Privacy Policy

Introduction

This policy sets out how GoFlyVPN collects, uses, shares, stores and protects personal information, and what you can require of us in return. It covers the application, the connection service behind it and the support channels attached to them.

By installing or continuing to use the service you accept the terms described here. If any part of it is unacceptable to you, the appropriate response is to stop using the service rather than to continue under terms you do not agree with.

Last Updated: January 5, 2026
Effective Date: January 5, 2026

Definitions

A few terms recur throughout this document and are worth pinning down:

• Personal Information –any information that identifies a particular person, or that can reasonably be linked back to one, whether on its own or in combination with other data.
• Sensitive Personal Information –a narrower category whose exposure carries elevated risk of harm or discrimination: government identifiers, financial account details, precise location, biometric data, health data and the contents of private communications.
• Processing –anything done to personal information at all, including collecting it, recording it, storing it, consulting it, transmitting it, restricting it, erasing it or anonymising it.
• Minors –individuals below the age of majority in their own jurisdiction, treated throughout this policy as requiring guardian involvement.

Where you are located determines which statutory framework governs our handling of your data. Depending on the case that may be the EU General Data Protection Regulation, the UK GDPR, the California Consumer Privacy Act as amended by the CPRA, Brazil's Lei Geral de Proteção de Dados, or an equivalent regional privacy law. Where such a law grants you more than this policy describes, the law prevails.

Information we collect, and why

We collect by category and only for a stated purpose. Nothing below is gathered simply because it is technically available.

Account and device information

Basic identifiers needed to deliver a working client: device information, advertising identifier, application version and platform.

Support information

When you contact us: the substance of your enquiry, any attachments you choose to send, the email address you write from and the resulting ticket record.

Device and diagnostic data

Device model, operating system version, application version, language, timezone, crash logs, error codes, performance measurements and how often particular features are used.

Limited connection metadata

Connection timestamps, approximate throughput, success and failure markers, and server or node load figures that are anonymised or aggregated before use. This is operational telemetry about the tunnel, not a record of what passes through it.

Advertising and attribution data, where applicable

Advertising identifiers (AAID or IDFA), coarse location inferred from IP address at country, region or city level, install, open and version events, ad impressions and clicks, anti-fraud signals, frequency-capping markers and your recorded consent preferences.

Optional location information

Precise location is not required for the service to function and is off by default. It is used only where a specific feature needs it and only after you grant that permission separately. Declining it does not disable the VPN.

Public-source data

Some features display content or metadata drawn from openly published internet sources –public GitHub repositories, open-source directories and free resource sites. Such material is used for display and search only, carries a link back to its origin, and is handled in accordance with the applicable licence and the publishing site's terms.

No-activity-log commitment

This is the core undertaking of the service, and it is stated without qualification.

We do not record the content of your communications.

We do not record which domains or URLs you visit, which applications you use, the detail of your DNS queries, your browsing history, anything you download or upload, your messages, your calls, or the contents of any session. None of it is written to disk, retained for later inspection, profiled, or made available for sale.

What we do process is the minimum anonymised or aggregated connection and diagnostic metadata genuinely needed to keep service quality acceptable, to prevent abuse and to maintain security. That data is held only for as long as it serves those purposes, and in no case longer than the retention ceiling for its type –zero, seven or thirty days depending on the category –after which it is deleted or irreversibly anonymised.

Some nodes run on infrastructure operated by cloud providers or by partners we have reviewed. Traffic across those nodes is carried inside strongly encrypted tunnels: such partners can see encrypted traffic and the operational metadata needed to run the machine, and nothing further.

How we use information

Each purpose below stands on its own legal footing; we do not collect for one reason and quietly repurpose for another.

• Providing and maintaining the service –authenticating clients, allocating capacity, routing connections and shipping updates.
• Security and anti-abuse –detecting fraud, credential abuse, automated attacks and conduct that degrades the network for other users.
• Support and communication –answering enquiries and following up on reported faults.
• Legal and compliance obligations –meeting requirements that apply to us, and responding to lawful demands.
• Product improvement and statistics –understanding in aggregate which features are used and where the service underperforms.
• Advertising delivery and measurement, where advertising applies to your build of the application.

For users covered by the GDPR or UK GDPR, the legal bases we rely on are: performance of our contract with you, our legitimate interests in operating and securing the service, compliance with legal obligations, and your consent where consent is the appropriate basis. Where we rely on consent you may withdraw it at any time, and withdrawal does not affect processing already carried out.

Cookies and local storage

The application and associated web properties use cookies, SDK caches and local storage to hold login state, support risk-control and security verification, and remember your preferences between sessions.

You can inspect, manage or clear this storage through your browser or device settings at any time. Doing so is your right, but be aware that clearing items which hold session or verification state will log you out and may stop some features working until they are re-established.

How information is shared

We do not sell personal information.

We share only what a given recipient needs in order to perform a function for us, and only under contract. Those categories are:

• Service providers and processors –cloud hosting, content delivery, monitoring, support ticketing, email delivery, advertising and attribution, logging and analytics.
• Legal disclosure –where we are compelled by valid legal process, or where disclosure is necessary to protect rights, safety or the integrity of the service.
• Corporate transactions –in a merger, restructuring, transfer of assets or insolvency, information may pass to a successor entity, which remains bound by the commitments in this policy.

