What your connection reveals

Four different parties can watch one connection, and they do not see the same thing. Most of what is written about this rounds the answer up. Here is the version that survives checking.

01 · Where it happens

Four observers, one connection

Your device: Everything, before any encryption is applied — the operating system and every app you have installed.
The network you are on: Café Wi-Fi, an office router, a hotel. Which sites you reach, and when. Not what is inside them.
Your internet provider: Every connection you make, tied to your account, your address and your name.
The site you visit: Your address, your browser, and whatever its embedded third parties collect.

A VPN changes what two of those four can see: the network you are on, and your internet provider. Your device still sees everything. The site still sees you arrive.

02 · What is and is not visible

Your provider sees the domain, not the page

Can see

The domain of every site you connect to
When you connected, and for how long
How much data moved, in each direction
That all of it belongs to your account

Cannot see

Which page within a site you opened
What you typed, read, or submitted on it
The contents of anything sent over HTTPS

example.com  /pages/what-they-read
───────────  ─────────────────────
  visible         sealed

The domain travels in the open so the connection can be made at all. Everything after the slash is inside the encryption.

You will often read that your provider sees every site you visit and what you do there. The first half is true and the second is not. We think the true version is uncomfortable enough: a list of every domain you reached, when, and for how long, attached to your name, retained for as long as the law where you live allows.

03 · What a record looks like

One line, field by field

2026-08-20T14:22:07Z  198.51.100.24  →  example.com:443  8.4 MB  312s

An illustrative record — not your connection. The address and domain are reserved examples.

2026-08-20T14:22:07Z: When the connection opened
198.51.100.24: The address your provider assigned you — and the account it belongs to
example.com:443: The domain you reached, over HTTPS. The domain, not the page
8.4 MB: How much moved. Enough to tell a page from a video
312s: How long you stayed

A VPN does not delete that record. It moves it: the same line gets written, by a different company, about a connection to us instead of to the site. That is the entire trade, which is why the only questions worth asking are who keeps it, for how long, and whether you can check the answer.

Read how we answer that →

Want the long version? How the internet works, and why a VPN matters walks the same request hop by hop.