Saily

Is Saily safe?

Yes. Saily, the travel eSIM from the company behind NordVPN, is among the safer apps in its class. There is no password to leak because you sign in with Google, Apple or Microsoft, every plan comes with ad and malware blocking, and we found no breach or fine. It scores 71/100, one point above Airalo and six above Holafly. It would score higher without a device ID used to track you for advertising and with a security audit of its own.

What Saily collects

Apple's label is lighter than most travel apps. Precise location is linked to you, for app functions. Your name, email, device ID, app interactions and crash data are collected but not linked to your identity. One item stands out: the device ID is used to track you, for third-party advertising.

Google Play adds that device IDs, user IDs, purchase history, app interactions and the list of installed apps may be shared with other companies, mostly for analytics. The privacy policy, last updated in June 2026, names AppsFlyer, Google Analytics, Firebase and Tune among its marketing and analytics providers. It says Saily may record your phone's IMEI or mobile number for regulatory reasons and "in some cases" for marketing or analytics. Under California law it says it does not sell or share personal information.

Retention is spelled out better than at most rivals. Data about your data use is kept for 30 days, data about the plans themselves for three years, support records for three years and billing records for ten.

ID checks and the phone number

Two features ask for more. In some countries, Saily may need a copy of your passport or ID before a data plan works, and it keeps that copy for national regulators. The newer US phone-number add-on always needs an identity check: a government ID, possibly a selfie or video, plus records of who you call and text, kept for as long as telecom and anti-money-launderingAnti-money launderingThe rules and checks that stop criminals from moving illegal money through banks, payment firms and crypto exchanges.More in the glossary laws require. Saily says it does not record call content. If you only need data, you never touch the phone feature.

Security and the Nord link

Saily inherits a lot from Nord Security, but not everything. The privacy policy describes a dedicated security team, encryption at rest and in transit, intrusion detection, regular vulnerability scans and external audits of its security policies. It names no auditor and publishes no report. NordVPN's no-logs claims have been checked six times by outside firms and NordPass has a paid bug bounty, but we found no audit or bug bounty that covers Saily itself.

The sign-in design helps. Saily has no password of its own: you log in with a Google, Apple or Microsoft account. If that account uses two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary, so does your Saily login.

The built-in tools

Every plan includes three switches in the app. The ad blocker and web protection filter domains through DNS, which blocks known malicious and tracking sites and saves data. Saily's own FAQ says this cannot stop threats that do not use DNS, such as malware in email attachments. Virtual location routes your traffic through a remote server, so websites see a different country. That helps privacy on foreign networks, but it can also get around school or parental filters, which matters given that the App Store rates Saily 4+ while its terms require users to be 18.

Refunds and renewals

The refund policy is the weak spot for buyers. Before you activate a plan, you get a full refund. After activation, a one-off plan qualifies only if more than 99% of the data is unused. Subscriptions get a full refund only within 14 days and if you used no more than 5% of the data. Saily may also run a zero-value check on your card up to 40 days before a renewal. Saily's Ultra plan is "unlimited" in a narrow sense: 30 GB of high-speed data a month, then up to 1 Mbps.

How to use Saily safely

1. Turn on two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary on the Google, Apple or Microsoft account you sign in with.
2. Refuse tracking when the iPhone prompt appears, and turn off marketing in your Saily profile.
3. Turn on web protection and the ad blocker for each eSIM.
4. Do not activate a plan until you are sure you will use it, since refunds become very limited.
5. Parents should know that virtual location can bypass network filters.

How we scored it

Regulatory record (86) is the strongest factor, with no fine or ruling found. Privacy (60) is the weakest, because a device ID tracks you for advertising and some features need ID documents. Security (72) rests on passwordless sign-in and no known breach, held back by the lack of a Saily-specific audit or bug bounty.