We do not hand individually identifiable data to advertisers for marketing purposes.

International transfers

Operating a global network means data may be accessed from, or transferred to, a country other than your own where that is necessary to deliver the service.

Where it happens, it happens under safeguards: standard contractual clauses, transfer impact assessments, recognised certification schemes, encryption in transit and at rest, strict access control, and minimisation so that only the data genuinely required crosses a border at all.

Data retention

We keep personal information only for as long as the purpose that justified collecting it still applies.

• Account and contract information –retained after your last use or after termination for the period that applicable accounting, tax and company law requires us to keep it, and no longer.
• Diagnostic and connection metadata –retained no longer than its category ceiling of zero, seven or thirty days.
• Dispute and compliance records –retained for the relevant statutory limitation or record-keeping period where a claim, investigation or legal obligation makes that necessary.

Once the applicable period expires, data is deleted or irreversibly anonymised so that it can no longer be associated with you.

Your rights and choices

Subject to the law that applies to you, you may:

• Obtain confirmation of what we hold about you and receive a copy of it.
• Have inaccurate information corrected and incomplete information completed.
• Request deletion of your data.
• Withdraw consent you previously gave, without affecting processing already performed.
• Request that processing be restricted, or object to it.
• Receive your data in a portable, machine-readable form and have it transmitted onward.
• Control advertising personalisation and diagnostic reporting separately from the core service.
• Delete your account, either through the account settings in the client or by writing to support.

We will ask you to verify your identity before acting, so that nobody else can exercise your rights on your behalf. We respond within the period the applicable law allows, which is ordinarily thirty days; where a request is complex and the law permits an extension, we will tell you before the first period expires.

Protection of minors

The service is intended for adults. A minor should use it only with the knowledge and consent of a parent or guardian, and the guardian is responsible for supervising that use.

We do not knowingly collect personal information from a minor without the consent the law requires. If we discover that we have, we delete it. We do not direct personalised advertising at users we know to be minors.

Security measures

The controls we maintain include:

• TLS and comparable strong transport encryption for data in transit.
• Strong tunnel encryption for VPN traffic.
• Access control on the principle of least privilege, so staff reach only what their role requires.
• Security audits, vulnerability scanning and penetration testing.
• Backups, disaster recovery procedures, continuous monitoring and alerting.
• Written processor agreements and security assessments before a third party handles data for us.

We should be straightforward about the limit of this: no internet-facing service can be guaranteed absolutely secure. These measures reduce risk substantially; they cannot reduce it to zero, and any provider claiming otherwise is overstating.

Third-party websites and SDKs

The service links to third-party sites and embeds third-party SDKs and plugins. Once data reaches one of those parties it is governed by that party's own privacy policy, not by this one, and we encourage you to read it before relying on their service.

Depending on your build and region, the components involved may include:

• Advertising and attribution –Google AdMob, AppLovin, Adjust, AppsFlyer, UnityAds.
• Diagnostics and monitoring –Firebase Crashlytics, Sentry, Datadog.
• Push notifications –Apple Push Notification service, Firebase Cloud Messaging.
• Support systems –Freshdesk, Zendesk.
• Infrastructure –Cloudflare, AWS, Google Cloud Platform, Microsoft Azure.

Availability, geography and network restrictions

The service is not offered, promoted or operated in places where local law, policy or network rules do not permit VPN or proxy technology.

• We may restrict download, registration, activation, updates or use on the basis of IP address, application store channel or other reasonable means.
• Where an internet provider or network operator blocks or throttles VPN and proxy traffic, we cannot guarantee that the service will be available or that its quality will be acceptable.
• You are responsible for complying with the laws and network policies that apply where you are.
• Available features may differ between regions and between networks.

Regional supplementary terms

Users in the EU and the UK

You hold the full set of GDPR and UK GDPR rights, including access, rectification, erasure, restriction, objection and portability. Where a decision affecting you would be based solely on automated processing, including profiling, with legal or similarly significant effect, you have the right not to be subject to it and to request human review.

Residents of California

We do not sell personal information. Where advertising involves cross-context behavioural advertising, that activity may constitute "sharing" under the CPRA, and you may opt out of it. You may also exercise your rights to know, delete, correct and limit the use of sensitive personal information. Where applicable we honour the Global Privacy Control signal as a valid opt-out request.

Users in Brazil

Under the LGPD you may obtain confirmation that processing takes place, access your data, correct it, request anonymisation, blocking or deletion of unnecessary or non-compliant data, obtain portability, and withdraw consent.

Updates to this policy

This policy will be revised from time to time as the service changes or as the law does. Where a change is material, we will give notice through the application, a prominent notice, an in-app message or email, and we will seek your consent again where the law requires it rather than treating continued use as agreement.

Contact

For privacy questions or to exercise any of the rights described above:

• Email: [email protected]
• In the application: Settings → Contact Us

Version

• Version: V1.3.5
• Publication / update date: 2026-01-05
• Effective date: 2026-01-05