Kairos War Room · campaign evidence · frozen 3 September 2026
Mysterium VPN · campaign attribution · measured 2 September 2026

The campaign that sold nothing.

take-back-the-internet produced zero web purchases in nine months — confirmed today on four instruments that share no lineage. But the 527,284 "sessions" are Google ad taps on US phones, not readers: a few hundred people a month demonstrably saw the page. The campaign was bought and judged as awareness, by session count. It met that goal.

Source · mysterium-bq.claude.vpn_web_sessions Window · 2025-12-01 → 2026-09-02 Aggregates only — no customer rows Open the live campaign page →
Tracker "sessions"527,284

HTTP hits in MN's server tracker. 99% carry a Google click ID; 97% US; 25% in-app WebViews.

People who saw it~100s / mo

GA4 (consented, JS-side): 124 users in July, 25 in August. Four times fewer than its homepage coverage.

Purchases0

On the tracker, on GA4 same-session, on GA4 user-level over two months, and in the purchase stream.

Spend[unknown]

Only fragment: Meta April €1,000. Google Ads cost lives in MN's Ads account. Not in the warehouse.

The result · re-stated after verification

Zero is real. The half-million is not what it looked like.

The zero survives every instrument that can see a purchase: MN's own tracker (0 thank-you pages from 228,188 raw sessions since April), Google Analytics same-session (0 of 164), Google Analytics user-level over two months (0 of 139 people ever bought, in any session — the homepage cohort converts at 2.06%), and the purchase stream itself (no 2026 purchase names this campaign; Brand-search and PMax campaigns are named, so attribution works).

What does not survive is the idea that 527,284 people read the page. MN bought roughly 460,000 YouTube and in-app ad taps on US phones for a campaign whose stated objective was awareness and whose reported KPI was session count. Ad taps are counted by a server tracker; most never become a rendered page in front of a person. The 09-02 framing — a magazine whose readers didn't buy — was wrong about the readers. Almost nobody who could buy ever saw it.

C1 · landing pages by traffic

Second-biggest door, no sales

Every landing page on the site since 2025-12-01, ranked by sessions. The campaign sits at number two, and it is the only page at this scale with an empty revenue column.

/1,366,975 sessions · 12,791 sales/take-back-the-internet527,152 sessions · 0 sales/offer300,041 sessions · 3,683 salesapp/dashboard/devices103,035 sessions · 214 sales/vpn-pricing50,459 sessions · 1,959 salesapp/dashboard/billing46,411 sessions · 2,176 sales/mysteriumvpn-deal43,857 sessions · 399 sales/limited-offer35,721 sessions · 6 sales
Top eight entry pages by sessions. /offer converts on a third of the campaign's traffic and returns $75,536; the campaign returns nothing.
Landing pageSessionsTransactionsRevenue
/1,366,97512,791$248,742
/take-back-the-internet527,1520$0
/offer300,0413,683$75,536
app/dashboard/devices103,035214$3,544
/vpn-pricing50,4591,959$38,720
app/dashboard/billing46,4112,176$39,272
C3 · month by month

Nine months, never once non-zero

Sessions run from 8,756 to 115,032 a month. The sales row underneath never moves off zero, including in March when the page took 113,619 visits.

115,03286,27457,51628,758068,9842026-010115,0322026-020113,6192026-03012,2692026-04075,8452026-05069,0952026-06063,6732026-0708,7562026-080112026-090Sales
Campaign sessions per month, with its own transaction count on the row beneath. The homepage booked 12,791 transactions over the same window.
Batch D · 3 September 2026

Four instruments, one zero

The 09-02 table is a copy of MN's server-side tracker. Everything below is outside that lineage, except the raw tracker itself, read directly.

InstrumentLineageWindowCampaign sessionsReached pricingPurchases
vpn_web_sessions (09-02)MN tracker, aggregated2025-12 → 2026-09527,2844240
MN tracker, raw eventsserver-side2026-04-07 → 09-03228,1881070 thank-you
GA4 raw, same sessionGoogle · JS · consented2026-07-06 → 09-0216410
GA4 raw, user-level, any later sessionGoogle · JS · consentedsame139 people11 returned0 ever
Purchase stream · traffic_sourceGA4 purchase events2026none name the campaign
Subscription sourcesMN attribution view2026none name the campaign

Controls on the same instruments: homepage GA4 same-session 3.4%; homepage GA4 user-level 2.06%; homepage Google-click-only sessions in the raw tracker 6.1% reach a thank-you page (97 of 1,594). The session-break explanation is dead — the user-level row follows people across sessions.

