Privacy Policy

1. Scope and who we are

This Privacy Policy applies to the Such VPN Android app, the VPN service it connects to, and the Such VPN website. In this policy, “Such VPN,” “we,” “us,” and “our” mean AQX LLC, trading as SuchVPN/dVPN, the operator of the Such VPN service and the Such dVPN independent-operator network.

Such VPN does not require a Such VPN consumer account. We do not ask for a name, email address, or password to use the app. The app uses an installation-scoped identity; this does not make use of the service anonymous.

2. Data we process

We limit our processing to information needed to provide access, run the VPN, prevent abuse, restore purchases, and understand whether the service is working.

Installation and device access data

• An installation-scoped cryptographic public key and opaque installation identifier.
• Device registration, access-token state, entitlement tier, and remaining rewarded usage time.
• Security and abuse-prevention state associated with the installation.

VPN session and service-operation data

• Opaque internal session and provisioning references.
• Selected region, mode, and VPN protocol.
• Connection start and end times, session duration, and aggregate bytes transferred.
• Server health, performance, provisioning state, and redacted failure categories.

DNS settings

The Android app stores only the identifier of the public DNS resolver you select. Its addresses are applied the next time the VPN tunnel starts, and DNS requests travel inside the protected VPN route. This does not mean the app uses a separate encrypted DNS transport such as DoH or DoT. DNS queries and responses are not retained as activity history.

Network information

Your IP address is necessarily visible to our API, security systems, VPN servers, and network edge providers when your device communicates with them. It may be processed for routing, rate limiting, security, fraud prevention, and abuse response. Limited historical edge access records are retained for a bounded operational period until scheduled deletion or reconciliation. On the backend reference host, the legacy web-server access log is limited to the active log plus up to seven rotations; the rotation count does not mean a fixed number of days. These records are not VPN activity history, and we do not use them to build a record of sites or services you visit through the VPN.

Website requests

When you visit this website, the hosting and network providers that deliver it may process ordinary request data such as IP address, requested page, browser type, and request time for delivery and security. We do not use third-party advertising trackers on this website.

This site also uses Cloudflare Web Analytics. Its beacon reports page-view and performance metrics; Cloudflare analytics can include page path, browser, operating system, device type, and referring-page information.

3. What we never log

Such VPN keeps no activity logs. We do not collect, log, or store:

• Browsing history or search history.
• DNS request history.
• Destination IP address or domain history.
• URLs you visit.
• Packet contents, payloads, or the contents of your internet traffic.

“No activity logs” does not mean the app or service processes no information at all. The limited operational data described above is required to provide and secure the service.

4. Rewarded ads

When Free access time is exhausted, you can choose to watch a rewarded ad for additional VPN usage time or choose Premium. Ads are never forced or shown while you connect, and Premium users do not see rewarded ads.

We use Google AdMob and the Google Mobile Ads SDK to provide rewarded ads. Depending on your device, region, consent choices, and ad settings, Google and its advertising partners may collect or receive:

• Your IP address, which may be used to estimate general location.
• App and ad interactions, such as app launches, taps, and video views.
• Diagnostics such as crash, launch-time, and performance information.
• Device or advertising identifiers, including the Android advertising ID and app set ID where available.

Google may use this information for advertising, analytics, and fraud prevention. Even non-personalized ads can use identifiers for purposes such as frequency capping, aggregated reporting, and fraud prevention. Where required, the app asks for your privacy choices before requesting ads through Google’s consent tools.

Learn more in Google’s Privacy Policy, How Google uses information from sites or apps that use its services, and AdMob privacy information.

After a completed rewarded ad, Google sends our server a signed verification callback. We validate that callback and its device-bound, opaque reference before adding usage time. We do not put your VPN traffic or browsing activity into the ad-verification request.

5. Google Play billing and Premium

Premium purchases and subscription restoration are handled through Google Play. Such VPN does not receive your payment card details or require a separate login.

To verify, restore, and reconcile Premium access, the app sends a Google Play purchase proof to our server. We verify it with Google Play. The purchase token may be retained solely for subscription verification as versioned, authenticated ciphertext protected by a separate server-side key. It is decrypted only during bounded provider-verification work. Plaintext purchase tokens are never stored in database fields or included in logs, reports, analytics, fixtures, or command arguments. We also retain a one-way token hash and limited entitlement information, such as product, status, validity, and acknowledgement state, to prevent duplicate claims and determine access.

