This policy describes exactly what Suphuzi VPN handles, what is written down, how long it survives and who else touches it. Where a statement is a technical claim about our servers, it comes from an inspection of the live production systems rather than from marketing intent.
The data controller for the personal data described in this policy is İmzahub Teknoloji Ltd. Şti., registered at Beştepe Mahallesi, 32. Cadde No: 1/97, Yenimahalle, Ankara, Türkiye (tax number 2091799098).
You may see a different company name next to the app depending on where you downloaded it. On Google Play, Suphuzi VPN is published by İmzahub Teknoloji Ltd. Şti. On the Apple App Store it is published by Cheetah Tech Lab Yazılım Elektronik Mobil ve Danışmanlık Hizmetleri Ticaret Limited Şirketi, registered at Çiğdemtepe Mahallesi, 1081. Cadde No: 8/8, Yenimahalle, Ankara, Türkiye — an affiliated company under common ownership.
This changes nothing about your rights or about who answers for your data. Whichever store you used, İmzahub Teknoloji Ltd. Şti. determines the purposes and means of the processing described in this policy and is the controller you exercise your rights against. Cheetah Tech Lab acts only as the App Store publisher of record and does not decide how your data is processed.
For any privacy question, request or complaint, write to privacy@suphuzivpn.com. We answer data-rights requests within 30 days.
We think you should be able to hold the whole picture in your head, so here it is:
We deliberately do not describe Suphuzi as a “no-log VPN” or a “zero-log” service. Those phrases are absolutes, they are unverifiable from the outside, and they are not true of the advertising SDK in the free tier. The narrower statements above are the ones we can stand behind.
On every production exit server, all of the following were verified to be absent or disabled:
-j LOG / NFLOG) exist in the firewall, and per-connection byte accounting is disabled.The system journal on those machines holds no peer address and no handshake record: the WireGuard, reconciler and obfuscation units write neither — measured 18 August 2026, zero lines containing an IP address from any of them. The journal does also contain ordinary SSH daemon noise from unsolicited login attempts against the server itself; those are attackers’ addresses, never a user’s. On every exit server the journal is held in memory only and is lost on reboot.
For each live peer the kernel holds, and only in RAM:
10.66.x.y, an RFC 1918 address that identifies nobody outside the tunnel).A maintenance service on every exit server scrubs the first four of those fields once a peer has not completed a handshake for 180 seconds. In practice your real IP address stops existing on the server roughly three minutes after your device goes quiet — and immediately when you disconnect, because the app releases its lease and the peer is removed outright. Everything in this list is lost on reboot and none of it is ever written to storage.
We do not read the per-peer byte counters. Server-side traffic measurement would create exactly the kind of tunnel-linked metadata this design exists to avoid, so the control plane never queries it. Your free allowance is metered by your own device (section 6).
Access logging on the control-plane API gateway is switched off, so no
request IP address is recorded there. The application code never reads the
caller's IP address except at the one endpoint described in
section 10. The only application log lines the control plane writes
are server-health errors and counters such as
{"event":"ssv_credited","ok":true}; they contain no IP address,
no account identifier and no key. That log group is retained for
7 days and then deleted automatically.
All seven of our exit servers pull their configuration from the control plane over an authenticated request, so nothing about you passes through a cloud management API.
To connect you, the control plane writes one short-lived record to a
database table in Frankfurt (AWS eu-central-1). It contains:
| Field | What it is | Can it identify you? |
|---|---|---|
token | A random value used to renew or release the lease | No — unrelated to any account |
server_id | Which exit server, e.g. hetzner-hel-1 | No |
public_key | The public half of a WireGuard key pair | A pseudonym. It can be regenerated at any time. |
client_ip | Your address inside the tunnel, e.g. 10.66.21.105 | No — this is a private address, not your real IP |
created_at, lease_expires_at, expires_at | Timestamps for lease and automatic deletion | No |
Your WireGuard private key never leaves your device. The key pair is generated on the device itself — by the operating system's own cryptography on iOS and by the WireGuard library on Android — and only the public half is ever sent to us.