D4 · D5 · D8 · what the traffic is made of

Ad taps, not readers

228,188 raw campaign-page sessions since April, decomposed.

Click IDs99% Google

gclid 90.9% · wbraid 7.3% · gbraid 1.1%. Meta, Reddit and X together: 8 sessions. Google search referrals: 86.

Where fromYouTube · in-app

Referrer none 84%, youtube.com 11.5%, Google ad SDK 1.3%. User agents: mobile browser 70%, in-app WebView / Dalvik 25%, desktop 4%.

Who97% US phones

Top networks are T-Mobile, Comcast, AT&T, Verizon Wireless, Charter — real consumer devices, not datacentre bots.

That is the signature of YouTube and in-app video/display taps — which is what MN said it bought. GA4, which needs the page to render and the visitor to consent, saw 0.26% of these sessions against 1.1% of homepage sessions: the campaign traffic bounces before the page even finishes loading, four times more often than ordinary traffic.

Slack · ClickUp · all-hands decks

What MN says it bought

Their own words, in order.

  • 2026-01-07, Slack #vpn_marketing (VPN marketing lead): "this week we are starting with google awareness ads, reddit also".
  • 2026-01 all-hands, VPN marketing slide: "Session count +25% (218,785 → 273,481)". 2026-02: "Reached our 100th article on take-back (43,652 sess, from 7,926 on Jan)". 2026-03: "campaign organic sessions grew by 15% 7,589 → 8817".
  • 2026-04-02, ClickUp 869crfdvt: "New awareness ad campaign • Meta — objective: awareness — optimise for impressions — Budget for April: 1000 EUR — target CPM ~2.5".
  • 2026-04-14, Slack: "Majority of the investments are for Action metric (DemandGen) — yeah, we do it too. scale is just way smaller" · "we know we should start with youtube vertical videos".
  • Q2 2026 company priorities slide: "VPN — grow brand visibility (# of web sessions)".

No deck line, Slack message or task ties the campaign to revenue, transactions or cost. The campaign met the KPI it was given. The KPI did not measure what the company needed.

The artefact

What the page actually is

Read live on 2026-09-02 and again today. The ask exists — it is one line inside a magazine.

The page opens on “TAKE BACK THE INTERNET.” over a dark hero, then runs The Restriction Feed — a dated news stream of censorship and surveillance headlines, updating through today — followed by a six-panel editorial essay (identity gating · blocking by default · surveillance by design · platform enforcement · infrastructure control · anonymity removal), each panel structured as the pitch, the drift and the reality check.

Between the feed and the essay sits the only commercial ask on the page: “Be part of the resistance, quietly”, three product lines, and one button — Get Mysterium VPN/vpn-pricing. The link is correctly targeted. It is one of thirty links on a page whose dominant content is journalism.

The CTA is not broken — and the page's design is not on trial either. Too few people who could buy ever rendered it for the data to say whether a 30-link magazine repels buyers. What the data does say: the traffic sent to it was never going to buy anything.

Open https://www.mysteriumvpn.com/take-back-the-internet →

C2 · the control

The zero is observed, not missing

A blank in a summed column can mean “no rows” instead of “no sales”. So the claim was tested against a control before it was written down.

Page classRowsSessionsRows with tx NOT NULLΣ transactions
homepage (control)201,6291,366,97511,75112,791
all other pages612,4331,510,73514,34014,176
take-back campaign17,470527,28400

The transactions column populates whenever a conversion happens — the homepage proves the mechanism with 11,751 non-null rows out of 201,629. The campaign page has zero non-null rows out of 17,470. The instrument works; the page produced nothing for it to record.

C6 · the discriminating test

The page is the variable, not the channel

Same window, same channels, two destinations. If the ads had simply bought bad traffic, the unpaid visitors would still convert. They don't.

Google Ads — everywhere else1.396% · 222,615 sessions · 3,108 salesGoogle Ads — take-back page0.000% · 426,435 sessions · 0 salesMeta — everywhere else0.080% · 48,890 sessions · 39 salesMeta — take-back page0.000% · 35,171 sessions · 0 salesunpaid — everywhere else1.357% · 1,446,586 sessions · 19,626 salesunpaid — take-back page0.000% · 64,749 sessions · 0 sales
Session-to-transaction rate by channel and destination, 2026-01-01 → 2026-09-02. Unpaid traffic converts at 1.357% everywhere else and 0% here; Google Ads converts at 1.396% everywhere else and 0% here. Every channel that touches this page returns zero.

