Privacy Policy

1. Information We Collect

Veilora VPN operates a no-logs policy for your traffic. We do not collect, store, or share:

• Your browsing history or DNS queries
• A history of your connections, or the duration of any session
• Traffic data or bandwidth usage per session
• The IP address assigned to you by the VPN

We would rather be precise than absolute, so here is everything we do hold:

• Your email address — for account creation and sign-in. Accounts created through our Telegram bot have no email; for those we store your Telegram account ID, username and language instead.
• Subscription status (free, active, expired) and, if you have one, the plan and its expiry date.
• Total traffic used this month — a single running number, needed to enforce the free plan's limit. Not a history, and not tied to what you did.
• The time you last connected. Our server panel keeps one timestamp per account, overwritten each time you connect. It is a single value, not a log: it cannot show when you connected before, for how long, or to what. We use it to tell whether an account has ever been set up successfully, and to stop sending setup reminders to people who clearly no longer need them.
• Your country at sign-up, and a one-way scrambled fingerprint of the IP address you signed up from. The IP itself is not written to our database — it is used at that moment to work out the country (so we can route you to a working server) and to produce the fingerprint, which lets us spot people creating many accounts to farm referral rewards. It is scrambled with a secret only we hold and cannot be turned back into an address. It is briefly held in memory for rate limiting.
• A notification token, if you use the Android app, so we can send you alerts such as your data running low or your plan expiring.
• Payment records — which plan, when, through which payment method, and the amount. Card and wallet details never reach us; they stay with Google Play, Telegram or the cryptocurrency processor.
• Referral and partner relationships, if you use an invite link or join the affiliate programme.

If you use our Telegram bot, we also record which buttons you press in it (for example: opened the menu, chose a plan) against your Telegram ID, so we can see where people get stuck in setup. This concerns the bot only — never your VPN traffic.

The Android app also reports a small number of anonymous counters so we can see which parts of the app people actually use — for example, how many times the subscription screen was opened, and from which button. These are sent to our own servers and stored only as totals: there is no user identifier, no device identifier, no advertising ID, and no record of an individual person's actions. We use no third-party analytics service in the app, and this data is never shared or sold. It says nothing about your VPN usage — the no-logs policy above is unaffected.

2. How We Use Information

The limited data we collect is used solely to:

• Authenticate your account and provide VPN access
• Enforce the free plan's monthly traffic limit
• Process subscription payments through Google Play, Telegram Stars, or a cryptocurrency processor
• Detect abuse of referral rewards
• Send critical service notifications (e.g., subscription expiry)

3. Data Storage and Security

Account data is stored in Google Firebase (Firestore) with encryption at rest. We use Firebase Authentication for secure login. No VPN traffic data is ever written to disk.

Our VPN servers are located in more than twenty countries, and our backend is hosted in Switzerland. Hosting location is not the same as the legal home of the operator; see the Terms of Service for the contracting entity.

4. Third-Party Services

• Google Play / RevenueCat: Purchase and subscription management for the Android app. Subject to Google's and RevenueCat's privacy policies.
• Cloudflare: CDN Mode routing and DDoS protection. Cloudflare may log connection metadata per their privacy policy.
• Firebase (Google): Authentication and database. Subject to Google's privacy policy.
• Telegram: Bot-based sign-in, VPN configuration delivery, and Telegram Stars payments. Subject to Telegram's privacy policy.
• OxaPay and CryptoBot: Cryptocurrency payment processing. They receive the payment details; we receive only the confirmation that an invoice was paid.
• Resend: Sends transactional email such as password resets and account notices.
• Sentry: Error reporting from our own servers, so we can find crashes. Configured not to send personal data.
• PostHog: Anonymous website analytics (page views, navigation patterns, which buttons are clicked). No cookies are used. Instead, a random anonymous identifier is stored in your browser's local storage so that a multi-page visit is counted once rather than as several separate visitors. It contains no personal data, is never linked to your VPN account or traffic, and is cleared when you clear your browser storage. If you arrive from a marketing link, its campaign parameters (for example utm_source) are stored the same way so we can tell which channel a visit came from. Analytics requests are proxied through veilora.net and processed by PostHog, Inc. per their privacy policy. This applies to our website only — it is unrelated to the VPN service, which remains no-logs as described above.

5. User Rights

You have the right to:

• Request deletion of your account and associated data
• Export your account data
• Opt out of non-essential communications

To delete your account, visit /delete-account or contact support.

6. Contact

Email: support@veilora.net Telegram
Telegram: @veilora_support

7. Changes to This Policy

We may update this Privacy Policy periodically. Significant changes will be communicated via email or in-app notification. Continued use of the service after changes constitutes acceptance of the updated policy.