Privacy Policy

This policy explains how the Android app Orbix VPN ("the app", package com.devflovv.orbixvpn) handles your information. The app is published by Devflovv. It is a free VPN. It has no account, no ads, no in-app purchases and no analytics or advertising SDKs, and Devflovv does not run any server that receives your data. Devflovv does not collect, sell or share your personal data.

To provide the VPN, the app connects you to free public VPN servers that are run by community volunteers and listed by the VPN Gate Academic Experiment Project. Devflovv does not operate these servers. VPN Gate and the operator of the server you use can see your original IP address and information about your connection, and VPN Gate states that it keeps connection logs for at least two weeks. Please read "VPN Gate and the volunteer servers" below before you use the app.

In short:

• Account or sign-in: none. No registration, email address or phone number.
• Advertising: none.
• Analytics and tracking: none. No analytics, advertising or tracking SDKs.
• In-app purchases: none. The app is free.
• VPN servers: public servers run by volunteers and listed by VPN Gate, a research project of the University of Tsukuba, Japan. Devflovv does not operate them.
• Who can see your connection: VPN Gate and the operator of the server you use can see your original IP address and connection metadata. VPN Gate states that it keeps connection logs for at least two weeks.
• Other services the app contacts: VPN Gate (server list), api.ipify.org (your visible IP address), the VPN servers (response-time checks) and, while Block trackers is on, AdGuard DNS. Block trackers is on by default. If it is off and the server supplies no DNS servers, DNS lookups go to Cloudflare and Google public DNS instead.
• Favorites, settings and other app data: stored only on your device.
• Crash reports: off by default. Sent by email only if you turn them on and choose to send one.
• Data sent to Devflovv: none, unless you email us.
• Data sold or used for advertising: never.
• Data deletion: see "Your choices and data deletion" below.

When you connect, the app sets up a VPN tunnel between your device and the server you chose, and your internet traffic passes through that server on its way to the websites and services you use. Those websites and services see the server's IP address instead of yours.

A VPN moves trust from your local network to the VPN server. It does not make you anonymous. Traffic leaves the VPN server and travels to its destination like any other internet traffic, so prefer websites and apps that use HTTPS, which keeps the content of your traffic encrypted end to end.

The app does not use servers run by Devflovv. It uses public VPN servers that are listed by the VPN Gate Academic Experiment Project, which is run by the University of Tsukuba in Japan. The servers themselves are run by volunteers around the world. When you are connected, your traffic passes through one of these third-party volunteer servers.

• What they can see. VPN Gate and the operator of the server you connect to can see your device's original IP address and metadata about your connection, such as when you connected and the addresses and services your traffic goes to.
• Logs. VPN Gate states that it keeps connection logs for at least two weeks. Its website explains how these logs are kept and when they may be disclosed.
• Not under our control. Devflovv does not operate, monitor or have access to these servers, their logs or the traffic that passes through them, and cannot delete data they hold. VPN Gate and the server operators handle data under their own terms and policies.

Our advice: because the servers are run by third parties and connection logs are kept, do not use Orbix VPN, or any other free public VPN, for highly sensitive activity.

Apart from the VPN connection itself, the app makes the following requests. Like any internet request, each one reveals the IP address it comes from to the service that receives it. None of them includes your favorites, settings or other app data.

• Server list, sent to VPN Gate (vpngate.net): downloads the public list of VPN servers, which is then cached on your device.
• Public IP check, sent to ipify (api.ipify.org), a public IP lookup service: shows you the IP address that websites currently see, which is the VPN server's address while you are connected.
• Response-time check, sent to the VPN servers in the list: opens short test connections to measure how quickly each server responds.
• Block trackers, sent to AdGuard DNS, a public tracker-blocking DNS service, while that setting is on: see "Block trackers" below.

Block trackers is an optional setting. It is on when you first install the app, and you can turn it off at any time in Settings. While it is on and the VPN is connected, the app sends your device's DNS lookups, which are the names of the websites and services your device looks up, to AdGuard DNS, a public DNS service that blocks known tracker domains. AdGuard handles these lookups under the AdGuard DNS privacy policy. When Block trackers is off, the app does not send any lookups to AdGuard DNS.

When Block trackers is off and the VPN server supplies no DNS servers of its own, the app sends your DNS lookups to the public DNS services of Cloudflare (1.1.1.1) and Google (8.8.8.8) instead, which handle them under their own privacy policies. These lookups travel through the VPN tunnel whenever all of your traffic does, which is the case when the server asks for it or sends no routes of its own.