Roughly two-thirds of all Google Ads traffic in 2026 — 426,435 sessions — was sent to a page that has never produced a sale, while the third sent elsewhere converts at 1.4%. That is a page-level result, and it rules out “the ads bought the wrong people” as the sole explanation.

C7 · the mechanism

The funnel never starts

Not a checkout that leaks. A journey that never begins.

Everywhere else

Sessions2,645,499
Clicks to pricing229,700 · 8.68%
Clicks to checkout128,215
Transactions24,076

Take-back page

Sessions527,284
Clicks to pricing424 · 0.080%
Clicks to checkout56
Transactions0

Sessions here move toward pricing 108× less often than elsewhere. Arithmetically right; as a statement about readers, misleading — the denominator is ad taps (see Verified 09-03). Most of these sessions never became a rendered page. The ratio measures the traffic type, not the page.

C1 · what the site actually attracts

Nobody arrives for the politics

Of the 35 blog pages inside the top 80 landing pages, zero are political-theme.

Streaming & social93,027 sessions

Eleven geo-unblocking how-tos: Snapchat location, YouTube ads, TikTok region, Hinge bans, Fortnite lobbies, Valorant servers, Tinder location.

Censorship & surveillance0 pages

Not one page on censorship, surveillance, speech or political access appears in the top 80 by organic traffic.

Who actually buysUS × Apple × yearly

Median 204.23 GB traffic — the governed join of 2026-08-28. A heavy streamer, not the political-safety persona.

how-to-change-snapchat-location 17,089 how-to-watch-youtube-without-ads 14,131 how-to-change-region-on-tiktok 13,167 how-to-get-unbanned-from-hinge 10,792 how-to-get-bot-lobbies-in-fortnite 8,164 how-to-change-servers-in-valorant 5,708 how-to-change-location-on-tinder 5,302

The people who arrive want to change their TikTok region. The NFL / streaming instinct in the August marketing deck is the evidenced one, and the site's own top organic pages already prove it. The September target-audience document points away from the customer the data shows.

Full dossier · 3 September 2026

How long, what it cost, who paid in hours

From Slack (to 08-18), ClickUp (906 family tasks, zero hours tracked), eight 2026 decks and the warehouse. Labels: fact · MN claim · estimate · unknown.

Duration · fact9 months, still running

Announced 2025-12-05 · LP live 2026-01-05 · ads 2026-01-07 → August (~8 months) · editorial 2025-12-23 → today, 533 posts.

Money · mostly unknown€1,100 known

Meta April €1,000 + a €100 test. Google Ads (~460k taps), Telegraph ×3, Standard.co.uk, i2Coalition: not in any captured source. The Ads cost column is the one ask.

Human hours · estimate≈ 3,300–5,300 h

1.9–3.1 person-years across 14 people, a daily core of five. Modelled from counted output (470 articles, 100 banners, 34 weeks of ad ops, 30 recaps); ClickUp logs 0 h.

Work (count is a fact)CountRate assumedHours
Editorial articles written, edited, uploaded4703–5 h (AI-assisted)1,600–2,665
Daily topic sourcing~180 days1 h/day180
Post images (68 design tasks + heroes)~2501–2 h250–500
Weekly + monthly recaps, three formats304–6 h120–180
Social distribution, daily~180 days1–2 h/day180–360
Paid media set-up (56 to-dos) + weekly ops Jan–Aug56 + 34 wk2–3 h · 4–8 h/wk255–430
Ad banners and size adaptations~1002–3 h200–320
LP build, CMS, GTM, later UI redo100–140
Management and monthly reporting9 mo20–25% of a month290–360
Partnerships arm (i2C, Telegraph, Standard, listicles)120–200
Total≈ 3,300–5,300

Calibrated to MN's real payroll (public Sodra registry, fetched 08-16): MN Intelligence UAB — the consumer-VPN entity where marketing sits — pays €3,107 average gross to 13 staff (MN Technologijos, engineering, pays €6,365 to 12). With ~1.8% employer contributions over a ~166 h month that is ≈€19/h, so the campaign consumed ≈€63k–€101k of salary time (band €53k–€152k across the monthly spread and the chance some designers sit in the engineering entity). The LT ring's entire payroll is ≈€113k/month, so this programme spent roughly 0.6–0.9 months of whole-company payroll. Three of the original team left during the campaign (partnerships 02-24, SEO ~03, organic lead ~05).