No account field is ever written to this table. Your account identifier, device identifier and email digest are physically absent from it; this separation is enforced in a single place in the code and covered by automated tests.
The record is deleted automatically at most 48 hours after it is issued (a 24-hour lease plus a 24-hour grace period), and typically much sooner, because disconnecting deletes it immediately.
Nothing outlives that 48 hours. Continuous backups (point-in-time recovery) are switched off on the lease table, so no restorable copy of a lease survives once it expires. The 48-hour figure is the whole story for tunnel data, not just the story for the live table.
Suphuzi VPN accounts are anonymous by default. When you first open the app it registers a device with our server and receives two random 128-bit identifiers — an account ID and a device ID. There is no sign-up form, no password and no email address. We need a stable identifier because the one-time allowance and rewarded-ad limit cannot be enforced against nothing.
Account data lives in a separate database table from the tunnel lease above, in Frankfurt (AWS eu-central-1). Every field is listed here:
| Data | Why it exists | Retention |
|---|---|---|
| Account ID (random 128-bit) | Anchors your allowance and service state | Until you delete the account |
Device ID (random 128-bit), platform (android/ios) and a coarse device label | Authenticates this installation without using an advertising or hardware identifier as the account key | Until you delete the account |
| Android installation-continuity digest | On Android, the app reads ANDROID_ID, transforms it on-device with a Suphuzi-specific salted SHA-256 construction, and sends only that opaque result as an installation hint. The server HMACs it again with a secret before storing the account mapping. This lets the same device recover the same allowance after reinstall. Raw ANDROID_ID is never sent or stored by us. | Until you delete the account; deletion removes the mapping |
| Subscription tier and expiry; last RevenueCat event ID and event time | On Android, records which server-verified entitlement is active and prevents an old or repeated webhook from overwriting a newer subscription state | With the account, including up to 35 days in rolling backups after account deletion |
Creation date and last-seen date, to the day (YYYY-MM-DD, UTC) | Account operation and abuse prevention | With the account |
| Lifetime allowance balance: bytes granted and bytes your device reported using | One-time starter allowance and rewarded-data accounting | Until you delete the account |
| Daily rewarded-ad counter and leases issued | Ten-ad daily cap and abuse prevention | 3 days, deleted automatically |
| Active session: which server, start time, and (optionally) the lease token | So the app can end the current tunnel | Until you disconnect, or the lease expires |
| Rewarded-ad transaction ID from Google | Stops the same ad being credited twice | 7 days, deleted automatically |
| Idempotency keys for repeated requests | Stops a retried request being counted twice | 24 hours, deleted automatically |
The account table has continuous backups (point-in-time recovery) enabled with a 35-day window. We keep them because losing this table would destroy account and allowance state, and there is no reliable way to reconstruct it.
The honest consequence: when you delete your account it disappears from the live database immediately, but a copy of it remains inside those rolling backups for up to 35 days before it ages out. Nobody reads a backup to look you up — it exists only to restore the whole table after a failure — but it is not accurate to say your data is gone from everywhere the moment you press the button, so we say this instead.
The tunnel lease table (section 4) has no such window. Backups are switched off there, deliberately, so that tunnel data really does end at 48 hours.
The current release does not provide email login, email account recovery, Sign in with Apple or cross-device account joining. It therefore does not store an email address or email digest as an app-account field.
If you contact support or privacy by email, the sender address and message necessarily reach our support mailbox; that separate communication is described in sections 12 and 14. We do not use it to create or link an app account, and we do not send marketing email.
Account and tunnel data are never joined into a profile. The only link that exists at all is a short-lived one: while a session is running, the session record may hold the lease token so the app can end that tunnel. It contains no WireGuard key, no tunnel address and no endpoint, and it disappears when the session ends.
