Privacy Policy

Summary

• We collect only what we need to run your account and the VPN: your email, sign-in details, the devices you use and your country code.
• We do not monitor, record or sell the websites you visit or the content of your traffic.
• There are no advertising or analytics SDKs in the app, and we do not sell your data.
• Your password is handled by Google Firebase Authentication. We never store it.
• You can ask us to delete your account at any time by writing to [CONTACT EMAIL].

Who we are

The Vesper VPN apps for iOS and Android, and the related apps for Windows and macOS (together, the “Service”), are operated by [COMPANY OR OPERATOR NAME] (“we”, “us”). We are responsible for the personal data described in this policy. You can reach us at [CONTACT EMAIL].

Data we collect

Account data

• Email address.
• Password, if you sign up with email. Your password is stored by Google Firebase Authentication. Our server only passes it to Firebase when you sign in or create an account. We never see it after that and we never store it.
• Google or Apple sign-in. If you sign in with Google or Apple, we receive your account identifier and email address from that provider. If you use Apple’s “Hide My Email”, we receive a private relay address instead of your real email.
• Firebase user ID, a unique ID that Firebase gives your account.
• Display name, optional. Only we set this, for support purposes.
• Telegram ID. Some older accounts have one, set by us.

Device and session data

• A random ID created when the app is installed. It is not linked to your phone’s hardware or advertising identifiers.
• A device name (for example “Ana’s iPhone”) and the platform (iOS, Android, Windows or macOS).
• When each session was created and when it was last seen.

We use this data to enforce the device limit on your account and to show you the Devices list, where you can sign other devices out.

Country

The app works out which country you are in. On iOS it uses reduced-accuracy location if you allow it, and your phone’s region setting if you don’t. The app sends us only the two-letter country code (for example “DE”), so we can offer servers that work well in your country. We never receive your precise location.

Network data

Our server sees the IP address of each request to our API. We use it in memory for rate limiting and to prevent abuse. Standard web server logs may contain IP addresses. We keep these logs for a short period ([LOG RETENTION PERIOD]) for security and troubleshooting, and then delete them.

Traffic volume

Your account may have a data limit. To enforce it, we may keep a counter of how much data your account has used in total. This is an amount of data only. It does not include what the data was or where it went.

Your VPN traffic

When you connect to a Vesper server, your internet traffic passes through that server. We do not monitor, record or sell the websites you visit or the content of your traffic.

Your own servers. Free users can add their own server configurations or subscriptions. These are stored only on your device. When you use them, the app connects directly to those third-party servers, and your traffic does not pass through Vesper’s servers. We don’t control those servers, and their operators’ own privacy practices apply.

How we use data

We use the data above only to:

• create and secure your account and sign you in;
• provide the VPN, including choosing suitable servers for your country;
• enforce device and data limits and manage Premium access;
• prevent abuse, fraud and attacks on the Service;
• answer your support requests;
• meet our legal obligations.

We do not use your data for advertising or profiling. The app contains no advertising or analytics SDKs. We do not sell your personal data.

Where the law requires a legal basis (for example the GDPR), we rely on performance of our contract with you to provide the Service. We rely on our legitimate interests for security, abuse prevention and troubleshooting. Where we are legally required to process data, we rely on legal obligation. For location access on iOS we rely on your consent, which you can withdraw in your phone’s settings.

Third-party services

• Google Firebase Authentication stores sign-in credentials and handles sign-in for us, acting as our processor.
• Google and Apple handle sign-in when you choose “Sign in with Google” or “Sign in with Apple”.
• Google Firebase Hosting and Google Cloud. If our own domains can’t be reached from your network, the app may download an encrypted list of addresses from Firebase Hosting. It may also send its encrypted requests through a Google Cloud function. Google can see your IP address in this case, but not the content of the requests.
• Cloudflare, only if you run the built-in speed test. The test contacts speed.cloudflare.com.
• AdGuard DNS, only if you turn on ad and tracker blocking. DNS requests then go to dns.adguard-dns.com.
• DNS resolvers. Inside the tunnel, DNS lookups go over HTTPS to Cloudflare (1.1.1.1) or Google (8.8.8.8).
• Apple App Store and Google Play will handle payments once in-app subscriptions are offered. We do not receive your card details.

Each of these providers handles data under its own privacy policy.

Security

We protect your data with:

• HTTPS (TLS) for all connections;
• certificate pinning in the apps;
• an extra layer of end-to-end encryption (AES-GCM) on every API request, on top of HTTPS;
• password handling by Firebase Authentication, so we never store passwords.

No system is perfectly secure, but we work to keep the data we hold small and protected.

International transfers

Our VPN servers are in several countries, and we use Google’s infrastructure, which may process data outside your country. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses used by our providers.

How long we keep data

• Account, device and session data: kept until you delete your account. You can sign devices out at any time from the Devices list.
• IP addresses used for rate limiting: kept in memory only, for a short time.
• Web server logs: kept for [LOG RETENTION PERIOD].
• Server configurations you add yourself: stored only on your device. They are removed when you delete them or uninstall the app.

Your choices and rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data. You may also have the right to object to or restrict how we process it, and to withdraw consent. To use any of these rights, contact us at [CONTACT EMAIL].

Deleting your account: email us at [CONTACT EMAIL] from the address on your account. We will delete your account and the related device and session data.

You can also turn off location access for Vesper in your phone’s settings at any time. If you live in the EEA or the UK, you can complain to your local data protection authority.

Children

The Service is not directed to children under 13, or under 16 in the European Economic Area. We do not knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.

Changes to this policy

We may update this policy. When we do, we will change the “Last updated” date above. If the changes are significant, we will also tell you in the app or by email.

Contact

[COMPANY OR OPERATOR NAME]
Email: [CONTACT EMAIL]