Privacy Policy

Last updated: October 4, 2026

Secure Paid VPN is operated by RNS STAR LLC ("we", "us", "our"), a limited liability company registered in the State of New York, United States, with registered office at 99 Wall Street #112, New York, NY 10005, USA.

This policy covers our website, our iOS app (listed on the App Store as VPN Guard – Fast Secure Proxy), our Android app, our desktop apps for macOS, Windows and Linux, our browser extension, and the VPN service behind them. It explains what we collect, why, how long we keep it, who else receives it, and how you control it.

In short

We never record the websites you visit, your DNS lookups, or anything you send or receive through the VPN.
Our VPN servers keep no record of your connections.
To run the service we keep a small amount of account, device and connection data. Each item is listed below with how long we keep it.
We never sell your data.
The iOS app shares nothing with advertising companies. App statistics go to Google only if you switch them on.

Our commitment about your VPN use

We do not sell, use, or disclose to third parties any data about your use of the VPN, for any purpose. That covers the websites and services you reach through it, your DNS lookups, your traffic and our connection records. The only exception is a disclosure the law requires of us, described under Requests from authorities. The other parties that receive any data from us are the service providers listed under Who else receives data, for the purposes listed there.

What we never collect

The websites, apps or IP addresses you connect to through the VPN
Your DNS lookups
The content of your traffic
How much data you use per website or per session

What our VPN servers keep

Our VPN servers (WireGuard, IKEv2, OpenVPN, and the HTTPS proxy used by the browser extension) are configured not to write connection logs. They keep no record of your IP address, when you connected, how long you stayed, or which sites you reached.

While you are connected, a server holds what it needs to route your traffic in memory, including your IP address, and keeps a list of current connections that it overwrites every minute. We use that list to spread users across our servers. Once you disconnect, your connection drops off the list within a minute, and no record of it remains on the server.

What we collect, why, and how long we keep it

Only what we need to run the service, prevent abuse and handle payments:

Device details — a random ID the app creates for your device, its platform (iOS, Android, desktop or browser), the app version, your device's VPN keys, and when it last used the VPN. Used to run your free plan or subscription, apply the device limit and deliver VPN settings. Kept while your account exists.
Sign-up IP address and country — recorded when a device or account is first created. Used to stop abuse of the free plan and payment fraud. Kept while your account exists. When you delete it we keep only the country and the first three parts of the IP address, so that deleting an account cannot reset our abuse limits.
Connection log — when you connect, or a connection fails: the time, the server, the protocol, whether it worked, any error code, the app version, and the IP address your device used to reach our servers. Used only to find and fix connection problems. Deleted automatically after 30 days.
Free-plan usage — the minutes you used each day, the server, the temporary VPN credentials for that session and the first three parts of your IP address. Used to apply the daily limit. Deleted automatically after 14 days.
App and system events — a few moments in the app, such as a rating prompt shown or a checkout opened, and error reports; these can include your IP address. Used to fix problems and improve the app. Deleted automatically after 30 days.
Live status — while the app is open: whether the VPN is on, the platform and the app version, so our support team can see what you see when you ask for help. Not stored after the app closes.
Purchases — your App Store, Google Play or Stripe receipt and transaction IDs, the plan, its price and dates. Used to unlock Premium, restore it on new devices, and handle renewals and refunds. Kept while your account exists; subscription history is kept for up to seven years after deletion for tax and accounting. We never see or store your full card number.
Account (optional in the mobile apps) — your name, email address, a salted hash of your password, and your email preferences. Used to sign you in on other devices, send service emails and reset your password. Kept until you delete your account.
Support messages — what you send us through the in-app chat, the support form or email. Used to help you. Kept as support history.
Website visits from search engines and AI assistants — the referring site, the page visited and the browser type, not linked to you. Used to see how people find us. Deleted after 400 days.
Server access logs — like almost every website, our web servers record each request: the IP address, the time, the page or API address requested, and the browser or app version. Used for security and troubleshooting. Rotated and deleted automatically.

