Windows setup

Install WireGuard for Windows from wireguard.com.
On your account page, choose Add device. Your WireGuard key pair is made on your side, never by us; there are two ways to do it, described below.
In WireGuard click Import tunnel(s) from file and choose one or more .conf files (or the ZIP).
Select a tunnel and click Activate.

Two ways to add a device

In the browser (JavaScript on). The account page generates the key pair inside your browser, sends us only the public key, and shows one .conf download per server with the private key already filled in. Import those directly. The private key exists only on that page: download everything you want before leaving it.

With the WireGuard app (JavaScript off, or if you prefer). In WireGuard choose Add Tunnel → Add empty tunnel; it shows a freshly generated key pair. Copy the public key into the account page and download the ZIP. Then either paste the Interface and Peer values from a .conf into the empty tunnel, keeping the app's own PrivateKey line, or import the .conf, click Edit and replace PRIVATE_KEY_HERE with the private key the app generated.

Checks

With the tunnel on, open our leak check. Each address it shows should be an ironkeel server's; "No answer" means that family was not checked. It can't see DNS or WebRTC: ipleak.net, a leak-check site we do not run, tests your browser for both, and no DNS server or address it lists should be your internet provider's.
The tunnel panel should show a recent Latest handshake.
In the tunnel's Edit dialog, keep Block untunneled traffic (kill-switch) ticked; it is on by default for configurations that route everything.

If the tunnel stops

If pages stop loading, check your paid-until date first: switch the tunnel off, or use another device. When paid time runs out, the tunnel stops without a message: it stays on, but nothing gets through, and Latest handshake grows more than a few minutes old. To add time, redeem a voucher on the account page, then switch the tunnel back on.