Privacy policy
Acefina VPN is built so that we know as little about you as possible. There is no account, no email address and no name. This policy lists everything we process, why, and for how long. It applies to the Acefina VPN apps for iPhone, iPad, Mac and Android and to the servers behind them.
On Android, Acefina VPN uses Android's VpnService to create an encrypted tunnel between your device and Acefina VPN servers. We do not log or share the traffic that passes through it.
1. Who we are
Acefina LLC ("we") provides Acefina VPN and is responsible for the data described here. Contact: support@acefina.com.
2. What we never collect
- The websites, apps or services you use, or the content of your traffic.
- DNS queries you make through the VPN. Our resolvers run with query logging switched off.
- Connection logs: when you connect or disconnect, for how long, or from which IP address.
- Per-user bandwidth. Our servers only report total traffic and load for the whole server.
- Your contacts, photos, location, advertising identifiers or any other personal content on your device.
3. What we process
| Data | Why | How long |
|---|---|---|
| A random device ID and device token created when you first open the app | To recognise your device without an account | Until you delete your data |
| Your device's WireGuard public key and the private network address assigned to it | So our VPN servers accept your encrypted connection | Until you delete your data; removed from VPN servers when your subscription ends |
| Device platform (iOS, macOS, Android) and app version | Compatibility and support | Until you delete your data |
| The date your device last contacted our API | To clean up abandoned devices | Until you delete your data |
| Subscription status: plan, store, expiry date, and subscription events (such as renewal or cancellation) received from RevenueCat | To give subscribers access | Until you delete your data |
4. Your IP address
Any internet service necessarily sees the IP address you connect from. Here is exactly how we treat it:
- Our API (hosted on Cloudflare) receives your IP address when the app talks to it. We configured it not to keep request logs, and we do not store your IP address. When you connect, the app asks our API which country your traffic now appears to come from; that answer is computed on the fly and not stored.
- Our VPN servers must know your current IP address while you are connected, to send your traffic back to you. It is held only in the memory of the VPN software, is never written to disk or logs, and is gone when the connection ends or the server restarts.
5. Data that stays on your device
- Your WireGuard private key, stored in the device's secure storage (Keychain or Android Keystore). It never leaves your device.
- Your settings, favourite locations and apps you exclude from the VPN (Android). To show the list of apps you can exclude, the app reads the names of your installed apps on the device; that list is never sent anywhere.
- Which connection mode worked on a given network, identified by the connection type and network provider number. This helps the app connect faster next time and is never sent to us.
6. Payments
Purchases are handled by Apple (App Store) or Google (Google Play). We never see your name, card or billing details. We use RevenueCat, Inc. to verify subscriptions. The app shares your anonymous device ID with RevenueCat, and RevenueCat receives purchase receipts from the store along with basic technical data such as app version, device model, operating system and IP address. See the RevenueCat privacy policy.
7. Service providers
We share data only with providers that run parts of the service for us, under contracts that limit their use of it:
- Cloudflare, Inc.: hosts our API and database.
- Server hosting providers (currently Hetzner Online GmbH and Hostinger International Ltd.): host the VPN servers. Like any network operator they see encrypted traffic entering and leaving our servers, but not its content.
- RevenueCat, Inc.: subscription verification.
- Apple and Google: payments and app distribution, under their own privacy policies.
Each provider is bound to protect the data at least as well as this policy does.
We do not sell, use or disclose to third parties any user data for any purpose other than providing Acefina VPN. We do not sell personal information, share it for cross-context behavioural advertising, or use it to build profiles.
8. Support
If you write to us, we use your email only to answer you and delete the conversation when it is resolved. The in-app Connection report is shown to you first and is sent only if you choose to share it. It contains your anonymous device ID, app version, network type (for example Wi-Fi), network provider number and connection status, and never your traffic or browsing.
9. Security
All traffic between the app and our servers is encrypted: WireGuard for the VPN tunnel and HTTPS for the API. The list of servers the app receives is digitally signed, and the app rejects any list we did not sign. Device tokens are stored on our side only as one-way hashes. Access to our systems is limited to Acefina staff who need it.
10. Legal bases (EEA and UK users)
We process the data in section 3 to provide the service you requested (performance of a contract), and minimal technical data to keep the service secure and working (legitimate interests). We do not rely on consent for any tracking, because there is none.
11. Your rights and choices
- Delete everything: open Settings → Delete my data in the app. This disconnects you, removes your VPN key, tunnel address and subscription record from our servers, and resets the app. We keep only a marker with the random ID, platform and dates so the ID is never reused. To stop being charged, also cancel your subscription in the App Store or Google Play.
- Depending on where you live (for example under the GDPR, UK GDPR or California law), you may have the right to access, correct, delete or receive a copy of your data, to object to or restrict processing, and to complain to your data protection authority. Because we have no account, email us from the app's Settings → Your anonymous ID so we can find your record. We do not discriminate against anyone for exercising these rights.
12. International transfers
Our providers may process data in the United States and other countries. Where required, transfers rely on safeguards such as the European Commission's Standard Contractual Clauses.
13. Requests from authorities
We answer only legally valid requests and review each one. Because we do not keep activity or connection logs, we cannot say what any user did online or who used a given IP address at a given time.
14. Children
Acefina VPN is not directed to children under 13, or under the minimum age for online services in your country, and we do not knowingly collect their data.
15. Changes
We will update this page and the date above when our practices change, and describe material changes in the app before they take effect.