The KPI

It hit its target every month it had budget

The target was the traffic it bought.

  • Q4-2025 priorities deck: "Improve our Image & Build Awareness — VPN KPI: # of web sessions 40.8k → 49.6k".
  • Monthly all-hands decks, VPN marketing slide: Jan "Session count +25% (218,785 → 273,481)" · Feb "100th article on take-back (43,652 sess)" · Mar "organic sessions grew by 15%" · Apr "Substack released (1.95K subscribers)" · May "Started a Summer campaign, Started Censorship Index project".
  • Q2-2026 company priority: "VPN — grow brand visibility (# of web sessions)".
  • Q3-2026 company priority (06-05): "Your identity is already being sold online. We build the tools to take it back. Sell Digital Protection — not a VPN." — the same persona, made doctrine four months after the first zero was in the warehouse.
Every initiative aimed at the same customer

One persona, fourteen tries, one number

"Non super technical person who is skeptical about internet restriction, government surveillance" — Slack, 2025-12-05.

InitiativeWhenChannelPersona fitWeb result
Take-back page + awareness adsJan–Aug 2026Google (YouTube / in-app), Meta, X, Redditexact527k hits · 0 purchases
Editorial programme — 470 articles, Restriction FeedDec 2025 →organic, socialexact — 135 surveillance/ID, 111 censorship, 102 same themes uncategorised, 40 breaches, 35 platform; only 17 touch VPN or privacy tools105k sessions · 0; per-post traffic down 20× (median 441 → 25)
Recaps + Substack "Cookies Disabled"Apr 2026 →Substack, FB, IG, X, TikTokexact25 posts · ~1,000 subscribers · no revenue instrument
Reddit staff repost programmeJan 27 →Reddit organicexactunmeasured
i2Coalition / VPN Trust InitiativeFeb 2026credibilityexactbadge · fee unknown
Censorship Index 2026 researchApr–Jundigital PR (published on goproxies.com)exactVPN campaign task still backlog
/internet-freedom LPMar 2026 →organicexact185 sessions · 0
Summer campaign "Borders belong on maps" + $2.99Jun 3 → Jul 15Google, Meta, Reddit, email, Standard.co.ukhybridReddit: 1 web purchase in July, all pages; task notes call it "outperforming by ROAS" — instrument conflict
Empire State trend burst "Not hiding, just refusing to be observed"Jul 3–7Reddit, Metaexact + travellersCTR/CPC test only
Telegraph sponsored features ×3 + code VALUE26May–Julsponsored print/onlinenot this persona (travel)code never appears in the captured coupon table (extract 04-28)
Nostalgia / nothing-to-prove LP "Your internet was supposed to feel free"Aug 17 →Reddit, Metaexact4,246 sessions · 0 · India 704, Indonesia 167, Israel 127 vs US 1,018
Reddit NG · CI · BJ · BG · GH campaigns ("online income interests")Aug 2026Redditnot this persona; tier-3 one quarter after "Tier 3 is not the target"Reddit 2026 total: 65k sessions · 2 purchases · $29
Q3-2026 positioning: Digital Protection · UK & Poland · MystNodes "Fight censorship"Jun 2026 →strategyexact, escalated

Not in the family, listed so nothing is missed: Black Friday 2025, the Valnet affiliate network (Aug), Fatjoe reviews (MystNodes), Omnisend retention mails, DeleteMe / WhiteBridge partnerships.

Second instrument conflict · testable

Reddit. MN optimises Reddit campaigns on "ROAS/conversions" in its own task notes; MN's tracker shows Reddit at 2 web purchases in all of 2026 and the nostalgia traffic landing in India, Indonesia and Israel. Either Reddit's pixel counts app-store installs the tracker cannot see, or the optimisation runs on platform-reported conversions that never became revenue. Test: Reddit Ads Manager August conversions vs purchase_events.

The current Target Customer

Who this was built for, and who actually buys

Three descriptions of the customer exist inside MN today. They do not describe the same person.