App statistics and advertising

iOS app

The iOS app sends nothing to Meta (Facebook) or any advertising network, and our servers do not report iOS sign-ups or purchases to any advertising company.

The first screen of the app, and Settings → Your data, have an optional switch, Share app usage statistics. It is off unless you turn it on. When it is on, Google Firebase Analytics receives app usage events (such as app opened, screen viewed and purchase completed), an identifier for the app install, your device model, iOS version, app version, language, and an approximate location derived from your IP address. iOS then also asks for App Tracking Transparency permission; only if you allow it can Google use your device's advertising identifier to measure our Google ads. Turn the switch off at any time and collection stops.

Android app

The Android app has a similar switch, Share app usage and ad measurement, on the first screen and in Settings → Your data. It is on unless you turn it off. While it is on:

Google Firebase Analytics receives the data described for iOS above;
the Meta (Facebook) SDK receives app events (such as install, app opened and purchase completed), Meta's identifier for the install, your device information and your advertising ID;
our server reports your in-app sign-up and purchases to Meta with a hashed email address and account ID, your IP address and device details, so we can measure our ads.

While it is off, the app sends nothing to Google or Meta, and our server reports nothing about your app activity to Meta.

Website

Our website uses the Meta Pixel and the Google Ads tag to measure our advertising. They set cookies (such as _fbp and Google's ad cookies) and report page views, sign-ups, checkouts and purchases to Meta and Google. Our server also reports website sign-ups and purchases to Meta, with a hashed email address, your IP address and browser details, so that each one is counted once. You can block these cookies in your browser settings or with a content blocker; the site works without them.

Desktop apps and browser extension

They contain no analytics or advertising code.

Older app versions

iOS and Android app versions 1.0.10 and earlier start Google Firebase Analytics and the Meta SDK when the app opens, without the switch. Update the app to choose. Since October 4, 2026 our server no longer accepts or stores Meta identifiers from any iOS version.

Apple — processes App Store purchases.
Google — processes Google Play purchases; receives app statistics if you switch them on (Firebase Analytics) and website advertising measurement (Google Ads tag).
Stripe — processes card payments on our website and, where offered, in the Android app.
Meta — receives Android app events and purchase reports only while the Android sharing switch is on, and website measurement as described above. Never anything from the iOS app.
Hosting providers — the data centers that run our servers (such as OVH). They operate the machines; their terms do not let them use the data on them.

Emails are sent from mail servers we run ourselves. We share data with these providers only for the purposes listed, and each one processes it under terms that require it to protect the data at least as well as this policy describes. We never sell, rent or trade user data.

Your choices

Consent in the app — before the app sends anything to our servers, it shows what it collects and asks you to agree. Until you do, it only checks whether it needs an update.
App statistics — turn the sharing switch on or off at any time in Settings → Your data. On iOS you can also deny tracking in iOS Settings → Privacy & Security → Tracking.
Marketing emails — every marketing email has an unsubscribe link.
Delete your data — delete your account in the app or on the website, or ask us (see below).
Access, correct or export your data — email privacy@securepaidvpn.com. We reply within 30 days.

Deleting your account

In the mobile apps — Settings → Delete Account. It takes effect immediately.
On the website — sign in and open your Profile page.
By email — write from your account's email address to privacy@securepaidvpn.com.

We then cancel any active website subscription, mark your subscriptions inactive, delete your devices, VPN keys and free-plan records, remove your name and email from your support tickets, and erase your name, email, password, sign-up IP address and any Meta identifiers from your account record. We keep your subscription history for up to seven years for tax and accounting, and the country and first three parts of your sign-up IP address to protect the free plan from abuse. Connection logs and app events about you are deleted on their normal schedule, within 30 days.

Deleting your account does not cancel an App Store or Google Play subscription. Cancel it in your store account.

