TunnelBear

Is TunnelBear safe?

Yes. TunnelBear is one of the more trustworthy mainstream VPNs: it shows no ads, its privacy policy lists every piece of data it keeps, and the German firm Cure53 has torn through its code and servers every year since 2017. We score it 80/100, a point above NordVPN and Surfshark.

The gap with the very top, such as Proton VPN (88), is about proof rather than practice. TunnelBear's security has been tested many times over, but its promise not to log your activity has never had a dedicated no-logs audit, and the app ties your email and device ID to you for its own marketing.

Who owns TunnelBear?

McAfee, the antivirus company, bought TunnelBear in March 2018. The service still runs from Toronto as TunnelBear LLC and keeps its own brand, apps and privacy policy, which does not mention McAfee. The policy says TunnelBear stores no personal data outside Canada, although its servers sit in 46 or more countries, and points unhappy users to Canada's privacy commissioner.

For a VPN, the owner matters because it can see where your traffic goes. A large US security group brings resources and scrutiny, and also US jurisdiction over the parent. We found nothing to suggest McAfee has access to TunnelBear user data, but the policy does not address the parent either way.

What data does TunnelBear keep?

The May 2026 policy is unusually concrete: it lists account, operational and payment data "in its entirety", each with its purpose. For your account it keeps an email address, used for receipts and marketing. When you connect, it records your OS and app version, whether you were active this month, how much data you used this month (reset to zero each month), city-level location, crash reports, device model and account events such as payments and ad referrals. If you pay by card, it keeps your last name and the last four digits.

It says it never logs your IP address when you connect, your DNS queries, or the sites and apps you use through the tunnel. Apple's label matches: email and device ID are linked to you for marketing, analytics and app functions, usage and diagnostic data are not, and nothing is used to track you. The app has no ad networks. The website, unlike the app, uses Google Ads and Bing Ads cookies to measure campaigns.

What is missing is outside proof of the no-logs claim. Surfshark and NordVPN pay Deloitte to check theirs; TunnelBear's audits test security, not whether the logging policy is followed.

How secure is TunnelBear?

Its audit record is long. Since 2017 Cure53 has run a yearly white-box audit, meaning full access to source code, configuration and documentation, across the apps, back-end servers, public APIs and encryption. The 2024 round took 44 working days with eight auditors and found 10 vulnerabilities of medium severity or higher, three low ones and ten hardening suggestions; TunnelBear says all have been addressed or mitigated. It says the 2025 audit is done and the fixes are under review, although its post on 2024 appeared only in November 2025.

The apps use AES-256 encryption and WireGuard among other protocols. The National Vulnerability Database lists one serious bug: a 2018 flaw in the Windows app (version 3.2.0.6) that let a local user gain SYSTEM rights. We found no public bug bounty and no reported breach of user data.

How to use TunnelBear safely

1. Use WireGuard in the app settings for speed and modern encryption.
2. If you only need a VPN for public Wi-Fi, the free 2 GB a month is enough and costs nothing.
3. Buy an annual plan on the website if you want the 30-day refund; monthly plans and App Store or Google Play purchases are not covered.
4. Cancel auto-renewal in your account (or through Apple or Google) if you do not want a second year at full price.
5. Delete your account through the privacy centre when you stop using it; otherwise data is deleted 30 days after a paid subscription ends.

How we scored it

The regulatory record (90) is the strongest factor, with no fines found since 2012 and yearly audits behind it. Transparency and control and scams and harmful content (both 82) reflect a clear policy and an app without ads or user content. Privacy (76) is the weakest, because the no-logs claim has never been audited and email and device ID are linked to you for marketing.