ZoneVPN · Privacy Policy
In short
- We keep no logs of what you do: no browsing history, no DNS queries, no traffic contents.
- We never sell your personal data.
- The servers are operated by third parties, not by us. Treat the connection as protection from your local network, not as a secret.
- Ads come from Google AdMob, and you can limit them in your device settings.
This policy explains what ZoneVPN does with information when you use the app. It is written to be read, not to be survived.
1. What the app is
ZoneVPN is a VPN client. It gathers publicly published server configurations, tests them, and lets you connect through the ones that work. The servers themselves are operated by third parties: we do not own, run, or control them, and we have no agreement with whoever does.
2. What that means for you
A VPN hides your traffic from the network you are sitting on — your home Wi-Fi, a café, a mobile carrier — and from anyone watching it. It does not hide your traffic from the server at the other end. Because we do not operate these servers, we cannot promise how their operators behave. Use ZoneVPN to keep a local network out of your business; do not use it for anything you could not afford a stranger to see. Traffic to sites using HTTPS stays encrypted end to end regardless, which is most of the web.
3. What we do not collect
There is no account, so we never ask for your name, email, phone number or any government identifier. We keep no record of the sites you visit, the apps you use through the tunnel, your DNS queries, or the contents of your traffic. None of that ever reaches us, because the app connects your device to the server directly.
4. What is processed, and by whom
- On your device only: your chosen server, language, theme and settings. These stay on the phone and are deleted when you uninstall the app.
- Google AdMob (Google Ireland Ltd): serves the ads that fund the app, and for that processes your device's advertising ID, approximate location derived from IP, and ad interactions. See policies.google.com/privacy.
- Google Analytics for Firebase and Firebase Crashlytics (Google Ireland Ltd): anonymous usage and stability data — app version, device model, OS version, language, screens opened, crash reports, and whether a connection attempt succeeded. It is used to find what is broken and what is slow.
- The server list itself is fetched from a public endpoint. That request carries your IP address to the host serving it, as any web request does.
- Country lookup: to tell which country you are really in — which decides whether you are asked for ad consent, and which ads may be shown — the app asks public IP-to-country services (such as country.is, GeoJS, ipwho.is and Cloudflare) over an encrypted connection. They receive your IP address, as any web request does, and answer with a country code; nothing else is sent.
- Connection quality reports (Cloudflare, Inc.): after each connection attempt and each background server check, the app notes whether it worked and how long it took, whether you were on Wi-Fi or mobile data, your mobile operator's network code (for example 432-11) and your country. These are sent only through the VPN tunnel, so the address they arrive from is the VPN server's, not yours, and they carry no identifier for you or your device. They are stored only as hourly totals per server and are used to rank servers and to stop offering ones that do not work.
5. Advertising and consent
Where the law requires it — the EU, the UK and any other region covered by Google's consent requirements — you are asked for consent before personalised ads are shown, and you can change that choice later in Settings. You can also reset or delete your advertising ID at any time in your device's privacy settings, which limits ad personalisation system-wide.
6. Who we share with
We do not sell personal data, and there is no one to sell it to: we hold none. The providers above process data on our behalf under their own terms. We disclose information only where a valid legal obligation requires it.
7. Retention
We keep no activity logs, so there is no history to retain. Analytics and crash data are retained by Google under their published retention periods and are not linked to an identity by us. Connection quality totals are kept for three days and then deleted.
8. Security
The tunnel is encrypted by the protocol in use. We apply reasonable measures to the limited data we handle, and the app verifies the server list's signature before trusting it, so a tampered list is rejected. No system is perfectly secure, and we do not claim otherwise.
9. Children
ZoneVPN is not directed at children under 13, or under the minimum age of digital consent where you live, and we do not knowingly collect their data.
10. Your rights
Depending on where you live you may have the right to access, correct, delete or object to the processing of personal data. Because we hold no personal data ourselves, most requests are best directed to Google for the data they process; we will help where we can. Write to zonevpnsupport@gmail.com.
11. Lawful use
Use the service lawfully, and in line with the Terms of Service.
12. Changes
If this policy changes materially, the effective date above changes with it and the app shows a notice.