1 · The stated persona"Skeptical about internet restriction, government surveillance"

Slack #marketing, 2025-12-05: "Non super technical person who is skeptical about internet restriction, government surveillance … We do not know it is our perfect client, but it's the audience we'll be searching for." The September 2026 Target Audience (I) document writes the same person up: 17–50, US · EU · UK · AU, politics and world-news interests, reached on X, Reddit, YouTube, podcasts; pains = censorship & geoblocks, surveillance, platform control, unreliable information. No figure in it is computed from customer rows.

2 · The measured paying cellUS × Apple × yearly, heavy streamer

The governed account join (2026-08-28): modal paying cell is US × Apple × yearly, median 583 service days, median $128.92 net, 84.7% active in the last 90 days, median 204 GB/month of traffic — support-silent, telemetry-friction-heavy. Organic acquisition agrees: the top blog entry pages are TikTok region, Snapchat location, YouTube ads, Hinge bans, Fortnite lobbies (93k sessions); zero political-theme pages in the top 80.

3 · The ICP evidence board15 hypotheses · 11-way tie · no winner

The VPN ICP evidence board (3 Sep, a private working room) assessed fifteen candidate customers: eleven tie on weak evidence, none has candidate-level economics, and C12 "recently alarmed by exposure" is the research start by mechanical tie-break — research only, no launch. The stated persona maps onto C01b "blocked news and perspective seekers" and the privacy candidates: all at need weak · reach weak · economics none.

QuestionStated persona (1)Measured payer (2)
Why they want a VPNCensorship, surveillance, being judged for opinionsChange a TikTok / Snapchat / Tinder region; watch what is geo-blocked; unblock a game lobby
Where they are foundX, Reddit, YouTube, podcasts, news appsGoogle search (brand and generic VPN), Bing, affiliates; the app stores
What the site attractsZero political-theme pages in the top 80 organic entriesEleven geo-unblock how-tos: 93,027 sessions
Tested at scale?Yes — this campaign, nine months, 0 purchasesYes — every purchase the paid book made in 2026 (Brand search, PMax, offer pages)
Tolerance for the product's current defectsLow: the 09-02 runtime tests recorded the client failing open (direct ISP address exposed within 3 s, 45 s window, no kill switch in that configuration) — disqualifying for a political-safety customerHigh: survivable for a streaming customer
What this room adds to the customer question

The persona has now been tested at scale, through the web door, and did not buy.

The ICP board's honest status is "no winner yet." This campaign supplies the one large experiment the board did not have: the stated persona was given the site's second-biggest door, ~460,000 paid taps and 470 articles for nine months, and produced no purchase on any instrument. That does not close the persona; it prices it. It is a new-segment acquisition bet — to be costed as acquisition, not assumed as a description of the existing base — and it should be sequenced behind the protection-truth work the runtime tests call for, because it is the one customer for whom the current defects are disqualifying. The customer the data already shows is being acquired today, cheaply, by Brand search and offer pages; the question the ICP work still has to answer is whether that customer can be recognised before purchase.

The comparison that removes every excuse

MN ran a converting ad account and a non-converting one side by side.

The obvious objection to everything above is that something is broken — the tracking, Google Ads, the agency, the whole web funnel. It isn't. In the same account, the same months, the same table, MN's Google budget split two ways:

Google Ads destination · 2026 YTDSessionsTransactionsRevenueConversion
take-back page426,4250$00.000%
offer / deal / pricing pages213,9852,931$62,9961.370%
other pages5,061157$4,0563.103%

Two-thirds of MN's 2026 Google clicks went to the page that returned nothing. The third that went to offer pages returned $63k. The tracking works, Google Ads works, and MN knows how to run a converting campaign — the variable is the destination and the message, nothing else.

Clicks, not budget — a correction. An earlier version of this page said "two-thirds of the budget". That was wrong: the two destinations sit on very differently priced inventory. Take-back took 17 Google search clicks in five months; the offer pages took 39,315. Search on VPN keywords is Google's most expensive inventory; the YouTube, display and in-app taps that make up all of take-back's traffic are among its cheapest. The click split is measured; the money split cannot be computed without the cost column.
E7 · every page group, 2026 YTD

Where the money actually comes from

Paid conversion by page group, 1 January – 31 August 2026.