The app stores the following in its private storage on your device, so that it can work:

• Your favorite servers and recent locations.
• The names of Wi-Fi networks you mark as trusted.
• Your split tunneling choices, meaning which apps use the VPN.
• Your settings, such as the kill switch, auto-connect, Block trackers, crash reports and theme.
• The cached server list.

This data stays on your device. The app turns off Android backup for its data, including device-to-device transfer, so none of it is copied into a device backup or to a new phone. Devflovv runs no server that receives it, so we cannot see it or recover it for you. It is deleted when you uninstall the app.

Crash reports are off by default. If you turn them on, the app saves details of a crash on your device and offers to send them to us by email. A crash report contains:

• The app version.
• The Android version.
• Your device model.
• The error trace, which shows where in the app's code the error happened.

A crash report contains no browsing or network data. Nothing is sent unless you choose to send it. If you do, we receive the report together with your email address and anything else you include in the email, and we use them only to fix problems and, if needed, to reply to you.

Before the app can set up a VPN, Android shows its own consent dialog. Approving it lets the app route your traffic through the server you choose. The app's release build declares these permissions, each for the reason given:

• Internet (INTERNET): to connect to the VPN servers, download the server list and run the IP and response-time checks.
• Network state (ACCESS_NETWORK_STATE): to see whether your device is online and whether it is on Wi-Fi or mobile data, so that auto-connect can respond when the network changes.
• Wi-Fi state (ACCESS_WIFI_STATE): to read details of the Wi-Fi network you are connected to, such as its name and whether it is open, for auto-connect on untrusted Wi-Fi.
• Foreground service (FOREGROUND_SERVICE and FOREGROUND_SERVICE_SPECIAL_USE): the VPN runs as a foreground service with a persistent notification, which keeps it running while you use other apps.
• Notifications (POST_NOTIFICATIONS): to show the connection status in that notification while the VPN is running.
• Run at startup (RECEIVE_BOOT_COMPLETED): so that auto-connect can start the VPN after your device restarts, if you have turned auto-connect on.
• Location (ACCESS_COARSE_LOCATION and ACCESS_FINE_LOCATION), optional: used only to read the name of the Wi-Fi network you are connected to, for auto-connect on untrusted Wi-Fi. Android requires location permission before an app can read Wi-Fi network names. The app does not collect or send your location, and the network name is stored only on your device. You can decline this permission and use the rest of the app.
• DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION: an internal permission that the AndroidX libraries the app is built with add automatically. It belongs to the app itself, is limited to apps signed with the same key, and keeps the app's internal messages private. It gives the app no access to your personal information.

Visibility of apps: for split tunneling, the app can list the apps on your device that appear in your launcher, so you can choose which apps use the VPN. The list is read on your device and never sent anywhere.

The app does not ask for access to your contacts, camera, microphone, photos or files.

The app is not directed at children under 13, and we do not knowingly collect personal information from children. The app has no account and does not ask anyone for a name, email address or phone number. If you believe a child has sent us personal information by email, contact us and we will delete it.

You stay in control of the app's data:

• Data on your device. Uninstalling the app deletes all of its data from your device. You can also clear the app's data in your Android settings.
• Optional features. You can turn Block trackers and crash reports on or off at any time, and you can decline or withdraw the location permission in your Android settings.
• Emails you send us. To ask us to delete an email or crash report you sent, email hello@devflovv.com. We will delete it within 30 days and reply to confirm.
• Data held by third parties. Devflovv cannot access or delete connection logs kept by VPN Gate or the server operators, or data held by ipify, AdGuard, Cloudflare or Google. Please contact those services directly.

The app contains no third-party advertising, analytics or tracking SDKs. The third parties involved in using the app are VPN Gate and its volunteer server operators, ipify, and the DNS services described under "Block trackers": AdGuard DNS while that setting is on, and otherwise, if the VPN server supplies no DNS servers, Cloudflare and Google public DNS. Google Play delivers the app and its updates, and may provide us with anonymous, summarized installation and crash statistics under Google's own privacy policy.

Data the app stores is kept in its private storage on your device, which Android's app sandbox protects from other apps. No method of sending data over the internet is completely secure, and the VPN servers are run by third parties, as explained in "VPN Gate and the volunteer servers" above.

If the app's data practices change, we will update this policy and its effective date before the change takes effect.

Questions about this policy, or a request about your data? Email hello@devflovv.com.