This policy describes exactly what Suphuzi VPN handles, what is written down, how long it survives and who else touches it. Where a statement is a technical claim about our servers, it comes from an inspection of the live production systems rather than from marketing intent.
Before publishing: the values marked [LIKE THIS] must be replaced with the operating company's real details. A privacy policy without a named controller and a working contact address does not satisfy GDPR Article 13 and will be rejected by both stores.
The data controller for the personal data described in this policy is [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS, COUNTRY] (company number [COMPANY NUMBER]), which publishes the Suphuzi VPN applications.
For any privacy question, request or complaint, write to privacy@suphuzivpn.com. We answer data-rights requests within 30 days.
We think you should be able to hold the whole picture in your head, so here it is:
We deliberately do not describe Suphuzi as a “no-log VPN” or a “zero-log” service. Those phrases are absolutes, they are unverifiable from the outside, and they are not true of the advertising SDK in the free tier. The narrower statements above are the ones we can stand behind.
On every production exit server, all of the following were verified to be absent or disabled:
-j LOG / NFLOG) exist in the firewall, and per-connection byte accounting is disabled.The system journal on those machines contains only boot-time interface setup — no peer address and no handshake record.
For each live peer the kernel holds, and only in RAM:
10.66.x.y, an RFC 1918 address that identifies nobody outside the tunnel).A maintenance service on every exit server scrubs the first four of those fields once a peer has not completed a handshake for 180 seconds. In practice your real IP address stops existing on the server roughly three minutes after your device goes quiet — and immediately when you disconnect, because the app releases its lease and the peer is removed outright. Everything in this list is lost on reboot and none of it is ever written to storage.
We do not read the per-peer byte counters. Server-side traffic measurement would create exactly the kind of tunnel-linked metadata this design exists to avoid, so the control plane never queries it. Your free allowance is metered by your own device (section 6).
Access logging on the control-plane API gateway is switched off, so no
request IP address is recorded there. The application code never reads the
caller's IP address except at the one endpoint described in
section 10. The only application log lines the control plane writes
are server-health errors and counters such as
{"event":"ssv_credited","ok":true}; they contain no IP address,
no account identifier and no key. That log group is retained for
7 days and then deleted automatically.
Four of our nine exit servers pull their configuration from the control plane over an authenticated request, so nothing about you passes through a cloud management API. The remaining five are still provisioned by AWS Systems Manager, which retains its command history for about 30 days. That history contains the public half of your WireGuard key and your private in-tunnel address — never your real IP address and never any account field. We are migrating those servers to the pull model; until then we would rather write this down than leave it out.
To connect you, the control plane writes one short-lived record to a
database table in Frankfurt (AWS eu-central-1). It contains:
| Field | What it is | Can it identify you? |
|---|---|---|
token | A random value used to renew or release the lease | No — unrelated to any account |
server_id | Which exit server, e.g. hetzner-hel-1 | No |
public_key | The public half of a WireGuard key pair | A pseudonym. It can be regenerated at any time. |
client_ip | Your address inside the tunnel, e.g. 10.66.21.105 | No — this is a private address, not your real IP |
created_at, lease_expires_at, expires_at | Timestamps for lease and automatic deletion | No |
Your WireGuard private key never leaves your device. The key pair is generated on the device itself — by the operating system's own cryptography on iOS and by the WireGuard library on Android — and only the public half is ever sent to us.
No account field is ever written to this table. Your account identifier, device identifier and email digest are physically absent from it; this separation is enforced in a single place in the code and covered by automated tests.
The record is deleted automatically at most 48 hours after it is issued (a 24-hour lease plus a 24-hour grace period), and typically much sooner, because disconnecting deletes it immediately.
Nothing outlives that 48 hours. Continuous backups (point-in-time recovery) are switched off on the lease table, so no restorable copy of a lease survives once it expires. The 48-hour figure is the whole story for tunnel data, not just the story for the live table.