On supported devices, the app also keeps the random account and device credentials in operating-system storage that can survive uninstall. This prevents uninstall-and-reinstall from creating a fresh account and another starter allowance. On Android this uses Google Play services Block Store when available; on iOS Keychain items normally survive uninstall. Deleting the account in the app clears both the server record and this local persistent copy. Platform storage may be reset or unavailable, so no hardware identifier is treated as an infallible identity.
Free accounts receive 500 MB once as a starter allowance when the account is created during initial setup. It is not a daily allowance: it does not reset and it does not expire. You can add 100 MB per rewarded ad to that same balance, up to 10 ads per UTC day — the ten-a-day limit is daily, the balance is not. The grant is recorded on our server; the consumption is measured by your own device from the tunnel's byte counters and reported back as a number. We do not measure your traffic on the server side, which is why the ledger holds a total in bytes and nothing about what those bytes were.
Rewards are credited by a signed callback that Google sends directly to our server after an ad completes. The callback carries an ad transaction ID and your account ID; we verify Google's cryptographic signature before crediting anything, and we log neither the account ID nor the transaction ID.
The free tier is funded by rewarded video ads served by Google AdMob. This is the one place where a third party collects data about you through our app, so we describe it plainly.
When you choose to watch an ad, Google's Mobile Ads SDK may collect and use:
Google acts as an independent controller for this data under its own privacy policy.
Ad content is capped at Google's “General audiences” rating. We do not run banner or interstitial ads, and no ad is ever placed in the connection flow.
On Android only, Suphuzi Pro can be bought through Google Play Billing. Google Play handles checkout, payment details, order status and the store account. RevenueCat processes the anonymous account ID and Google Play purchase history — product, billing period, transaction and entitlement state — to verify, renew and restore Pro. RevenueCat is configured not to collect advertising identifiers automatically and with its own diagnostics disabled. Neither Google Play nor RevenueCat receives VPN traffic, DNS queries, tunnel keys or tunnel metadata from us.
RevenueCat is initially configured with the random installation ID and, after server registration, logs in to the random 32-character account ID. This creates the provider-side alias needed to keep a purchase attached to the same anonymous account. No name or email address is supplied. The network request necessarily reaches RevenueCat from your IP address, but Suphuzi does not receive your card or bank details.
iOS 1.0.5 contains no purchase SDK and offers no subscription or in-app purchase. Apple and Google may still keep app-download and store-account records under their own policies. Android users can restore an active purchase in the app; cancellation and refunds are handled through Google Play.
No DNS resolver on an exit server is reachable from the tunnel, and no Suphuzi exit resolver logs a query. The current release points your device at these public resolvers:
| When | Resolvers used | Operated by |
|---|---|---|
| Default connection | 1.1.1.1, 9.9.9.9 | Cloudflare and Quad9 |
| Android Pro: custom DNS | The addresses the user enters | The resolver operator chosen by the user |
| Android Pro: ads and tracker filtering | 94.140.14.14, 94.140.15.15 | AdGuard DNS |
| Android Pro: malware and phishing filtering | 9.9.9.9, 149.112.112.112 | Quad9 |
| Android Pro: ads, trackers and adult-content filtering | 94.140.14.15, 94.140.15.16 | AdGuard DNS |
Your queries travel inside the encrypted tunnel and are answered by the
operators named above, under their privacy policies. Cloudflare
states that it discards 1.1.1.1 query logs within 24 hours.
We plan to run our own resolver so this dependency disappears; until that
ships, this is the arrangement.
Custom DNS and a filtering profile cannot be active together because the tunnel has one DNS setting. If an Android Pro user enters a custom resolver, that chosen operator receives the DNS queries and applies its own privacy policy. DNS-based filtering blocks domains; it does not inspect page contents or guarantee that every unwanted item is blocked.
The app's connection-health screen calls four endpoints: a latency probe, a fixed-size download, a discarded upload, and an exit-IP check. An exit-IP check must by definition see your address in order to report it back, so the commitment we make is narrow and exact:
Your IP address is returned to you and goes nowhere else. It is not logged, not written to any database, not attached to a metric, not put in an error message, and not held in any server-side cache or rate-limit key. Automated tests assert this, and after deployment a search of the log system for a real caller's IP returned zero results.
