Privacy Policy

Version of 8 October 2026

Who processes the data

The ipk VPN service is operated by I-PLUS KYIV LLC, 11 Starytskoho St., Yahotyn, 07701, Ukraine. Questions about your data and deletion requests: support@ipk.one.

What data we collect

• Email address — to send you the access code and contact you about the service.
• Access code — for sign-in we check its irreversible fingerprint (hash). The code itself is stored encrypted with a key that exists only on our server and is not kept in the database: this lets you see your code in your account, and lets the administrator tell you the code if you lose it. Every such view by the administrator is logged.
• Device data: the device’s name and type (for example, “Android”), its public encryption key and the internal address assigned to it, such as 10.7.0.x. The private key is created on your device and is never sent to us.
• Traffic volume: how many megabytes each device downloaded and uploaded per day through each server. Volumes only — no websites, addresses or content. We need it for plan limits, server load planning and abuse prevention. When the free monthly limit is used up, the server slows the connection down by its current IP address — the address is used only at that moment and is not recorded.
• Sign-in records: the time, the IP address the sign-in came from, and the browser or app identification string. We need them to protect your account and investigate abuse.
• The device’s last activity time — to see which devices are still in use.
• Problem reports — only if you send one yourself from the app (“Settings” → “Report a problem”): your text, the app version, the device’s operating system, the connection method and the connection error log. They contain no sites, addresses or traffic content. We need them to sort out the problem.
• Subscription — if you subscribe to the Unlimited plan in the app: the plan, its end date, whether it renews, the Google Play order number and the purchase token. We need them to switch the plan on and to learn about renewals and cancellations. Card details and other payment data are processed by Google and are not passed to us.
• USDT payment — if you pay in your account on the website: the period, the amount, the sender’s wallet address and the transaction hash. This data is public on the TRON blockchain anyway; we need it to credit the payment.

What data we do not collect

• Your browsing history, destination addresses or the content of your traffic.
• DNS query logs: the resolver runs on the VPN server with logging turned off.
• VPN connection logs: WireGuard and XRay access logs are turned off.
• Payment card data: subscriptions are paid through Google Play; card numbers are not passed to us.
• Advertising identifiers and analytics: the app contains no ads and no analytics.

How the app works

The app creates a VPN connection on your device and encrypts all traffic to our server. It is decrypted only on the server and immediately continues to the internet — we neither record nor analyse it.

Retention periods

• Account and device data — for as long as the account exists.
• Subscription details — for as long as the account exists.
• Sign-in records and the internal security log — 90 days, after which they are deleted automatically.
• Problem reports — 90 days, after which they are deleted automatically.
• Daily traffic volumes — 13 months, after which they are deleted automatically.
• Records of disconnected devices are kept so that we can respond to a substantiated abuse complaint: without them it is impossible to establish which device used a particular internal address.

Who receives the data

• Hetzner Online GmbH (Germany) — we rent servers from them; the servers are located in Finland.
• EDGBL Ltd. (EDIS Global, Cyprus) — we rent servers in Lithuania and the Netherlands.
• Sendinblue SAS (Brevo, France) — sends our emails: access codes and service notifications.

These companies are data processors within the meaning of the GDPR and act only on our instructions. If you subscribe, Google handles the payment as an independent controller under its own privacy policy. The data is not shared with or sold to any other third parties.

Disclosure at the request of public authorities

We disclose data only in response to a legally binding request enforceable in Ukraine. We can only hand over what we have: your email address, device data, sign-in records for the last 90 days and daily traffic volumes. We have no history of visited websites or traffic content and cannot provide it in response to any request.

Your rights

Under the GDPR and Ukrainian personal data protection law, you may request a copy of your data, its correction or deletion. Write to support@ipk.one — we will reply within 30 days. Deleting the account also deletes all devices linked to it.

Children

The service is not intended for persons under 18.

Changes

In the event of material changes, we will notify you by email at least 14 days before the new version takes effect.