Who we are

VPNSecure is operated by InfiniteQuant Ltd (company no. 200305B; “we”, “us”), which is the controller of the personal data described here.

Data protection contact: John Milton, data@vpnsecure.me. Representative in the EU and the UK (GDPR article 27): Richard Stanberry, data-eu@vpnsecure.me.

Effective date: 6 June 2025. This version: 10 November 2026.

What this policy covers

This policy applies to the VPNSecure website (vpnsecure.me) and members area, our apps for iPhone, iPad, Mac, Apple TV, Android, Windows and Linux, our browser extensions, our Telegram bot @vpnsecureme_bot and its Mini App, and our support channels (together, the “Service”). Our Terms of Service explain the rules for using the Service.

What we never log

We enforce a strict no-log policy on the VPN itself:

• IP address while connected: not logged
• Connection and disconnection times: not logged (free-tier session times are the one exception, see Free tier and rewards)
• Bandwidth used: not logged
• DNS requests: not logged; they travel inside the tunnel
• Browsing history and online activity: never monitored or recorded

The VPN servers keep only simple usage counts so that we can plan capacity; these say nothing about who connected or what they did. None of the analytics or advertising tools described below ever receive your browsing, your traffic, the servers you use, your VPN configuration or keys.

What we keep, and why

We keep only the data the Service cannot run without:

We use this data to run your account, provide support, process payments, send service messages, and detect and prevent fraud, abuse and unauthorised access. We never sell or rent your personal data. We only send marketing e-mails if you opted in, and every one has an unsubscribe link.

Free tier and rewards

The free tier of our iPhone, iPad and Android apps works without an e-mail address. To run it we keep:

• an anonymous account created for your device, a hash of a random ID the app stores on the device (the raw ID is never stored), the platform, and the IP address and network (/24 or /64) of the device when it last contacted us;
• your minutes balance, and for each free session its start and end time and the minutes charged, because the minutes have to be counted. Nothing about what you did during the session is recorded;
• a ledger of rewards (start credit, ads watched, e-mail and Telegram bonuses, invites) and of 12-hour passes, with the App Store or Google Play transaction ID of each pass;
• your invite code and which free accounts redeemed it, so that both sides get their minutes once;
• if you opt in to offers by e-mail: the address, a hash of it, and the time and IP address of your consent and confirmation.

Payments

We keep the confirmation of each payment from the provider: date, plan, amount, currency, method and the provider’s transaction or order ID. We never receive your full card number.

• Website: PayPal, card payments through our card payment providers, and cryptocurrency through our crypto payment providers. When you pay, the paying IP address, a hashed form of your e-mail address and any billing details passed on by the provider are checked with MaxMind’s fraud-screening service; the result is kept with your account.
• App Store and Google Play: Apple and Google handle the payment. We receive and keep the purchase receipt or token to activate and renew your plan.
• Telegram: see Telegram bot and Mini App.

Telegram bot and Mini App

When you use @vpnsecureme_bot or its Mini App, Telegram shares with us your Telegram user ID, display name and language. We keep your Telegram ID, the account it is linked to, your invite and reward records, and your orders: plan, payment method, price, amount, status and the payment reference (the Telegram Stars charge ID or the blockchain transaction). Blockchain payments are public by nature: the TON or Tron transaction, including the sending wallet address, is visible on the blockchain to anyone.

Telegram itself processes your messages and payments under Telegram’s privacy policy. Measurement in the Mini App is described under Cookies and cookie settings.

Cookies and cookie settings

The website, the members area and the blog use cookies and similar technologies. We group them into three categories:

• Essential (always on): keep you signed in to the members area, protect forms and remember your cookie choices. They cannot be switched off.
• Analytics (optional): Google Analytics and Ahrefs Web Analytics count visits and show us which pages are useful, including checkout steps and completed purchases.
• Marketing (optional): the Meta Pixel measures our advertising (page views, checkout steps, purchases, contact clicks and app-store clicks). While you buy a plan, a cookie of ours remembers the plan for a day so the purchase can be counted once.

Your consent

If you visit from the European Union, the European Economic Area, the United Kingdom or Switzerland, or we cannot tell where you are, analytics and marketing stay off until you choose Accept all or switch them on with Customize in the banner we show on your first visit. Everywhere else they are on by default and we do not show a banner; you can switch either category off at any time. Your country is taken from the request header that our CDN, Cloudflare, adds; we do not store it. We keep your choice in a cookie of ours for 12 months.

How to change your choices

Use the Cookie settings button below or the Cookie settings link at the bottom of every page to change your choices at any time. If you switch a category off, its tools no longer load, Google Analytics and the Meta Pixel are told through Google Consent Mode and Meta’s consent setting, and we delete their cookies on our website where we can.

🍪 Cookie settings

You can also block or delete cookies in your browser settings.

Telegram Mini App

In the Telegram Mini App, nothing from Meta loads until you tap Accept in its consent row, wherever you are. The Mini App identifies you to Meta only by a one-way hash (SHA-256) of your Telegram ID. When a Mini App purchase is confirmed, our bot may also report it to Meta’s Conversions API with the same hash, the plan and its price, so that Meta counts the purchase once; it never sends your name, e-mail, phone, wallet or the IP address of your VPN connection.