The download and upload endpoints carry only a fixed synthetic payload; uploaded bytes are counted and discarded. Rate limiting on these endpoints is deliberately not keyed by IP address, because that would mean storing IP addresses.
Version 1.0.5 introduces crash-only reporting through Functional Software, Inc. (Sentry). If the app crashes or becomes unresponsive, it may send the error type, a sanitised stack trace, app version/build, operating-system name/version/build, device manufacturer/model/CPU architecture, and Dart/Flutter runtime name/version/compiler needed to reproduce the fault. Sentry error events on our Developer plan are retained for 30 days.
The reporting boundary removes request and user objects, server names, free-form exception and message text, transaction, culprit, logger and custom grouping fields, source-code context, local variables and every tag not created by the crash budget before transmission. Device identifiers, country, locale/timezone, battery, memory/storage, boot time, permissions, accessibility settings and connection type are also removed. Automatic HTTP, network, screen, user-interaction, console, log, metric, tracing, profiling, screenshot, view-hierarchy and session-replay collection are disabled. The only permitted breadcrumb is an internal count saying that repeated copies of the same error were suppressed; even it carries no structured data. At most five already-sanitised events may wait in the app's local offline queue.
Reports first go to a dedicated no-storage relay at
diagnostics.suphuzivpn.com. Cloudflare necessarily handles the
source IP while accepting that HTTPS connection, but Worker invocation
logging is disabled and the relay neither stores the envelope nor forwards
client-IP, cookie or request headers. Sentry therefore receives the
Cloudflare relay's network address, not yours. This was verified from
Türkiye: Sentry displayed its US relay location while the event contained
no user, IP, device identifier or real country. Our Sentry organisation is
additionally set to prevent storage of IP addresses. Sentry is hosted in
the United States for this project, so the transfer safeguards in
section 13 apply. Builds before 1.0.5 contain no active Sentry DSN and
send no event to either service.
ANDROID_ID is not sent or stored. On Android only, the two-stage digest described in section 5 is used to recognise a reinstall without disclosing the underlying value.We do not sell, use, or disclose to third parties, for any purpose, any data that passes through or is derived from the VPN tunnel. That covers your real IP address, your connection metadata, your DNS queries and the content of your traffic. This is an unconditional commitment with no exception, and it applies to the current free service.
Advertising sits outside the tunnel and is separate from it. On the free plan the app can show a Google AdMob rewarded ad inside the app process — not through the VPN. The request is non-personalised, and the build does not request IDFA or Android advertising-ID permissions, but Google still receives the data listed in section 7. It happens only after you ask for it, subject to the consent flow described there, and it is never combined with anything from the tunnel. Beyond that arrangement we do not sell personal data and we do not share it for cross-context behavioural advertising.
