Privacy Policy

Last updated: 2026-05-21

Vapen ("we", "the Service") provides a personal VPN client and the associated proxy infrastructure. This policy explains what data we collect, why, how long we keep it, and your rights.

1. Data we collect

Account identifiers. When you sign in with Telegram we receive your Telegram user id, first name, and (if set) public username. We store these to recognise returning users and to deliver subscription notifications.
Subscription state. Plan, expiry date, traffic counters (bytes uploaded/downloaded), and payment events. Required to enforce quotas and bill correctly.
Diagnostic logs (optional). If a VPN connection fails to start, the app may upload the sing-box engine log buffer, a Flutter exception trace, your device OS version, locale, timezone, and a redacted form of your subscription URL. We use these only to fix bugs. You can disable diagnostic upload in Settings.
Server-side request metadata. Our infrastructure logs the source IP, timestamp, and HTTP path of API requests for abuse prevention. These logs are kept for 7 days, then deleted.

2. What we do NOT collect

We do not log the websites you visit, the destinations you connect to over the VPN, or the content of your traffic.
We do not sell or share account or usage data with advertisers or data brokers.

3. Third parties

Telegram — used for login and notifications. We see only the public profile fields the Telegram Login Widget returns.
Apple TestFlight / App Store — distributes the app; Apple collects standard install/crash telemetry under Apple's privacy policy.
Telegram Stars and CryptoBot — handle payment. They receive only the amount and a payment reference; we do not transmit your name or email to them.
VPN exit nodes — third-party servers we rent. They forward your traffic without logging.

4. Retention

Account data: while your account is active, plus 30 days after deletion request.
Diagnostic logs: 7 days, then automatically deleted.
Server access logs: 7 days.
Payment records: 5 years (legal retention requirement).

5. Your rights

You can request data export or full account deletion by writing to @vapen_support_bot on Telegram. We respond within 14 days.

6. Children

The Service is not directed to anyone under 13. We do not knowingly collect data from children.

7. Changes

If we materially change this policy we will update the date above and notify active users via Telegram before the change takes effect.

8. Contact

Operator: Artem Ryabinin (sole operator). Contact via Telegram: @vapen_support_bot.