Suphuzi VPN accounts are anonymous by default. When you first open the app it registers a device with our server and receives two random 128-bit identifiers — an account ID and a device ID. There is no sign-up form, no password and no email address. We need a stable identifier because a daily allowance and a device limit cannot be enforced against nothing.
Account data lives in a separate database table from the tunnel lease above, in Frankfurt (AWS eu-central-1). Every field is listed here:
| Data | Why it exists | Retention |
|---|---|---|
| Account ID (random 128-bit) | Anchors your allowance, tier and devices | Until you delete the account |
Device ID (random 128-bit), platform (android/ios), the label you give a device | So the device limit can be counted and you can tell your devices apart | Until you remove the device or delete the account |
Creation date and last-seen date, to the day (YYYY-MM-DD, UTC) | So you can answer “which device is this?” | With the device |
| Subscription tier and its expiry | Unlocks paid features and lifts the metered allowance | With the account |
| Daily allowance ledger: bytes granted, bytes your device reported using, rewarded ads credited, leases issued | Free-tier accounting | 3 days, deleted automatically |
| Active session: which server, start time, and (optionally) the lease token | So you can cut off a lost device immediately | Until you disconnect, or the lease expires |
HMAC(secret, your email) — a keyed digest, if you choose to link an email address | Lets a second device join the same subscription | Until you unlink it or delete the account |
| One-time login code (as a hash) while an email link is in progress | Verifies the code you were sent | 10 minutes, deleted automatically |
| Rewarded-ad transaction ID from Google | Stops the same ad being credited twice | 7 days, deleted automatically |
| Idempotency keys for repeated requests | Stops a retried request being counted twice | 24 hours, deleted automatically |
The account table has continuous backups (point-in-time recovery) enabled with a 35-day window. We keep them because losing this table would destroy the subscription of everyone who paid for one, and there is no way to reconstruct it.
The honest consequence: when you delete your account it disappears from the live database immediately, but a copy of it remains inside those rolling backups for up to 35 days before it ages out. Nobody reads a backup to look you up — it exists only to restore the whole table after a failure — but it is not accurate to say your data is gone from everywhere the moment you press the button, so we say this instead.
The tunnel lease table (section 4) has no such window. Backups are switched off there, deliberately, so that tunnel data really does end at 48 hours.
Linking an email is entirely optional and is only offered if you want a second device on the same subscription. If you do it, we compute a keyed digest of the address and store only the digest. The plaintext address is used to send the code and is then discarded — it is never written to any database. The key used for the digest is held in a separate secrets store and is not in the database, so even a full database dump could not be reversed into a list of email addresses.
The honest cost of that decision: we cannot email you. No newsletters, no security notices, no receipts. Store receipts come from Apple or Google, not from us.
Account and tunnel data are never joined into a profile. The only link that exists at all is a short-lived one: while a session is running, the session record may hold the lease token so that removing a lost device can end its tunnel at once. It contains no WireGuard key, no tunnel address and no endpoint, and it disappears when the session ends.
Free accounts receive 500 MB per UTC day, and can add 100 MB per rewarded ad up to 10 ads per day. The grant is recorded on our server; the consumption is measured by your own device from the tunnel's byte counters and reported back as a number. We do not measure your traffic on the server side, which is why the ledger holds a total in bytes and nothing about what those bytes were.
Rewards are credited by a signed callback that Google sends directly to our server after an ad completes. The callback carries an ad transaction ID and your account ID; we verify Google's cryptographic signature before crediting anything, and we log neither the account ID nor the transaction ID.
The free tier is funded by rewarded video ads served by Google AdMob. This is the one place where a third party collects data about you through our app, so we describe it plainly.
When you choose to watch an ad, Google's Mobile Ads SDK may collect and use:
Google acts as an independent controller for this data under its own privacy policy.
Ad content is capped at a “Teen” rating. We do not run banner or interstitial ads, and no ad is ever placed in the connection flow.
Subscriptions are sold through the App Store and Google Play and managed for us by RevenueCat. We never see or handle your card details.
