Privacy Policy

We’re built for privacy. Internally, we know exactly what that standard requires: privacy functions as the primary filter for every architectural decision. If forced to choose between a practice that solidifies user confidentiality and an aggressive tactic that might accelerate business metrics, we will always prioritize security over growth. To review our operational principles and beliefs, please explore our team and ethics documentation.

We believe absolute transparency is vital. This policy provides a comprehensive, plain-language breakdown of:

• What our "logless" infrastructure means in practice

• What technical data is processed, how it is isolated, and its lifecycle

• How we handle legal requests, court inquiries, or DMCA copyright notices

• Our automated protocol for expired, cancelled, or dormant subscriptions

• How data subject access requests are fulfilled under privacy regulations

We have authored this document to be straightforward, concise, and immediately intelligible so you can evaluate the facts directly.

Zero user information is our goal

As a privacy-focused network operator, we collect only the bare minimum data required to establish secure cryptographic tunnels. Most online companies require personal email addresses to drive recurring marketing funnels and monetization cycles. When registering with VPN for Android, you are never asked for names, physical locations, or email credentials. We also strictly refrain from recording personally identifiable attributes like source IP addresses.

Because no personal contact details are held on file, we have no mechanism to broadcast unsolicited promotional alerts. If you choose to supply an administrative contact address for service maintenance notices, you may do so optionally inside your dashboard post-registration.

What data don’t you log?

We enforce a strict zero-logging policy across our network. We do not inspect, retain, or monitor network activity during your VPN sessions:

• No traffic or browsing activity logging

• No connection session timestamps or duration records

• No DNS lookup logging or query tracking

• No bandwidth or data volume logging per user

• No recording of originating subscriber IP addresses

• No activity logs except the active simultaneous connection counter (detailed below)

What data do you log on sign-up?

When generating an anonymous account, our authentication server retains only the baseline technical metadata shown below:

What information is logged when making a payment using a credit card, PayPal, Cash, cryptocurrency or voucher code?

When subscribing to a plan, the following transaction ledger entry is processed:

Certain payment metadata depends on your selected checkout method. When using PayPal, a transaction reference is mapped to your account token to maintain subscription validity. When paying via self-hosted BTCPay Server, an internal blockchain hash is linked. Voucher tokens used to claim service duration are permanently expunged 30 days after activation.

Credit card processing is handled via standard enterprise merchant processors. If automated renewals are chosen, an isolated tokenized reference is stored without saving raw card numbers.

Standard ledger format for card transactions:

Third-party payment gateways collect standard transactional billing details per financial regulations. VPN for Android does not store financial credentials on our VPN nodes, and external payment processors never have access to your VPN account credentials.

For enhanced anonymity, we recommend utilizing privacy-preserving cryptocurrencies or cash payments.

Why do you store transaction_id and subscription_id?

Transaction references are retained solely to fulfill our 30-day money-back guarantee, resolve billing discrepancies, and facilitate voluntary recurring subscription management.

What information is logged when I visit the website?

We deploy self-hosted instance analytics purely to measure aggregate traffic performance, load balancing, and overall site accessibility. Unlike surveillance providers such as Google Analytics, all aggregated telemetry is processed internally on secure bare-metal servers under our direct administrative control.

When loading web assets, non-identifying header metadata is received:

• Browser user-agent string

• Language preferences

• Display resolution

• Referring website header

• Truncated IP address (the final two octets are stripped immediately)

Local client settings such as dark/light color themes and interface options are saved directly in your browser's local storage and are never uploaded to remote servers.

Where is my data stored and who has access to it?

Our operations comply with stringent GDPR standards. We do not locate core authentication nodes in jurisdictions that impose mandatory subscriber retention mandates. VPN servers operate purely from ephemeral memory (RAM-disk environments) where no persistent identifiable records exist.

How do you limit the number of connected devices?

Our authentication clusters maintain an ephemeral table of active device tokens linked to account IDs:

• A random 16-character alphanumeric session token

• The associated account ID

We never record hardware IMEI numbers, serial identifiers, or MAC addresses. When an application session is terminated or signed out, the ephemeral token is erased immediately.

How do you limit simultaneous connections?

During active connection establishment, the gateway queries an in-memory session counter to ensure simultaneous tunnel limits are respected. As soon as you disconnect, the in-memory entry is wiped. Historical session records are neither compiled nor archived.

What information is stored for device management?

Device management is completely opt-in. When activated, devices are designated using randomized placeholder labels (A through G) rather than real hostnames, completely preventing hardware fingerprinting.

What information is retained when I stop using your service?

When an account reaches conclusion or is manually closed, all related records are permanently destroyed within 90 days, or instantly upon clicking "Delete Account" inside your dashboard.

How can I get access to the data you store on my behalf via a subject access request?

Under GDPR requirements, data subject access requests are fulfilled within 28 days upon verification of account ownership. Formal inquiries can be submitted via mail to [email protected].

What happens if you receive a legal notice such as a DMCA for copyright material?

Network traffic emerges from our shared gateway IP addresses. Copyright notices sent to our legal desk receive an official response stating our network operates with zero connection logs, making it technically impossible to match an external notice to any specific individual.

How do you react when requested by an authority for information relating to a customer?

We comply strictly with legitimate, binding court orders within valid legal jurisdictions. However, we cannot disclose information we do not possess. Because no activity logs, browsing records, or identifying data exist on our infrastructure, no customer connection history can ever be extracted or provided.

What happens if laws change?

If legislative mandates in our operating jurisdiction ever conflict with our uncompromising privacy principles, we will alert subscribers openly before enactment, offer prorated refunds, and relocate or terminate affected infrastructure rather than compromise our users.

Crash Logs

In the event of an application crash, anonymized diagnostic crash traces (operating system build, crash call stack) may be reviewed locally to correct bugs. No personally identifying network logs are ever embedded, and crash reporting can be toggled off at any time in client preferences.

Device permissions for Personal Data access

Our mobile applications require specific Android and iOS runtime permissions strictly to execute automated security features:

Android App

Background location permission (continuous):
Required solely by the Android OS to identify the current Wi-Fi network SSID when automatic Network Protection is enabled.

Camera permission:
Used exclusively to scan QR codes for swift account authentication.

iOS App

Permission to save VPN profile:
Required to install Network Protection configs.

Camera permission:
Used to scan QR code login credentials.

Changes to policy

Any necessary amendments to this policy will be documented visibly across our platform prior to taking effect. Inquiries concerning this policy may be directed through our help center.