Legal & privacy

Privacy Policy

Effective 16 August 2026 · Last updated 16 August 2026

Stormvpn provides an encrypted virtual private network and related account, device, subscription, security, and support features. This policy explains what information we process, why we process it, and the choices available to you.

1. Information we process

Account and authentication

Email address, nickname, securely hashed password, authentication sessions, account status, plan, expiry and device allowance. A guest account may be associated with a randomly generated installation identifier.

Device and VPN configuration

Random app device identifier, device name/model, operating-system version, language, VPN public key, assigned tunnel address, selected location and protocol, and feature settings necessary to provision and operate the VPN. Private VPN keys remain on your device.

Connection and security records

Source IP address, approximate country inferred from IP, selected server/location, protocol, connection outcome, timestamps, duration, and aggregate byte totals. These records support authentication, abuse prevention, device limits, troubleshooting, and network reliability. We do not associate an account with the content of websites you visit.

DNS protection statistics

If DNS protection is enabled, VPN nodes process DNS requests to provide resolution and filtering. The account service receives aggregate counts such as total requests and blocked ad/tracker requests; it does not receive or store DNS query names as account history.

Purchases

Google Play product ID, subscription or purchase status, entitlement expiry, order metadata where supplied by Google, and a one-way hash of the purchase token. Google processes payment credentials under its own privacy terms; Stormvpn does not receive your full card details.

Support and deletion requests

Information you provide when contacting us, plus the email address and authentication data needed to validate an account-deletion request.

2. Android permissions and local data

VpnService is used solely to create the device-level encrypted tunnel that is the app’s core function. Location permission is requested only when you enable trusted Wi-Fi auto-connect because Android requires it to read the current Wi-Fi network name. Trusted Wi-Fi names and split-tunneling selections are stored locally. Stormvpn queries only user-launchable apps for split tunneling and does not request broad access to the complete installed-app inventory.

3. How we use information

• Provide accounts, subscriptions, VPN tunnels, device management, smart routing and DNS protection.
• Authenticate users, enforce device and guest limits, verify purchases, and prevent fraud or abuse.
• Maintain service availability, investigate failures, secure infrastructure and respond to support requests.
• Comply with applicable legal obligations and enforce the Terms of Service.

4. Sharing

We may use infrastructure hosting providers and Google Play Billing as processors needed to operate the service. Information may also be disclosed when legally required, to protect users or infrastructure, or as part of a business transaction subject to appropriate safeguards. We do not sell personal information.

5. Retention

Account and device information is kept while your account is active. Operational and security records are retained only as long as reasonably necessary for service delivery, troubleshooting, security and abuse prevention. When an account is deleted, associated account, device, session, connection and DNS-statistics records are deleted. Purchase and order records may be retained in anonymized or legally required form for accounting, dispute handling, fraud prevention and regulatory compliance.

6. Your choices and rights

You can update account information in the app, disable optional features, remove devices, and delete your account in the app. You can also use the web deletion page. Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information. Contact us to exercise a right.

7. International processing and security

The service may process information in countries where Stormvpn infrastructure or providers operate. We use access controls, encrypted transport and other reasonable safeguards, but no system can guarantee absolute security.

8. Children

Stormvpn is not directed to children under 13, or the higher minimum age required in a user’s country. We do not knowingly collect personal information from children without legally required authorization.

9. Changes

We may update this policy as the service or law changes. The effective date above will be updated, and material changes may be communicated in the app or on this website.

10. Contact

Operator: Stormvpn. Privacy and support email: devops@vpn.shifen.dev.