RevenueCat receives a pseudonymous app user ID (initially a random installation identifier generated on your device, later aliased to your random account ID), your purchase and renewal history, and your IP address. It tells our server which tier you are entitled to; our server never accepts a tier claimed by the app itself.
Apple and Google process the payment and keep their own transaction records under their own policies, including for tax and accounting purposes that we cannot override.
Our exit servers run no DNS software, so a DNS query cannot be seen or logged on them. Instead the tunnel points your device at public resolvers:
| When | Resolvers used | Operated by |
|---|---|---|
| Default, all tiers | 1.1.1.1, 9.9.9.9 | Cloudflare and Quad9 |
| Custom DNS (paid) | Whatever you enter | Whoever you chose |
| Threat protection → “Ads and trackers” (paid) | 94.140.14.14, 94.140.15.15 | AdGuard DNS |
| Threat protection → “Malware and phishing” (paid) | 9.9.9.9, 149.112.112.112 | Quad9 |
| Threat protection → “Ads, trackers and adult content” (paid) | 94.140.14.15, 94.140.15.16 | AdGuard DNS |
Your queries travel inside the encrypted tunnel and are answered by the
operator named above, under that operator's privacy policy. Cloudflare
states that it discards 1.1.1.1 query logs within 24 hours.
Turning on a filtering profile deliberately moves DNS visibility to the
named operator, which is why the app shows you who answers before you
choose. We plan to run our own resolver so this dependency disappears; until
that ships, this is the arrangement.
The app's connection-health screen calls four endpoints: a latency probe, a fixed-size download, a discarded upload, and an exit-IP check. An exit-IP check must by definition see your address in order to report it back, so the commitment we make is narrow and exact:
Your IP address is returned to you and goes nowhere else. It is not logged, not written to any database, not attached to a metric, not put in an error message, and not held in any server-side cache or rate-limit key. Automated tests assert this, and after deployment a search of the log system for a real caller's IP returned zero results.
The download and upload endpoints carry only a fixed synthetic payload; uploaded bytes are counted and discarded. Rate limiting on these endpoints is deliberately not keyed by IP address, because that would mean storing IP addresses.
We do not sell personal data, and we do not share it for cross-context behavioural advertising beyond the AdMob arrangement described in section 7.
| Provider | Role | What it can reach | Where |
|---|---|---|---|
| Amazon Web Services | Control plane (API, database, secrets) and five exit servers | Runs the infrastructure. Network flow logging is disabled, so no record of your traffic exists. Hypervisor-level access is theoretically possible for any cloud host. | Frankfurt (control plane); N. Virginia, Oregon, London, Singapore, Sydney (exits) |
| Hetzner Online GmbH | Four exit servers | As above | Nuremberg, Helsinki, Singapore, Ashburn |
| Google Ireland Ltd. / Google LLC | AdMob advertising; app distribution and payments on Google Play | Advertising identifier, IP-derived approximate location, ad interactions (free tier only, after consent) | Global |
| RevenueCat, Inc. | Subscription management | Pseudonymous app user ID, purchase history, IP address | United States |
| Apple Inc. | App distribution and payments on iOS | Purchase records under Apple's own policy | Global |
| Cloudflare, Quad9, AdGuard | DNS resolution (section 9) | Your DNS queries, as an independent controller | Global |
| Amazon SES | Sending the one-time code, if you link an email | Your email address, transiently, to deliver the message | Frankfurt |
| Netlify | Hosting this website | Standard web server request data for this site only. It has no access to the VPN or to accounts. | Global CDN |
Account data and tunnel leases are stored in the European Union (AWS Frankfurt). Exit servers are in the countries listed above and only forward packets; they hold no database. Where a sub-processor is outside the EEA — RevenueCat and Google in the United States, and exit servers in the US, Singapore and Australia — transfers rely on the European Commission's Standard Contractual Clauses or, where applicable, an adequacy decision. [CONFIRM THE TRANSFER MECHANISM WITH COUNSEL AND NAME IT HERE.]
