Privacy Policy

1. Who we are

VPNHero is operated by Def24 Inc. Contact: info@vpnhero.com. [Postal address — owner to supply.]

2. What we process and why

• Device identifier (Android ID, Apple DeviceCheck token, Mac hardware UUID or Windows machine GUID), sent inside our encrypted connection: to prevent abuse of the free service and, as a one-way code, to count active devices (see “Counting active devices”). Not used for advertising or tracking.
• IP address: used for each request to estimate your approximate location (city level) for “Nearest first”; that estimate is not stored. Our servers also write the IP address to technical logs, kept about 3 months (92 days) to handle abuse, then deleted automatically.
• App version and platform: an hourly check whether an update is available or required.
• Crash and error reports: when the app crashes or hits an unexpected error, a report goes to our own error tracking, so we can fix it. It contains the error and where in the app it happened, the app and system version, the device model and its state at that moment (such as free memory, battery level and network type), a random code the error tracking creates for the installation, and the app's last log lines, which show what it was doing just before (for example, connecting to a country). From version 0.1.6, IP addresses are removed from these log lines; earlier versions could include your IP address and the VPN server's. If a VPN file opened the app, version 0.1.7 and later only note that a file or link started it; earlier versions could include that file's address on your device.
• Usage and performance statistics: after you accept these terms, the app sends anonymous counts and timings in batches, such as how many connections to a country succeeded, how long connecting took, why a server failed, how quickly a server answered and, from version 0.1.7, the quality figures of each server tried (its uptime and response time as our server list records them, counted in ranges together with how that attempt went, UDP or TCP and the VPN location, never stored with the server’s name or address) and how each server attempt went on the way: how long it took, whether the server answered our first contact or there was no answer or a refusal, how long that took, the kind of port (such as 443), how long the connection check through the new tunnel took, how often a connection had to reconnect and its fastest second (all in ranges), session length and traffic in ranges, whether our servers were reachable, the app's memory use (every 10 minutes, in ranges), which Diagnostics checks passed or warned, how often a VPN file or link was opened with the app (only that it happened), and what you chose when the app warned you about another program handling name lookups. Each value is added to totals together with everyone else's as it arrives; no statistic contains your device identifier, IP address, location, the servers you used or anything you do online. The device identifier is only used to limit how often a device may send, and your IP address only to add a country code and the kind of network (mobile, home line or business line, as our location database knows it) to the counts of reachability and of how connections went, so we can see where connections are blocked or slow. For your own VPN files, only anonymous counts are sent: how files were added (from a file, the clipboard, opened with the app or through a link) and whether they were saved or why one was refused (for example too large or already added), whether a link’s file could be downloaded, how many own files a device keeps (in ranges, once a day), and how connections with them went (whether they connected, why an attempt failed, UDP or TCP, how long connecting took, how sessions ended and how long they lasted). Never the file itself, its name, its servers’ addresses or the link. Versions before 0.1.7 counted a connection with your own file only when it dropped on its own, in the general count of dropped connections (just the connection stage). Used to keep the service working and improve it.
• Counting active devices: to know how many devices use VPNHero and in which countries, our server turns the device identifier (on iPhone and iPad, where there is no lasting one, the IP address) into a one-way code and keeps only that code, the country, the platform and when it was last seen. The code is not linked to anything else and cannot be used to find your device identifier or IP address. A device unseen for 30 days is dropped. We only ever look at the totals, such as “devices in Germany this week”. While you are connected, your device counts for the country it was last seen in without VPN, never for the VPN location. Our server also adds up, per country and kind of network, how many server lists and servers it hands out, as totals only, so we can see where servers fail more often.
• Support requests you send from the app: subject, message and the optional reply e-mail, plus IP address, approximate location, app platform, system and version, the device identifier and a few app facts (app mode, VPN state). Used to answer you and to prevent abuse. Kept 12 months, then deleted.

3. What stays on your device

• Your acceptance of these terms (version and date).
• Favorites, sorting and other settings.
• Your statistics: the last 1000 connections. You can reset them in the app.
• Recent connection details used to improve reliability. From version 0.1.7 the anonymous statistics above include the quality figures of each server tried, counted in ranges and never stored with the server’s name or address. A detailed upload of these records may be added later; this policy will say so first. Runs with your own VPN files are never uploaded in detail; only the anonymous counts above leave the device.
• Your own VPN files (“My VPNs”), up to 20. The user name may be remembered; passwords are never stored.
• Diagnostics results: the app checks the device to explain problems (internet and name lookups, other VPN apps that are running, a system setting that sends name lookups to another program, kill switch settings). The details are shown to you only; just the pass or warn counts above leave the device.
• Your reply e-mail for Support, if you let the app remember it, and the list of requests you sent.

4. Third parties

• VPN servers in the VPNHero network may be operated by VPNHero or by third parties. Like any VPN server, the server you connect to can see connection details and any traffic that is not itself encrypted, and a server operated by a third party may keep its own logs. VPNHero does not make you anonymous; use HTTPS for anything sensitive.
• DNS while connected: Cloudflare (1.1.1.1) and Google (8.8.8.8). If another program on your device handles all name lookups (for example Tailscale with “Use Tailscale DNS”, or a company policy), lookups go to that program instead; the app tells you before it connects.
• IP checks that show and verify your IP: Cloudflare, ipify and icanhazip.
• VPN file links: when you open a VPNHero import link and agree, the app downloads that VPN file directly from the website the link names, or one that website forwards to, the same way as your other traffic (through your VPN connection when it carries all traffic). That website sees the download like any other; it does not go through our servers.
• Website hosting: Firebase Hosting (Google), with standard server logs. The website uses no cookies and no analytics.
• App stores: Apple and Google, for downloads and updates.
• Direct downloads (the Android APK and Windows installer linked on vpnhero.com): served from DigitalOcean Spaces (DigitalOcean’s file storage and CDN), with standard server logs.

5. Legal bases

Where the GDPR applies, we rely on our legitimate interests (preventing abuse, security, service quality) and on providing the service you asked for (answering support requests).

6. How long we keep data

• Server logs (with IP addresses): about 3 months (92 days).
• Support requests: 12 months.
• Usage and performance statistics (totals only): about 1 month.
• Active-device codes: 30 days after a device was last seen.
• Crash and error reports: the newest 10,000; older ones are deleted.
• Session data that hands out servers: about 30 minutes.
• Data on your device: until you delete it or uninstall the app.

7. Your rights

You can ask for access to or deletion of data we hold, object to its processing, and complain to a supervisory authority. Write to info@vpnhero.com. Uninstalling the app removes everything stored on your device.

8. Children

VPNHero is for adults (18+). We do not knowingly process data of children.

9. Security

The app talks to our servers through an encrypted envelope on top of HTTPS, and we keep as little data as the service needs.

10. Changes

When this policy changes, the app asks you to accept the new version before you continue.