Page groupSessionsPaid sessionsTransactionsPaid conv.Revenue
Persona / awareness family
take-back · 470 editorial articles · /internet-freedom · nothing-to-prove
633,933465,46400.000%$0
Offer / deal / pricing pages427,361370,4285,5371.082%$116,797
Homepage1,283,412810,80311,3160.039%$224,481
Other blog — geo-unblock how-tos308,65225436$904
Everything else — app, checkout, downloads505,1538,4507,070$134,761
Google gclid 2,908 tx · $63,180 Microsoft msclkid 604 · $9,856 Impact affiliate 481 · $12,324 CJ 192 · $4,246 gbraid 180 · $3,871 Meta 39 · $1,678 Omnisend 15 · $415 Reddit 2 · $29 X 0

The purchase stream even names the winners: "search — Brand — BE/CA/FI/DE/IT/NL/CH/NZ" (58 purchases), "search — Brand — FR" (39), "search — Brand — US" (22), "PMax — US (ROAS) web purchase" (15 across variants). Brand search and PMax sell. Awareness does not.

Opportunity cost · estimate, ceiling not forecast

Had those 426,425 Google sessions been pointed at the offer pages instead, at the rate the same account achieved in the same months, they would have produced ≈5,800 transactions ≈ $125k. Assumption named: awareness-intent clicks would not convert like offer-intent clicks, so $125k is the ceiling; the floor is $0. The media spend itself is still unknown either way.

Batch F · the 4,009 decomposed

What paid marketing actually buys

Origin, campaigns, cost ceiling, and share of every sale MN made in 2026.

Delivered by three channels98.7%

Google Ads 2,931 · Microsoft 604 · Impact affiliate 421. Meta 25, Reddit 2.

Delivered by one page84.9%

3,402 of the 4,009 land on /offer.

Campaign names knowable4%

GA4 names a campaign for 176 of 4,424 paid purchases. 73% of those are Brand search.

Share of new customers13.5%

Company-wide; 24.8% of the web door. ~86% arrive with no paid click.

F1 · who delivered the 4,009

Three channels, one page

Paid-click purchases on offer / deal / pricing pages, 1 Jan – 31 Aug 2026 · $85,711 first-purchase revenue.

ChannelPaid sessionsPurchasesRevenueShare
Google Ads · gclid + gbraid196,0922,931$62,99573.1%
Microsoft Ads · msclkid9,284604$9,85615.1%
Impact affiliate · irclickid38,437421$10,99710.5%
Meta · fbclid45,39625$1,0990.6%
Omnisend email42914$4020.3%
CJ affiliate48712$3340.3%
Reddit · rdt_cid50,1042$280.0%

Read the bottom rows twice: on offer pages — pages whose whole job is to sell — Meta bought 45,396 sessions for 25 purchases and Reddit 50,104 for 2. Paid social fails on the selling pages too, not only on the awareness page. Note what this does not say: the take-back campaign itself was 92.2% Google Ads (426,435 of 462,535 paid sessions), 7.6% Meta, 0.2% Reddit and X. It was a Google buy with a small Meta tail — never a social campaign.

F2 · the coverage defect

MN cannot see which campaign sold what

Marketing.purchase_events is the only surface carrying campaign names.

2026 purchases in GA4's purchase streamCountShare
carrying a paid medium — i.e. attributable to a campaign1761.0%
(direct)10,39959.9%
campaign name NULL6,02934.7%
organic7354.2%
referral280.2%
Total17,369

The session tracker sees 4,424 paid-click purchases in the same window. GA4 names a campaign for 176. ~96% of the paid book is invisible in the surface where campaign names live — so the take-back zero could not have been caught from the reporting in use: in that view the entire paid business looks like a couple of hundred sales a year.

Of the 176 that are named, 129 — 73% — are Brand search ("search – Brand – US / UK / FR / BE-CA-FI-DE-IT-NL-CH-NZ"): people typing Mysterium VPN into Google, i.e. demand the brand already created. The rest is generic VPN search and PMax. Not one named campaign is an awareness or persona campaign.

F3 · share of every sale

86% of new customers arrive with no paid click

Denominator split by revenue_type so automatic renewals are not counted as sales marketing won.