Analytics and ads in the apps

Our iPhone, iPad and Android apps have one switch under Settings › Privacy › Usage & ad measurement. It is on by default; turning it off stops PostHog and Meta in the app. The Apple TV app and our Windows and Linux apps contain none of the SDKs below.

• PostHog (product analytics, crash reports and session replay). Which screens are used, connection outcomes and timings, and app errors. Session replay records screen images in which all text, input fields and images are masked on your device before upload, and the account name, e-mail, password, invite, IP address, server and VPN configuration areas are always hidden. No console logs or network data are recorded. Events never contain your IP address, e-mail, password, server addresses, keys or configuration; PostHog discards IP addresses and GeoIP lookup is off. A signed-in user is identified only by a one-way hash of the VPN username.
• Firebase Analytics (Google, Android app from Google Play only). Anonymous app events such as connection outcomes, without usernames, e-mail addresses, IP addresses or purchase tokens.
• Meta SDK (ad install attribution). Only a few events: account created or signed in, onboarding finished, first free session, first connection, and purchase tapped. No automatic events, screen data or purchases are sent by the app. The SDK is not even started unless the switch is on and Google’s consent tool allows it: in regions where consent is required (such as the EU, EEA and UK) you must have agreed to Meta and to storing information on your device, ad measurement and market research. On iPhone and iPad, the advertising identifier (IDFA) is only collected if you choose Allow in Apple’s App Tracking Transparency prompt, which we show at most once, after your first successful connection.
• Google AdMob (rewarded ads on the free tier only). Ads load only while the VPN is off and never through the tunnel. Before any ad is requested, Google’s User Messaging Platform asks for your consent where the law requires it (EU, EEA, UK and some US states); you can review your choice under Settings › Privacy options. On iPhone and iPad ads are always non-personalised. On Android, personalisation follows your consent choice. AdMob receives device and ad-interaction data under Google’s policies. To credit your reward, AdMob tells our server that an ad was watched using a random reward ID, never your username or e-mail.
• RevenueCat (purchase records). Records App Store and Google Play purchases for our sales reporting; it never grants or removes access. Your RevenueCat customer ID is your VPN username. Purchase events may be forwarded from RevenueCat to Meta for ad measurement.

Service providers we use

We share data only with providers that help us run the Service, only what they need, and under contracts or terms that limit their use of it. We may also disclose data when the law requires it, but we have no activity logs to disclose.

Why we are allowed to use your data

Where the GDPR or UK GDPR applies, we rely on:

• Contract: running your account, your plan and payments, support and account deletion;
• Legitimate interests: security, fraud and abuse prevention, rate limits, and improving the apps with masked, pseudonymous analytics (you can switch these off in the app);
• Consent: analytics (Google Analytics, Ahrefs) and marketing (the Meta Pixel) on the website and the Meta SDK in the apps where consent is required, personalised ads, App Tracking Transparency, and marketing e-mails. You can withdraw consent at any time;
• Legal obligation: keeping accounting records.

How long we keep data

Your privacy rights

Wherever you live, you may ask us to:

• access your personal data, or receive a copy in a portable format;
• correct it;
• delete your account and associated data: in the apps under Account › Delete account, or by writing to us;
• stop marketing e-mails (use the unsubscribe link) or withdraw any consent (Cookie settings on the website, the privacy settings in the apps);
• restrict or object to processing based on legitimate interests.

EU, EEA and UK residents also have the right to lodge a complaint with their data protection authority.

California and other US states. We do not sell personal information. Using the Meta Pixel and SDK for ad measurement may count as “sharing” for cross-context behavioural advertising under California law; you can opt out with Cookie settings on the website and the Usage & ad measurement switch in the apps. We do not use sensitive personal information to infer characteristics, and we will not discriminate against you for exercising your rights.

Write to our data protection contact at data@vpnsecure.me (or to support@vpnsecure.me) from the e-mail address of your account. We answer within one month, and may need to verify that the request comes from you.

Children

The Service is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child has given us personal data, contact us and we will delete it.

International transfers

We are based in The Bahamas. Our account database and website are hosted by Amazon Web Services in the United States, and several of the providers listed above process data in the United States or other countries. Where data from the EU, EEA or UK is transferred to a country without an adequacy decision, we rely on the provider’s standard contractual clauses or an equivalent safeguard.

Security

We use industry-standard security practices to protect your data. Traffic between your device and our servers is encrypted. Your sign-in is checked against a one-way hash of your password; the encrypted copy of the password is used only to issue your VPN credentials and configuration files. Device tokens are stored only as hashes, and sign-in codes, device tokens, configuration files and keys are never written to our logs. No system is perfectly secure; if a breach affects your personal data we will tell you and the authorities as the law requires.

Changes to this policy

We may update this policy from time to time; the date at the top shows the current version. If we make significant changes, we will tell you by e-mail or in the apps.

Contact us

Questions or requests about your privacy:

Data protection contact: John Milton, data@vpnsecure.me.
Representative in the EU and the UK (GDPR article 27): Richard Stanberry, data-eu@vpnsecure.me.