| Provider | Role | What it can reach | Where |
|---|---|---|---|
| Amazon Web Services | Control plane only — API, database and secrets. No exit servers. | Runs the control-plane infrastructure. Your traffic never passes through it. | Frankfurt (eu-central-1) |
| Hetzner Online GmbH | Four exit servers | Runs the machine your traffic exits from, and therefore sees your connection's endpoint IP while the session is live. Network flow logging is disabled, so no record of your traffic exists. Hypervisor-level access is theoretically possible for any host. | Nuremberg (DE), Helsinki (FI), Singapore (SG), Ashburn (US) |
| OVH SAS | One exit server | As above | Gravelines (FR) |
| The Constant Company, LLC (Vultr) | Two exit servers | As above | Mumbai (IN), São Paulo (BR) |
| Google Ireland Ltd. / Google LLC | AdMob advertising; Google Play distribution and Billing; destination mailbox for support and privacy email | For ads: IP-derived approximate location, basic app/device information, ad interactions and SDK diagnostics. The build does not request IDFA or Android advertising-ID permissions. For an Android purchase: Google account, payment/order and subscription state under Google Play's policy. For messages you send us: sender address, message content and attachments. | Global |
| RevenueCat, Inc. | Android-only purchase verification, entitlement renewal and Restore purchases | Random installation/account ID, product and package identifiers, Google Play transaction/purchase/entitlement state, app/platform information and the IP address that reaches its service. Automatic advertising-identifier collection and RevenueCat diagnostics are disabled. No VPN traffic or tunnel metadata. | United States |
| AdGuard Software Ltd. | DNS resolution when an Android Pro user selects an AdGuard filtering profile | DNS queries sent inside the tunnel to the selected AdGuard resolver, under AdGuard's policy | Global |
| Functional Software, Inc. (Sentry) | Privacy-minimised crash and app-hang diagnosis in app version 1.0.5 and later | Error type; sanitised function/file/line stack; app version/build; OS name/version/build; device manufacturer/model/CPU architecture; Dart/Flutter name/version/compiler; crash-budget tags. The payload excludes the user's IP/country, account or device identifier, VPN endpoint, request URL, free-form exception text, locale/timezone, battery, memory/storage, boot time, permissions, screenshots, replays, logs and interaction trails. Sentry receives the Cloudflare relay address, not the user's; IP storage is also disabled at organisation level. | United States |
| Apple Inc. | App distribution on iOS | App Store account and download records under Apple's own policy | Global |
| Cloudflare, Inc. | DNS resolution; Email Routing for support@ and privacy@; website hosting; no-storage relay for privacy-minimised crash envelopes | DNS queries when you use 1.1.1.1; envelope and transit data for messages routed to our mailbox; standard request data when you visit this public website; and the source IP plus already-sanitised crash envelope while relaying it to Sentry. Crash-relay invocation logging is disabled, the relay creates no storage, and client-IP/cookie headers are not forwarded. Cloudflare has no access to app accounts or decrypted VPN traffic. | Global |
| Quad9 | DNS resolution (section 9) | Your DNS queries, as an independent controller | Global |
The public support@suphuzivpn.com and
privacy@suphuzivpn.com aliases are routed by Cloudflare Email
Routing to one access-controlled Google Gmail mailbox read by an authorised
member of our team. Do not include VPN traffic contents, private keys or
passwords in a support message. We use message content only to answer the
request and meet legal obligations.
Account data and tunnel leases are stored in the European Union (AWS Frankfurt). Exit servers are in the countries listed above and only forward packets; they hold no database. Where a sub-processor is outside the EEA — Google, RevenueCat, Cloudflare, AdGuard and Sentry services, and exit servers in the United States, Singapore, India and Brazil, and support email processed by Cloudflare and Google — transfers rely on the European Commission's Standard Contractual Clauses or, where applicable, an adequacy decision.
İmzahub Teknoloji Ltd. Şti. is established in Türkiye, which does not hold an EU adequacy decision. For a user in the EEA, the transfer of personal data to us is therefore itself a third-country transfer, and it relies on the Standard Contractual Clauses.
