# How vploq works

vploq is a private link back to your own home network. Unlike a commercial VPN,
there is no shared server you rent space on: the thing you connect to is a
device on your own router, and the connection runs between your app and that
box. This page describes the whole model, which is enough to make sense of every
other page.

## The device is the destination

A commercial VPN sends your traffic to a company's server. vploq does not. You
plug a small vploq device into your router at home, and your phone and laptop
connect back to *it*.

That difference is the whole product. Because the destination is your own home,
"connected" means your printer, your NAS and your router answer as if you were
sitting in the living room, and, if you choose, your internet browsing comes out
of your home connection too.

Each device carries a factory identity that can be claimed by exactly one
account. The identity is checked rather than typed in, which is why a setup can
fail with "this device was not found" or "has been reported lost", and why you
[release a device](/account/your-data#release-a-device) before selling it so the
next owner can claim it.

## The two paths

Once you connect, your app and your device have to find each other across the
internet. There are two ways that can happen, and vploq always prefers the first.

<Mermaid chart={`flowchart TD
  APP["vploq app"]
  DEV["vploq device at home"]
  RELAY(["Encrypted relay"])
  APP -->|"1 · Direct: peer to peer,<br/>skips our infrastructure entirely"| DEV
  APP -->|"2 · Relayed: forwards encrypted packets<br/>it cannot read"| RELAY
  RELAY --> DEV
`} />

A direct connection is peer to peer. Your app and your device talk straight to
each other, and the traffic does not pass through vploq's infrastructure at all.
It is the faster path, with fewer hops and lower latency, and the app tries for
it whenever the network allows.

A relayed connection is what happens when a direct one is impossible, which many
mobile networks and corporate firewalls make it. An encrypted relay then
forwards the packets between the two ends. It moves ciphertext from one side to
the other and cannot read what passes through it.

You do not choose between these. The app negotiates the best available path and
falls back to the relay silently if it cannot build a direct one. A relayed
connection is normal and is not a fault. The [Connecting](/using/connecting)
page shows which path is in use.

## What stays private

The tunnel between your app and your device is encrypted end to end with
[WireGuard](https://www.wireguard.com/). Encryption happens on your app and is
only undone on your device, which has two consequences worth stating plainly:

- The networks you pass through, such as café Wi-Fi or an office LAN, see
  encrypted packets and their size and timing, never their contents.
- The relay, when one is used, forwards that same ciphertext. It cannot read
  your traffic.

vploq's infrastructure does handle the small amount of information needed to
route a connection and keep the service working. Exactly what that is, why, and
how long it is kept is set out in the [privacy policy](/privacy), which is the
authoritative document rather than this summary.

## Your internet, or just your devices

A connection can do one of two things, and the app tells you which:

<Mermaid chart={`flowchart LR
  YOU["You, connected"] --> Q{"Does this connection<br/>carry your internet?"}
  Q -->|"Full"| A["Everything routes through home:<br/>local devices and web browsing"]
  Q -->|"Device access only"| B["Only your home devices;<br/>browsing uses the network you are on"]
`} />

Most of the time the connection carries everything: local devices *and* your
internet browsing, which exits through your home connection. Sometimes it is
device access only, meaning you can reach the machines on your home network but
your browsing goes out through whatever network you are physically on. That
happens when the vploq you are connected to is shared with you rather than owned
by you, or when it is not set up to route internet traffic. The app marks this
state so you do not have to guess.

## Accounts, devices and teams

Your account is the thread that ties everything together. Sign in on a second
phone or a laptop and you see the same devices and teams, with nothing set up
twice.

A team lets more than one person use the same vploq without anyone sharing a
password. The owner invites people by email, and each has their own account and
their own app. See [Teams](/teams/managing-teams).

## Where to go next

- [Install the app](/setup/install-the-app) and [set up your vploq](/setup/set-up-your-vploq)
- [Connecting](/using/connecting): the button, the statuses, direct vs relayed
- [Your data](/account/your-data): export, deletion, releasing a device
- [Privacy policy](/privacy): the authoritative account of what is processed