| Data | Kept for |
|---|---|
| Your real IP address, handshake time, byte counters, session keys (server RAM) | Until ~180 s after your device stops handshaking, or immediately on disconnect. Never stored. |
| Tunnel lease record (token, public key, in-tunnel address) | Up to 48 hours; deleted on disconnect. Backups are switched off on this table, so nothing restorable outlives it. |
| Account record, devices, tier | Until you delete the account, then up to 35 more days inside the database backups (section 5) |
| Daily allowance ledger | 3 days |
| Active session record | Until disconnect or lease expiry |
| Email digest / Apple identifier digest | Until you unlink it or delete the account |
| One-time login code | 10 minutes |
| Rewarded-ad transaction ID | 7 days |
| Idempotency keys | 24 hours |
| Backups of the account database (point-in-time recovery) | A rolling 35 days. Deleted account data ages out of these within that window. |
| Control-plane application logs (server health, counters; no personal data) | 7 days |
| Cloud provisioning command history on five AWS exit servers (public key + in-tunnel address only) | ~30 days, by the cloud provider |
| Purchase records at Apple, Google and RevenueCat | Under their policies and applicable tax law |
If you are in the European Economic Area or the United Kingdom, the GDPR and UK GDPR give you the rights below. We extend the same rights to everyone, wherever they are. Users in Türkiye have equivalent rights under KVKK Articles 11 and 13.
| Right | How to use it |
|---|---|
| Access (Art. 15) | The app reads your account record back from the server and shows it to you: your account ID under Settings → Account, and your plan, your device limit and every registered device — with its label, platform, creation day and last-seen day — under Settings → Devices. Your remaining daily allowance is on the home screen. You can also ask us by email for the whole record at once. |
| Portability (Art. 20) | The record is held as JSON and we will send you the export on request. To be exact about what the app does and does not do: it displays the record, but it has no one-tap “download my data” button. Email us and we will send the file. |
| Erasure (Art. 17) | Delete the whole account from Settings → Account → Delete account, or remove a single device from Settings → Devices. See Delete your account. |
| Rectification (Art. 16) | Device labels are editable in the app under Settings → Devices → Rename, and the change is written to the server. There is very little else that could be wrong, because we hold very little — the rest of your record is either random identifiers we generated or dates we recorded. |
| Objection and restriction (Art. 21, 18) | Email us. For advertising specifically, withdraw consent under Settings → Ad and tracking preferences, or subscribe to remove ads entirely. |
| Withdraw consent (Art. 7(3)) | The same settings entry. Withdrawal takes effect on the next ad request and does not affect processing already carried out. |
| Complain (Art. 77) | You may lodge a complaint with your national supervisory authority. [NAME THE LEAD SUPERVISORY AUTHORITY FOR THE ENTITY] |
There is no automated decision-making with legal or similarly significant effects, and no profiling by us.
You can delete your account from inside the app, and you can also request deletion from the web without installing anything. Both routes, what each one removes, what survives and for how long, are set out on a dedicated page: Delete your Suphuzi VPN account.
In both cases the account leaves the live database immediately, and leaves the database backups within 35 days, as described in section 5. Deleting your account does not cancel a paid subscription — Apple and Google do the billing, and only they can stop it.
If you only want to remove one device — a phone you sold, or one you have lost — you do not have to delete the account. Open Settings → Devices on any other device that is still on the account and remove it there. That deletes its device record, revokes its access token and closes its tunnel within seconds.
Suphuzi VPN is rated 18+ and is not directed to children. We do not knowingly collect data from anyone under 18. The app is not enrolled in Google Play's Families programme, and the advertising SDK is configured with child-directed treatment and under-age-of-consent flags set to “no”. If you believe a child has used the app, write to us and we will delete the account.
If we change this policy in a way that affects you, we will update the effective date and version at the top and announce it in the app before the change takes effect. Because we deliberately cannot email you, in-app and on-site notice is the channel we have. Previous versions are available on request.
[LEGAL ENTITY NAME]
[REGISTERED ADDRESS, COUNTRY]
Privacy and data rights: privacy@suphuzivpn.com
General support: support@suphuzivpn.com