2026 YTD denominatorPurchasesRevenuePaid marketing's share
New purchases, company-wide32,733$613,60113.5% · 15.6% of revenue
— of which on web gateways (Stripe · CoinGate · PayPal · Adyen)17,813$359,35924.8% · 26.6%
— of which in the app stores (Apple · Google, no click id possible)14,920$254,242
All acquisition (New + New/History + Winback)41,216$747,40110.7% · 12.8%
Every purchase incl. recurring renewals80,460$1,282,8925.5% · 7.5%
Cost · unknown, but the breakeven line is now fixed

All paid web marketing returned $95,599 of first-purchase revenue on 4,424 purchases — $21.61 per acquired purchase; Google Ads alone $67,051 / 3,088 = $21.71. If MN's blended Google CPA exceeds ~$21.71 it loses money at purchase one and depends on renewals to pay back. At the governed median LTV of $128.92/account those 4,424 acquisitions are worth ≈$570k over full life [rough], so a CPA up to ~$100 could still defend itself. Between $21 and $100 the answer flips on renewal rate — only the Ads cost column decides it.

The two numbers to hold side by side

$95,599 versus two-thirds of the budget.

Paid marketing's entire measurable contribution to MN in 2026 is $95,599 of first-purchase revenue. The take-back campaign consumed two-thirds of the Google Ads traffic in that same year and contributed $0 of it. And three-quarters of what paid marketing did earn came from Brand search — capturing demand the brand already had, not creating any.

Where the money came from

The ads were paid for by funding, not by customers

Spend is still unknown. Its size can be bracketed; its source is a fact on the public record.

take-back Google clicks · 426,435at €0.10at €0.25at €0.50
Estimated media cost — market benchmarks, not MN data€42.6k€106.6k€213.2k

€0.10–0.50 is the ordinary band for YouTube / display / in-app inventory, and it brackets MN's own single disclosed target (Meta awareness at ~€2.50 CPM lands at €0.25–0.50 per click at 0.5–1% CTR). So the Google buy plausibly ran €40k–215k, central ≈€105k. For contrast the offer-page buy, with its expensive search slice, brackets to €120k–350k and returned $62,996 — on these benchmarks both halves of the account lose money at first purchase; take-back is simply the half that returned nothing at all. Every figure in this paragraph is an estimate and dies the moment the Ads cost column is read.

Ring cost base · fact≈€283k / month

FY2025, both LT entities. Payroll is ≈€113k — so ≈€170k/month is non-payroll: node payouts, processor fees, ads, tools, intercompany.

Ring result · fact−€25k / month

Combined equity −€784k; liabilities €1.82M, which the filings and the all-hands corpus both read as group/intercompany funding.

What marketing returned · fact$95,599

All paid web marketing, first-purchase revenue, the whole of 2026 — against a media buy bracketed in the same order of magnitude.

The answer

The group treasury paid for it, not the customers.

MN buys ads out of funding — the ring runs at a loss carried by €1.82M of intercompany liabilities, as the 2023 all-hands stated: "majority of the expenses are covered from the allocated project budget … company capital." The spend line lives in Google Ads, outside the warehouse. The revenue line lives in the warehouse, outside Google Ads. No report in the company joins them — which is the same instrumentation gap that let a nine-month zero pass unremarked.

Discipline

Limits that must travel with these numbers

State them wherever the figures go. Two of them are load-bearing.

  1. Web door only. This table's gateways never include Apple or Google — roughly 44% of clean July revenue. App-store purchases influenced by these ads are invisible here.
  2. Entry-page, same-session attribution. A visitor who lands on the campaign, leaves, and returns later via the homepage is credited to the homepage. Brand lift and assisted conversions are not measured and are not claimed either way — though the funnel result argues against them.
  3. Revenue basis. The revenue column is session-attached and duplicate-carrying (July 2026 $114.7k here versus $91.3k non-store clean). Transaction counts are the load-bearing figures; zero is unambiguous on any basis.
  4. Partial edges. 2026-09 is two days. The older W2d2 extract cuts at ~2026-08-16.
  5. GA4 is a consented ~1% sample with no linked Google Ads campaign names (every google_ads_campaign field is NULL); the raw tracker starts 2026-04-07, so January–March rest on the aggregated copy alone.
  6. The search-authority hypothesis is untested. That the page pays for itself by building domain authority (DR 53 → 60) remains a hypothesis and is sized smaller than it was first stated: search is 41% of the web door, and the web door is roughly half the business.
Open

What is still missing

Both are MN-side asks. Neither changes the measured result.