Google processes purchase and Play-account information under the Google Privacy Policy. Removing the app or clearing its data removes the local installation identity and any remaining free rewarded time. An eligible Premium purchase can normally be restored through the Google Play account on the device.

6. When information is shared

We do not sell your browsing activity or VPN traffic. We disclose limited information only as needed to operate the service or meet legal obligations:

• Google: for AdMob rewarded ads, consent management, Google Play billing, and purchase verification.
• Independent Such dVPN node operators and the selected public DNS provider: to process the VPN traffic or DNS requests needed to provide the selected route in real time. Such VPN does not retain activity history; each provider’s own handling is governed by its policies.
• Infrastructure providers: hosting, networking, and security providers that process data to deliver and protect the website, API, and VPN service.
• Legal and safety matters: when we reasonably believe disclosure is required by law, necessary to protect rights or safety, or needed to investigate abuse of the service.
• Business changes: if the service is reorganized, acquired, or transferred, subject to this policy and applicable law.

Advertising partners may independently process information from rewarded ads as described in Section 4. Their processing is governed by their own policies and your available consent choices.

7. How long we keep information

We keep information only for as long as reasonably necessary for the purpose described in this policy, including providing access, maintaining service integrity, preventing fraud and duplicate rewards, resolving disputes, and meeting legal or accounting obligations.

• The installation private key is stored on your device. Remaining Free time is recorded by our server against that installation identity and expires 24 hours after the latest eligible welcome or verified reward grant.
• Clearing app data or uninstalling removes the device key, so the prior installation and any unused free time cannot be restored.
• Server-side installation and access records are kept only while needed to recognize an active installation and protect the service, then removed through bounded cleanup.
• Encrypted Google Play purchase tokens may remain while needed to verify, restore, and reconcile a subscription. Plaintext purchase tokens are not retained in database fields, logs, reports, or analytics.
• Aggregate session accounting, entitlement verification, security, and fraud-prevention records may be retained after a session ends when needed for those purposes.
• Operational and edge access logs are subject to bounded retention and scheduled rotation or deletion. The backend reference host keeps the active legacy web-server access log plus up to seven rotations; this is a rotation limit, not a stated number of days.
• If you send feedback through the app, the server rejects messages that contain email addresses, URLs or domains, IP addresses, opaque identifiers, credential-like secrets, or invalid control data. Validated feedback and the installed app version are visible to administrators for 90 days, then removed by bounded cleanup. Diagnostic summaries and device references are not shown with feedback in the admin panel.

We may retain information longer if required by law, to preserve evidence in a dispute, or to protect the service from abuse.

8. Your choices and rights

• Rewarded ads: you decide whether to request an ad. You can use Premium instead if you do not want rewarded ads.
• Ad privacy choices: where available, review or change your consent choices through the privacy options presented in the app or your Android advertising settings.
• Reset local access: clearing app data or uninstalling removes the local installation identity and unused rewarded time. This action cannot be undone.
• Privacy requests: depending on where you live, you may have rights to access, correct, delete, restrict, or object to certain processing, or to withdraw consent. Because Such VPN has no account and uses a pseudonymous installation identity, we may ask for limited information needed to locate a record. We will not ask for VPN traffic history because we do not have it.

You may contact us using the details in Section 12. You may also have the right to complain to your local data protection authority.

For a data-deletion request, see our Data deletion request page.

9. Security and international processing

We use technical and organizational safeguards designed to protect the limited information we process. These include encrypted transport, signed device requests, server-side verification of ad rewards and purchases, restricted access, and separation of public identifiers from private keys. No service can guarantee absolute security.

Such VPN and its providers may process information in countries other than the one where you live. Where required, we use legally recognized protections for international transfers.

10. Children

Such VPN is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Local law may set a higher minimum age for consent to data processing. If you believe a child has provided information to us, contact us so we can review and delete it where appropriate.

11. Changes to this policy

We may update this policy when the product, our providers, or the law changes. We will publish the updated policy at this URL and revise the effective date. If a change materially affects how the app handles information, we will provide an additional notice where required.

12. Contact