Privacy Policy
Nono VPN exists to protect your traffic, so the rule is simple: we never look at what you do inside the tunnel. To run the service, enforce device limits, fix crashes, and make the apps better, we do collect the account, device, and diagnostic data listed below — and nothing beyond it.
What we collect
- Account data — your email address, your password (stored only as a salted hash — we cannot read it), subscription plan and expiry, redemption-code records, sign-in sessions (session tokens are stored hashed; we also record the browser/app user-agent of each sign-in for account security), and the list of devices bound to your account.
- Device & app data — platform (iOS / Android / Windows / macOS), device model, OS version, app version, system language, CPU architecture, and a hashed device identifier derived from a platform-provided ID. We never see the raw hardware identifier. Used for per-account device limits, compatibility decisions, and tying diagnostics to a device class.
- Connection diagnostics — when the app connects, fails to connect, or disconnects: event type, timestamp, the node you selected, protocol, error codes and error messages, connection duration, latency measurements, the network type and carrier category at the time (Wi-Fi, cellular or wired, and whether it is a hotspot or in Low Data Mode; never the network name, router address or IP address), and, when a connection fails, the results of reachability probes the app runs against our own servers, public DNS resolvers (1.1.1.1, 8.8.8.8) and public connectivity endpoints — only success/failure and timing. This is how we find broken nodes, routes and interfered networks. It never includes what you access through the tunnel.
- Route measurements — to pick the best server and protocol for you automatically, the app measures our own servers: while disconnected it periodically checks which of our servers and protocols are reachable from your network and how long they take to answer; while connected it occasionally sends small requests through the tunnel to public connectivity endpoints (such as captive.apple.com, cp.cloudflare.com and www.gstatic.com) and downloads up to about 1 MB of test data from speed.cloudflare.com to measure response time, throughput, packet loss and jitter. What we receive is the result per server and protocol: reachable or not, timing, speed and loss figures, the network type and carrier category, and your app version. These reports never contain the network name, your IP address, or anything you access through the tunnel. We keep the test download as small as we can, and it never runs in Low Power Mode or Low Data Mode. You can switch the route measurements and their reports off at any time in Settings › Advanced › Help map routes; the app then stops its periodic measurements and no longer reports them. If a connection seems stuck, the app may still run a quick test to decide whether to switch routes, and we receive the result only if Share diagnostics is on.
- Server health counters — our servers keep per-minute aggregate counts of arriving connection attempts, completed connections and packet drops. These are plain numbers with no user identifier or address, and cannot be linked to your account.
- Usage analytics — app-lifecycle and feature-usage events (app launched, screen opened, update installed, and similar), together with the device and app attributes above and related diagnostic attributes. This tells us which features matter and where the apps fail in practice. These diagnostic and analytics events are stored with your app version and are retained with those events for up to 24 months (see Retention).
- Crash reports — when an app crashes: stack trace, app version, and device state at the moment of the crash, delivered through Sentry.
- Traffic totals — the number of bytes your account transfers (counted per account and per server you connect through), used for fair-use quotas, capacity planning, and abuse prevention. Byte counts only — never contents, never the destinations you visit. Which server you used is not where you went. On the free tier, the app also reports its own byte count for the same traffic, as measured on your device, so we can cross-check it against ours. This stops when you turn off Share diagnostics.
- Payment metadata — from our payment partners we receive transaction status, amount, and the plan purchased. Card and bank details never touch our servers.
- Operational server logs — like every internet service, our API servers keep standard short-lived logs (which include IP addresses) for security and troubleshooting. They rotate away automatically within weeks.
- Support conversations — the messages you send us in the in-app support chat (or by email), and any screenshots, screen recordings or files you choose to attach to them. Attachments are stored encrypted on our server and are only used to help with your request.
- Country you connect from — each time your device connects to one of our VPN servers, that server checks whether the IP address you are connecting from is registered in China, Russia or Iran, using the public address lists published by the regional internet registries. No other country is checked. If there is a match, the server saves only two things to your account: the two-letter country code (CN, RU or IR) and the time. It does not store your IP address, and the address never leaves that server. The app uses the code only to choose which country's sites and services you reach directly rather than through the VPN. Even then, it falls back on the code only when none of these is available: the region you picked under Settings › I am in, the country our server reports for your IP address when the VPN is off, or your device's time zone. If several devices use the same account, the most recent connection from any of them sets the code for all of them. This happens on our VPN servers, so the Share diagnostics switch does not turn it off. The code is deleted 30 days after it was last recorded, or immediately when you delete your account.