Open · highest value

What did Google Ads charge for ~460,000 taps, by month? Nothing in the warehouse, Slack, ClickUp or the decks carries it except one fragment — Meta, April, €1,000. Any total quoted before MN's Google Ads account is read is an estimate. The ask is one screenshot of the campaign cost column, by month.

Open · separate and larger

Does MN pay for radsid? Sources eu.effic.pro, us.effic.pro, us.macly.co, eu.bestteam.club, eu.traff.world carry 1,592,984 sessions, 6 transactions, $0 — traffic-arbitrage inventory, roughly 16% of all sessions in the file. Unrelated to this campaign, and bigger.

Provenance

Evidence

Batches C (09-02), D (09-03, eleven files) and E (09-03, four files); sha256 in the manifest. Aggregates only. Written analyses: CONTEXT/2026-09-02-takeback-campaign-attribution-result.md · CONTEXT/2026-09-03-takeback-zero-verification.md · CONTEXT/2026-09-03-takeback-full-dossier.md.

Marketing.purchase_events was deliberately not used. The W2e/W2e2 batch of 2026-08-16 established that its traffic_source reads 75% (direct)/(none) and 24% null on purchases — it cannot answer a source question. claude.vpn_web_sessions carries landing_page, so the campaign is measurable by entry page instead, which is the stronger instrument.
Result files and hashes 7 files

C1 · 2026-09-02T143230Z-C1-landing-pages-since-2025-12.csv
sha256 4292ef210a11dd504fdf887fd219bb7a4b98320a6aca82063dcbbf16c528c6f4
one row per landing_page, 2025-12-01 onward, top 80 by sessions

C2 · 2026-09-02T143230Z-C2-nullcontrol-takeback-vs-homepage.csv
sha256 5a975176082e9ceaa1d5e370690ecdc997234826fc459412f1b9cc26ee7365c0
one row per page class — the NULL-vs-zero control

C3 · 2026-09-02T143230Z-C3-takeback-monthly.csv
sha256 c41668f93669e40b9919bee2351d79fc08d9e217ebc58416ffdedcdef3984290
one row per calendar month, 2025-11 onward

C4 · 2026-09-02T145900Z-C4-takeback-by-channel.csv
sha256 3d2fbcc93d8a8d3595718a1293146591e26417cb5138af4338f58212798f337d
one row per channels_type on the campaign page

C5 · 2026-09-02T145900Z-C5-takeback-paid-monthly.csv
sha256 0c32df95d7e36ba84fa144fa0145cdf39d3c52650178fa9aca270e1bbf3dc278
one row per month, paid vs unpaid split

C6 · 2026-09-02T145900Z-C6-paid-split-samewindow.csv
sha256 cf95ead163d233b090e3a614276ecff47037375d6787114062b9b08c23554a27
channel × destination, same window 2026-01-01 → 2026-09-02

C7 · 2026-09-02T145900Z-C7-funnel-depth.csv
sha256 cda155f60268609cf910656d9309b9ceab0b9c686f8420065ea7a20a24121fe2
destination × funnel step

Files ~/Claude/Projects/Kairos/CONTEXT/warehouse/
Manifest CONTEXT/warehouse/MANIFEST.md § Batch C
Written analysis CONTEXT/2026-09-02-takeback-campaign-attribution-result.md

The load-bearing query C2 · the control
SELECT
  CASE WHEN landing_page = 'https://www.mysteriumvpn.com/take-back-the-internet'
         THEN 'take-back campaign'
       WHEN landing_page = 'https://www.mysteriumvpn.com/'
         THEN 'homepage (control)'
       ELSE 'all other pages' END               AS page_class,
  COUNT(*)                                      AS rows_,
  SUM(no_sessions)                              AS sessions,
  COUNTIF(transactions IS NULL)                 AS rows_tx_null,
  COUNTIF(transactions IS NOT NULL)             AS rows_tx_notnull,
  COUNTIF(transactions > 0)                     AS rows_tx_positive,
  COALESCE(SUM(transactions), 0)                AS tx_sum,
  ROUND(COALESCE(SUM(revenue), 0), 2)           AS rev_sum
FROM `mysterium-bq.claude.vpn_web_sessions`
WHERE session_start_date >= '2025-12-01'
GROUP BY 1

Frozen evidence page, dated 3 September 2026. Every figure was read from the named result files at build time. A later measurement supersedes this page with a newer dated one; it does not edit it.