Privacy Policy
Last updated: 30 October 2026
This policy explains what data the ZeroVPN apps for iOS and Android ("ZeroVPN", "we") process, and why. ZeroVPN is run by Christian Calderon (publisher name "Calships"), San Juan, Puerto Rico, USA, who is the data controller. Contact: privacy@zerovpn.app.
Summary
- No account. We never ask for your name, email address or phone number.
- We do not log or store the websites you visit, your DNS queries, your traffic contents or the addresses you connect to.
- We keep only what the service needs to run: a random device key, your session expiry, your service tier, and short-lived records for ad rewards and subscription checks. All of it is listed below.
- Free sessions show non-personalized ads from Google AdMob. Google processes some device data to show them; see "Ads".
- We do not sell your data.
How the VPN works
When you connect, the app makes a WireGuard key pair on your device. The private key never leaves your device. The app sends the public key, your platform (iOS or Android), the server region you picked, and, if you subscribe, your store receipt to our API at api.zerovpn.app. The API assigns you an exit server and private tunnel addresses for a limited session. Your traffic then flows, encrypted, from your device to that exit server and on to the internet.
Data on our API (Cloudflare)
Our API runs on Cloudflare Workers. It stores:
- Session record, keyed by your WireGuard public key: the session expiry time and which exit server holds it. It is used to add time to your session when you watch a rewarded ad.
- Subscription check result, keyed by a one-way SHA-256 hash of your store receipt (not the receipt itself): your tier (free or VIP) and the subscription expiry. It is kept until the subscription expires so we don't have to ask Apple or Google on every connection.
- Rewarded-ad transaction IDs: when you finish a rewarded ad, Google tells our API, with a transaction ID and your public key. We keep the transaction ID for 7 days so a reward can't be claimed twice.
- Server records: load and status of our exit servers. These contain no user data.
Our API code does not log client IP addresses. Cloudflare, as our host, handles the network connection and may process your IP address and request metadata for security and operations under its own privacy policy.
Data on exit servers
Exit servers run in Hetzner data centers in the EU. For each active session an exit server keeps your public key, tier, tunnel address and session expiry, and saves these to disk so a session survives a server restart. The lease is removed when the session expires.
While you are connected, the WireGuard software holds your current IP address and port in memory so it can send traffic back to you, along with byte counters for the connection. These are not written to disk or logs. Servers count total outbound traffic per month for the whole server (for hosting bills), not per user.
Exit servers run their own DNS resolver with query logging turned off. We do not inspect, log or store the sites you visit, your DNS queries, your traffic contents or your destination addresses.
Ads
Free sessions are supported by Google AdMob ads. Ads load over your normal connection before the VPN starts, not through the tunnel.
We request non-personalized ads only. ZeroVPN does not ask for App Tracking Transparency permission on iOS and does not use your advertising ID for ad targeting. Google still receives data it needs to deliver and measure ads and to prevent fraud, such as your IP address, device type, operating system, app version and ad interactions, and may use identifiers for frequency capping and reporting. On Android, Google's ad software may read the device advertising ID; you can reset or delete it in Android settings. See how Google uses data from apps that use its services.
Consent. In the European Economic Area, the UK and Switzerland, the app asks for your consent through Google's consent form before any ad is requested. Elsewhere no form is shown. Where the form applies, you can change your choice at any time with "Privacy choices" in the app.
If you subscribe to VIP, no ads are shown.
Subscriptions
VIP is sold through the Apple App Store or Google Play. Apple or Google handles payment; we never see your card details or your name. To confirm your subscription, the app sends your store receipt (iOS) or purchase token (Android) to our API, which checks it with Apple or Google. We store only the result described above. Manage or cancel your subscription in your App Store or Google Play account settings.
Legal bases (EEA/UK)
We process the data above to provide the service you asked for (contract) and to prevent abuse and fraud (legitimate interests). For ads in the EEA, UK and Switzerland, we rely on your consent.
Sharing
We share data only with the providers that run the service: Cloudflare (API hosting), Hetzner (exit servers), Google (AdMob ads, Google Play subscriptions) and Apple (App Store subscriptions). We may disclose data if the law requires it, but we can only hand over what we have, as listed in this policy. We do not sell data.
International transfers
Our providers process data in the USA, the EU and elsewhere. Where required, transfers rely on the providers' standard contractual clauses or other lawful mechanisms.
Retention
- Exit-server lease: until your session expires.
- Session record on our API: an expiry time and server name, no longer used once the session expires.
- Subscription check result: until the subscription expires.
- Rewarded-ad transaction IDs: 7 days.
- Emails you send us: as long as needed to answer you.
Your rights
Depending on where you live, you may have the right to access, correct or delete your data, to object to its processing, and to complain to a data protection authority. Because ZeroVPN has no accounts, we usually can't link stored data to you. Write to privacy@zerovpn.app and we will help as far as we can. Deleting the app removes everything it stored on your device.
Children
ZeroVPN is not directed at children under 13, and we do not knowingly collect their data.
Changes
We will post changes on this page and update the date above.