Requests from authorities

We disclose data only when the law requires it, and only what we hold: account details, purchase records, the sign-up IP address and country, the 30-day connection log and support messages. We cannot provide the websites you visited or your traffic, because we never have them. Where we are allowed to, we tell you about a request before we answer it.

Security

Your connection is encrypted between your device and our servers. We store passwords only as salted hashes, protect keys and credentials with strong cryptography, and restrict access to personal data to the people who need it to run the service, who are bound by confidentiality. Please do not share your password with anyone.

Age

The service is intended for adults aged 18 and over. If you believe a child has given us information, tell us and we will delete it.

Where your data is stored

Our account servers are in the European Union (Poland). Our VPN servers are in the United States, the United Kingdom, France, Germany, Singapore and Australia. Wherever your data is, it is protected as this policy describes.

We process your data on these legal bases:

Contract — to provide the service and subscriptions you ask for.
Legitimate interests — to keep the service secure, fix connection problems, prevent abuse and fraud, and measure our website advertising.
Consent — app statistics and ad measurement in the apps (the sharing switch). You can withdraw it at any time.
Legal obligation — tax and accounting records.

You can ask to access, correct, delete or export your data, or object to how we use it, by emailing privacy@securepaidvpn.com. You can also complain to your data protection authority.

Browser extension

The Secure Paid VPN browser extension for Chrome, Firefox and Edge is a thin client for the same VPN service the apps use. When you click Connect, the extension routes your browser's traffic through a TLS-encrypted HTTPS proxy on the server you select. Your operating-system network settings and other applications are not affected.

What the extension stores on your device

Your sign-in token — kept in browser storage scoped to the extension, removed when you sign out or remove the extension.
Your email address and display name — fetched from /api/auth/me after sign-in and cached so the popup can show who is signed in. Removed on sign-out.
A randomly generated per-install device ID (e.g. ext-<uuid>) — used to apply the device limit. It is not linked to your hardware, IP address or any browser fingerprint.
Your selected server, last connection state and settings (such as notifications on or off) — stored only on your device.

What the extension does not read or send

The URLs you visit — the extension never sees them; the browser routes proxy traffic internally.
Page content, form data or browsing history.
Tabs, bookmarks, downloads, or anything else beyond the extension popup itself.

What the proxy servers log

The HTTPS proxy on our servers runs with request logging switched off. It records no connection times, source IP addresses, websites or data volumes. Its own error log (startup, shutdown, configuration errors) contains no user information.

The proxy uses the same per-account credentials as the app's VPN connections. They travel only inside the encrypted browser-to-proxy connection.

Permissions the extension requests

proxy — to send browser traffic through the server you choose.
webRequest + webRequestAuthProvider (Chrome) / webRequestBlocking (Firefox) — to answer the proxy's sign-in challenge with your credentials, without a prompt.
storage — for the sign-in token, settings and the items listed above.
alarms — to re-check your subscription every 15 minutes; the proxy is switched off automatically if a subscription expires mid-session.
notifications — optional connect / disconnect notices (a toggle in Settings turns them off).
<all_urls> host permission — required because the proxy applies to every site you choose to visit.

The extension contains no analytics code, loads no remote code, and sends nothing beyond the periodic check to /api/auth/me that confirms an active subscription.

Changes to this policy

When we change this policy we update the date at the top. For material changes we also tell you in the app or by email before they take effect.

October 4, 2026: rewritten to list everything we collect and how long we keep it; added the consent screen and the sharing switch to the apps; the iOS app stopped sharing data with Meta. While preparing this update we found that system logs on our VPN servers had been recording the IP addresses and times of IKEv2 and OpenVPN connections, and that the browser-extension proxy had been recording the names of websites requested through it, which our previous policy said did not happen. We switched those logs off and deleted them on October 4, 2026.

Contact

Privacy questions and requests: privacy@securepaidvpn.com. RNS STAR LLC, 99 Wall Street #112, New York, NY 10005, USA.