Diagnostics, analytics, and crash reporting are on by default and can be turned off at any time in Settings › Advanced › Share diagnostics. Turning them off stops all of it immediately — nothing about your usage leaves the device after that, and every app feature keeps working. If we materially expand what we collect, we will say so here and in the app's release notes before the new collection starts.
What we never collect
- Websites you visit or apps you use through the tunnel
- DNS queries
- Traffic contents — no inspection, no DPI, in any form
- Logs that could link a session to a destination
- Device location — the apps never request location permission
- Contacts, photos, or messages — the apps never request those permissions and never read your photo library; the only images or files we receive are the ones you pick and attach to a support message yourself
Why we collect it
- Delivering the service: authentication, subscriptions, device limits
- Reliability: finding failing nodes, routes, and protocols before you report them
- Stability: diagnosing and fixing crashes and errors
- Product improvement: understanding which features are used and where users get stuck
- Fair use: quotas and abuse prevention
- Security and compliance with applicable law
Data retention
| Data | Kept for |
|---|---|
| Account data | Life of the account |
| Diagnostics, analytics & crash reports | Up to 24 months |
| Traffic totals | Up to 24 months |
| Operational server logs | Weeks (auto-rotated) |
| Support conversations & attachments | 180 days after the conversation is marked resolved, or immediately when you delete your account. An attachment you upload but never send is removed within 2 hours. |
| Country you connect from | 30 days after it was last recorded, or immediately when you delete your account |
| After account deletion | Purged; backups age out ≤ 90 days. One irreversible hash of the email address is kept to prevent abuse of the deletion flow. It cannot be turned back into your address and is not used to contact you. |
Third parties
We use the following providers to operate. None of them can see your tunnel contents:
- Sentry — crash-report aggregation. Receives stack traces and the device/app attributes above.
- Email delivery provider — sends transactional email such as password-reset messages. Receives the recipient address and the message body. We send no marketing email.
- Cloudflare — network edge in front of our API and some connection modes. Sees encrypted bytes in transit, like any carrier.
- Payment processors — hold your card or payment details; we never receive them.
- Cloud hosting providers — run the servers the service operates on.
- Offsite backup storage — holds encrypted copies of our database. Backups are encrypted on our side before they leave our servers, so the storage providers hold only ciphertext they cannot read.
We do not sell personal data, and we do not share it with advertisers.
We do not sell, use, or disclose to third parties any data collected through this app or service for any purpose unrelated to providing the service itself. The providers listed above act solely as our data processors under contract: they process data only on our instructions, only to the extent needed to operate the service, and are not permitted to use it for their own purposes.
No tracking, no selling, no disclosure. We do not track you across other apps or websites, and we do not integrate any third-party advertising SDK. The hashed device identifier used for the device limit serves only this app's own device management and abuse prevention — it is never used for cross-app advertising attribution or identity-graph building, and it is never shared with data brokers.
Install attribution (Apple Ads). To measure whether our own ads on the App Store actually work, the iOS app asks Apple's built-in AdServices framework for an attribution token on first launch (after you accept this policy) and sends it to our server, which exchanges it with Apple for coarse campaign data — e.g. which ad campaign or keyword led to the install, and the storefront country. Alongside the token the app sends a random install identifier that it generates itself and keeps in the device keychain; it exists only to match this one report to your account and is not derived from your device or any Apple identifier. This mechanism is Apple's own, involves no third-party SDK, does not use the advertising identifier (IDFA), does not require or trigger the “Ask App Not to Track” prompt, and tells us nothing about your browsing. We store the result alongside your account solely to evaluate our advertising spend; we never share it, and it is deleted with your account.
A note on “the node you selected.” The connection diagnostics above record which Nono VPN server you connected through (the tunnel entrance). They do not record the destinations you visit inside the tunnel. We do not log, and cannot reconstruct, a link between a session and the sites or services you reached through it.
Your rights
- Request an export of the data we hold about you
- Request correction or deletion of your account and its data — we act within 30 days
- Turn diagnostics off at any time in Settings › Advanced › Share diagnostics — it takes effect immediately. You can also write to us and we will purge your diagnostic records
Children
Nono VPN is not directed at children under 16, and we do not knowingly collect their data.
Changes to this policy
If we materially change this policy, we will update this page and notify active subscribers by email before any new collection starts.
Contact
Questions, export or deletion requests: [email protected]