| Data | Kept for |
|---|---|
| Your real IP address, handshake time, byte counters, session keys (server RAM) | Until ~180 s after your device stops handshaking, or immediately on disconnect. Never stored. |
| Tunnel lease record (token, public key, in-tunnel address) | Up to 48 hours; deleted on disconnect. Backups are switched off on this table, so nothing restorable outlives it. |
| Account record and current-device record | Until you delete the account, then up to 35 more days inside the database backups (section 5) |
| Server-side subscription tier, expiry and RevenueCat event metadata | With the account; after deletion, up to 35 more days inside the rolling account-database backups |
| Lifetime free-allowance balance | Until you delete the account. It has no expiry, because the 500 MB itself has none. |
| Daily rewarded-ad counter | 3 days |
| Active session record | Until disconnect or lease expiry |
| Rewarded-ad transaction ID | 7 days |
| Idempotency keys | 24 hours |
| Backups of the account database (point-in-time recovery) | A rolling 35 days. Deleted account data ages out of these within that window. |
| Control-plane application logs (server health, counters, error traces; no user identifier and no IP address) | 7 days |
| Privacy-minimised crash and app-hang envelopes (app version 1.0.5 and later) | No Cloudflare Worker storage or invocation log; 30 days after receipt by Sentry on the current Developer plan; at most five sanitised events may wait locally while offline |
| Support and privacy email correspondence | Until the request is resolved and for any further period required to establish compliance or respond to a dispute. The mailbox does not currently apply a separate automatic Suphuzi deletion schedule; you may request deletion where the law permits. |
| App Store and Google Play distribution records | Under Apple and Google's own policies |
| Google Play and RevenueCat Android purchase, renewal, cancellation and refund records | Under their policies, contractual obligations and applicable accounting law. Account deletion does not compel a store to erase legally required transaction records; contact us to request processor-side erasure where permitted. |
If you are in the European Economic Area or the United Kingdom, the GDPR and UK GDPR give you the rights below. We extend the same rights to everyone, wherever they are. Users in Türkiye have equivalent rights under KVKK Articles 11 and 13.
| Right | How to use it |
|---|---|
| Access (Art. 15) | The app shows your account ID, current service state and remaining lifetime allowance. You can also ask us by email for the server-side record associated with that account ID. |
| Portability (Art. 20) | The record is held as JSON and we will send you the export on request. To be exact about what the app does and does not do: it displays the record, but it has no one-tap “download my data” button. Email us and we will send the file. |
| Erasure (Art. 17) | Delete the account from Settings → Account → Delete account, or use the request route described at Delete your account. |
| Rectification (Art. 16) | Email us with the account ID and the field you believe is inaccurate. Most fields are random identifiers, counters or dates generated by the service. |
| Objection and restriction (Art. 21, 18) | Email us. For advertising specifically, use Settings → Ad and tracking preferences where that entry is available, and use your operating system's advertising controls. |
| Withdraw consent (Art. 7(3)) | The same settings entry. Withdrawal takes effect on the next ad request and does not affect processing already carried out. |
| Complain (Art. 77) | You may lodge a complaint with your national supervisory authority. Our own supervisory authority is the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, KVKK) in Türkiye. |
There is no automated decision-making with legal or similarly significant effects, and no profiling by us.
You can delete your account from inside the app, and you can also request deletion from the web without installing anything. Both routes, what each one removes, what survives and for how long, are set out on a dedicated page: Delete your Suphuzi VPN account.
In both cases the account leaves the live database immediately, and leaves the database backups within 35 days, as described in section 5. On Android, deleting the Suphuzi account does not cancel a Google Play subscription or stop its next renewal. Cancel it separately in Google Play; purchase records controlled by Google and RevenueCat may remain for the periods described in section 14.
Uninstalling alone is not deletion: on supported devices the local account identity may survive and return after reinstall. Use the in-app deletion command before uninstalling when possible. It clears the live account, current tunnel and the operating-system copy used for reinstall recovery.
Suphuzi VPN uses the 4+ / all-ages content-rating category on stores that use those labels and is not designed specifically for children. A store rating describes the content in the app; it is not a statement that a child can consent to data processing or agree to a contract without a parent or guardian. We do not ask for a name or date of birth, so we normally do not know a user's age. The optional ad flow may process the ad-request data listed in section 7. If you are a parent or guardian and believe a child's data was handled, contact us with the account ID and we will investigate and delete it where appropriate.
If we change this policy in a way that affects you, we will update the effective date and version at the top and announce it in the app before the change takes effect. Because no email address is attached to the app account, in-app and on-site notice are our normal channels. Previous versions are available on request.
İmzahub Teknoloji Ltd. Şti.
Beştepe Mahallesi, 32. Cadde No: 1/97, Yenimahalle, Ankara, Türkiye
Privacy and data rights: privacy@suphuzivpn.com
General support: support@suphuzivpn.com
Telephone: +90 553 688 13 56