# TunnelBear privacy rating

VPN service from TunnelBear, based in Canada, with a free plan limited by data and paid unlimited plans. Apps support WireGuard, OpenVPN and IKEv2.

## Summary

TunnelBear scores 42 out of 100 (grade D) on the VPN providers criteria. It meets 4 of 12 criteria: no ads or data sales, independent audit, TLS configuration and modern protocols. It partly meets transparency report, security headers and audited no-logs policy. It does not meet open source, no trackers or telemetry, tells users about requests, anonymous payment and open-source apps. It is based in Canada: Five Eyes member. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B.

- Website: https://www.tunnelbear.com
- Jurisdiction: Canada. Five Eyes member.
- Platforms: Windows, macOS, Android, iOS
- Home page trackers: Cloudflare Web Analytics (cookieless analytics)
- Category: [VPN providers](https://privacyratings.com/vpns/)
- Grade: D (42/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The privacy policy lists Google Analytics and Hotjar, and the Android app includes AppsFlyer and Google Firebase Analytics. | https://www.tunnelbear.com/privacy-policy |
| No ads or data sales | Yes | Funded by paid plans, and the free plan has no ads. The policy states personal data is not sold. | https://www.tunnelbear.com/privacy-policy |
| Independent audit | Yes | Cure53 audits the apps and servers every year, and the full audit report is public. | https://cure53.de/pentest-report_tunnelbear_2023.pdf |
| Transparency report | Partial | The privacy policy describes what data is disclosed in response to a valid subpoena or warrant. No current request counts are published. | https://www.tunnelbear.com/privacy-policy |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=www.tunnelbear.com&hideResults=on |
| Security headers | Partial | Grade B (70/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=www.tunnelbear.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| Audited no-logs policy | Partial | The policy states IP addresses, DNS queries and activity are not logged. The Cure53 audits are security tests, not a no-logs assessment. | https://www.tunnelbear.com/privacy-policy |
| Anonymous payment | No | An email address and payment by card or app store are required. Cryptocurrency is not accepted. | https://help.tunnelbear.com/hc/en-us/articles/360059783972-What-payment-platforms-do-you-offer |
| Open-source apps | No | The apps are closed source. |  |
| Modern protocols | Yes | WireGuard is supported alongside OpenVPN and IKEv2. | https://www.tunnelbear.com/features/ |

Source: https://privacyratings.com/vpns/tunnelbear/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/vpns/tunnelbear.md