VPN4All is run by a single operator. This policy explains, in plain
language, what data we collect, why, how long we keep it, and who we
share it with — across our website, our Android phone and Android TV
apps, our VPN service, and the bundled password manager. It applies
everywhere VPN4All operates, not just the website.
This service is not directed at children and is not intended for
use by anyone under 16. We do not knowingly collect data from
children. If you believe a child has provided us with personal data,
contact us at support@vpn4all.eu
and we'll delete it.
1. What we collect
- Account data: the email address and password
(stored as a salted hash, never in plain text) you sign up with,
whether through the website, the Android app, or the Android TV
app. This is the same account across all three.
- Device/connection records: for each device you
connect (phone, TV box, laptop, etc.), we store a device label (on
the apps, this is your device's manufacturer and model, e.g. "Google
Pixel 8" — used only to tell your devices apart in your dashboard),
a WireGuard public key, an assigned internal VPN IP address, and
when the device was added. We do not collect your device's
advertising ID, IMEI, or any other hardware identifier beyond that
label.
- DNS query logs: only if your device is using
our default AdGuard-filtered DNS mode. Kept only for a short,
minimal retention window, used solely to detect abuse and keep the
ad-blocking service healthy. Never sold or shared with third
parties. If you switch a device to unfiltered DNS mode (available
in the app and web dashboard), that device's queries go straight to
an unfiltered resolver and are not logged by us at all.
- Connection metadata: basic bandwidth usage per
device (data transferred), used for capacity planning, not content
inspection.
- Payment records: handled by our billing
provider (Paymenter) and your chosen payment method (PayPal or
NOWPayments) — see Section 3.
- Password vault data: your Vaultwarden vault is
encrypted end-to-end on your device before syncing. We store only
the encrypted blob — we cannot read your passwords, notes, or any
vault contents. Account metadata (your email, login timestamps, and
IP address at login) is visible to us as the operator, the same as
with any hosted account system.
- Support communications: if you email support,
we keep that correspondence to help resolve your issue and for a
reasonable period afterward in case of follow-up.
2. What our apps do not do
- No analytics or crash-reporting SDKs of any kind — the Android
phone and Android TV apps don't include Google Analytics, Firebase,
Crashlytics, or any comparable tracking library. We don't know how
you use the app beyond what our own server logs (Section 1) already
cover.
- No advertising IDs collected or shared.
- No third-party ad networks.
3. Who we share data with
We don't sell data, and we don't share it with advertisers or data
brokers. We do share the minimum necessary data with the following
service providers, each acting on our behalf to run VPN4All:
- Paymenter (billing): processes your order and
subscription. Sees your email and order/payment status.
- PayPal / NOWPayments (payment methods):
processes the actual payment. If you pay via PayPal, that
transaction is tied to your identity through PayPal's own records —
see Section 4. NOWPayments (cryptocurrency) significantly reduces
this link.
- Mailgun (transactional email): delivers
account emails like password resets. Sees your email address and
the content of that specific email only.
- Vaultwarden (password manager, paid tier):
self-hosted by us — this isn't a third party, but noted here since
it's a separate system from the VPN itself. See Section 1 for what
it can and can't see.
We do not share data with any party beyond what's listed above,
and never for advertising or marketing purposes.
4. Payment and identity
If you pay via PayPal, that transaction is tied to your identity
through PayPal's own records, which we can see on our side as the
payment recipient. Paying with cryptocurrency significantly reduces
this link. We do not claim full anonymity for either method — see our
FAQ for more detail.
5. Data retention
DNS logs are retained for the minimum period needed to detect
abuse, then deleted. Account, device, and billing records are
retained for as long as your account is active, plus any period
required by applicable tax and accounting law.
6. Deleting your account and data
To delete your account and associated data (email, device records,
DNS logs, and — where legally permitted — billing history), email
support@vpn4all.eu from the
address on your account and request deletion. We handle these
requests manually and will confirm once it's done. Some billing
records may need to be retained longer where required by tax law,
even after account deletion.
7. Your rights (GDPR)
As we operate from and serve customers connected to the
Netherlands, you have the right to access, correct, export, or delete
your personal data under GDPR. To exercise any of these rights, email
support@vpn4all.eu and we'll
respond directly — there's no support queue to get lost in.
8. International data transfer
Our infrastructure runs in the Netherlands (EU). Some service
providers listed in Section 3 may process data outside the EU as part
of their own operations; where that happens, they do so under their
own applicable safeguards (e.g. standard contractual clauses). We
choose providers with clear privacy commitments and avoid this where
we can.
9. Changes to this policy
If this policy changes in any way that reduces your privacy
protections, we'll announce it clearly rather than updating it
quietly. Continued use of the service after a change means you accept
the updated policy.
10. Contact
Questions about this policy, or requests under Sections 6 or 7,
can go straight to
support@vpn4all.eu.