. The differing audit answers come from vpnMentor and Wizcase, which received different ones. Cloudwards and PrivateProxyGuide supplied the free tier limits, the 128-bit encryption and the seven-day refund window. The Play Store badge described as an independent audit appears on the provider’s own site, quoting a review published there. Streaming results differ sharply between accounts and we have given both. The WebRTC finding dates from 2021 and may no longer apply. We do not run our own tests. Our method lives on the About Us page.
ZoogVPN FAQ
Incorporated in Greece, which sits outside the Five, Nine and Fourteen Eyes arrangements. One published account reports the headquarters and most employees are in Ukraine. The company previously used an Isle of Man registration.
No published report exists. One reviewer was told an audit was underway but support could not name the firm conducting it. Another was told it was planned once a trusted partner is found. The provider’s own site describes a Google Play verification badge as following an independent audit, which tests something different.
It is among the more honest free plans: ten gigabytes a month, three locations, one device, no advertising and no data sale. One account reports the free tier uses 128-bit encryption rather than 256, which is worth knowing because a data cap is visible and that is not.
A leak test found Google’s resolvers in use while connected, meaning the provider does not run its own DNS. Requests mix with a very large volume of others, so this is a gap rather than an exposure — but it undercuts part of the reason to pay for a tunnel.
Seven days. Every other provider in our refund table gives at least thirty, and CyberGhost offers forty-five. Test quickly if you buy.
ZoogVPN
The Verdict
One of the more honest free tiers, cheap paid plans, wide platform coverage and a Greek registration outside the intelligence arrangements. Against that: no audit anyone can point to, a Play Store badge described as one, lookups routed through Google’s resolvers, disk-based servers, 128-bit encryption on the free plan, a seven-day refund window, and an operation reportedly run from a different country than the registration implies.
Final Verdict
The free tier earns its reputation. Ten gigabytes, no advertising, no data sale, and every protocol the paid plan has. Few free services manage that.
The privacy case rests on a registration. Greece is favourable, and one account places the actual operation in Ukraine. Those are different facts, and only one reaches the marketing.
And the audit exists only in descriptions of it. Three sources were told three things. None of them saw a report, and neither did we.