CryptoVPN Privacy Policy

Effective date: September 25, 2026.

This Privacy Policy explains how the CryptoVPN Android application, the CryptoVPN Fleet service, and participating VPN nodes access, use, retain, and delete data. For privacy questions, contact vpnappcrypto@gmail.com.

1. Application purpose

VPN connectivity is CryptoVPN's core function. When you choose to connect, CryptoVPN uses Android VpnService to route eligible device traffic through a selected VPN node. You can disconnect at any time. Optional split-tunneling rules can route selected applications or domains outside the tunnel. The application routes .ru and .su domains directly.

2. Data processed by CryptoVPN Fleet and VPN nodes

2.1. Device identity and access credentials

The application creates a random device ID and a separate secret for authenticating requests to Fleet. The secret is protected in local Android storage; Fleet stores a one-way digest of it. The application also sends a SHA-256-derived value based on the app-scoped Android ID so Fleet can recognize the same device after a normal reinstallation. The original Android ID is not sent to Fleet. Fleet stores a keyed digest of the derived value, not the value itself. These identifiers are used for access control, trial continuity, and abuse prevention.

The derived identifier may remain the same after reinstallation when the Android user and application signing key remain the same. It may change after a factory reset, a change of Android user, or a change of signing key. It is not an account name or an advertising identifier.

2.2. VPN access, trial, and usage

Fleet and the selected VPN node may store:

• the device ID, account creation time, and last activity time;
• the selected country, node, access status, and VPN peer assignment;
• the trial start and reset or expiration times and traffic limit;
• aggregate bytes transferred, used to show and enforce the trial limit;
• technical VPN peer identifiers and connection state needed to provide the tunnel.

The current application displays plan options but does not process payments or collect payment card details. This Policy must be updated before payment processing is introduced.

2.3. Google Play Integrity, when enabled

The application supports Google Play Integrity. If this check is enabled by Fleet, the application asks Google Play for a verification token; Fleet sends that token to Google for verification. The verdict is used to help identify an authentic application and device environment. Fleet may issue a time-limited access confirmation after verification. The verification token is not stored as a permanent device record in Fleet's database.

2.4. Technical request data

When the application contacts Fleet or a VPN node, the source IP address, request time, requested endpoint, response status, and error information may be processed by the service and its infrastructure providers to deliver requests, diagnose failures, and prevent abuse. This information is not used to build advertising profiles.

3. Data processed on your device

The application may store or process locally:

• the protected device credential and a time-limited integrity confirmation, if enabled;
• language, notification, selected country, and split-tunneling preferences;
• installed application names and package names displayed for app-based split tunneling;
• domain rules entered for domain-based split tunneling;
• connection history: node label, start time, duration, and aggregate traffic for up to 64 connections;
• current VPN state, traffic counters, and node latency measurements.

The installed application list, selected application package names, saved domain rules, and connection-history entries are not uploaded to Fleet by the current application. Domain rules are applied by the local tunnel, while DNS providers and requested services may still receive the information needed to resolve and serve a requested domain.

4. VPN traffic and DNS

While connected, traffic covered by the VPN is encrypted between your device and the selected VPN node. The node forwards it to the internet. Traffic excluded by split tunneling, including .ru and .su domains, uses a direct connection instead. DNS queries may be processed by the DNS servers configured for the tunnel or by the device's direct network resolver for excluded traffic. Fleet requests may use the direct network so that the application can reach the service while the VPN is active.

Fleet records aggregate traffic usage, not the contents of messages, files, or web pages. VPN nodes and network providers necessarily handle connection metadata and traffic to route it. Requested websites, DNS providers, and network operators may process data under their own privacy practices. CryptoVPN does not redirect traffic for advertising monetization.

5. Purposes of processing

• provide and maintain VPN connectivity and server selection;
• authenticate devices and restore access after reinstallation;
• measure trial usage and enforce access limits;
• apply user-selected split-tunneling settings;
• show local connection history and VPN notifications;
• secure and diagnose the service and prevent abuse;
• comply with applicable legal obligations.

6. Disclosures and service providers

CryptoVPN does not sell user data or use advertising or third-party analytics SDKs in the current application. Data needed to operate the service may be processed by:

• infrastructure providers hosting Fleet and VPN nodes;
• Google, only when Play Integrity verification is enabled or when you use Google services independently;
• DNS providers and websites or services you choose to access;
• public authorities when disclosure is required by applicable law.

If you choose to email support, your email provider will process that message under its own terms. The application does not automatically send your support correspondence to Fleet.

7. Android permissions and capabilities

• Internet and network-state access support Fleet requests, node checks, and the VPN connection.
• VpnService creates the device VPN tunnel after Android's VPN permission flow.
• Foreground Service keeps an active VPN session running.
• Notifications show the connection state, duration, and aggregate traffic when permitted.
• Launcher-app visibility lets you choose applications for local split tunneling.

8. Retention and deletion

• Local settings and history remain until overwritten, cleared with application data, or removed by uninstalling the application. The connection history is limited to 64 entries.
• Fleet retains device, trial, and aggregate usage records while needed to provide access, maintain trial continuity, prevent abuse, or meet legal requirements. The current service does not promise automatic deletion after a fixed number of days.
• Infrastructure and security records may be retained for operational or legal purposes according to the relevant provider's practices.

CryptoVPN does not currently require an email or password account. To request access to or deletion of data associated with your device, email vpnappcrypto@gmail.com. We may request information needed to identify the correct device record and prevent unauthorized deletion. Data will be deleted or de-identified unless a legal or security reason requires retention.

9. Data security

CryptoVPN uses HTTPS for Fleet requests, Android platform storage and Keystore protections for the local device credential, access controls for service infrastructure, and encryption between the device and VPN endpoint. No transmission or storage method guarantees absolute security.

10. Children

CryptoVPN is not specifically directed to children and does not knowingly collect children's personal data. If you believe a child has supplied personal data, contact us so we can review and address it.

11. Changes to this Policy

This Policy may change when application functionality, data practices, or legal requirements change. An updated effective date and the current text will be published on this page.

12. Contact

Service: CryptoVPN.
Privacy contact: vpnappcrypto@gmail.com.