1. Who runs FreeVPN
FreeVPN is an independent project by an individual developer. It provides 200 MB of free daily VPN traffic without any signup, account, email, or phone number. Users can optionally watch a rewarded video ad to add up to 300 MB more on the same day. Throughout this policy, "we" / "our" / "FreeVPN" refers to that developer.
2. What we collect
FreeVPN was designed so that we know as little about you as we can while still being able to enforce the daily quota and credit the rewarded-ad bonus. The complete list of information we receive or generate is:
- An anonymous device identifier. The first time you open the app, your device computes a 32-character hexadecimal hash from Android's
SSAID and a UUID generated locally at install time. This hash, and only this hash, is sent to our server. It does not contain your phone number, IMEI, hardware serial, name, email, or any account ID. Reinstalling the app generates a new hash; the previous one becomes orphaned.
- Daily traffic byte counters. The VPN node measures how many bytes of upload + download you send in a UTC calendar day, and our server stores that running total against your anonymous device ID. We do not record what websites, apps, domains, or IP addresses you visit; we only count bytes.
- Session timestamps. When you tap "Connect", our server records when the session started, when it stopped, and which node was used. This is retained for abuse analysis (for example, detecting one device opening hundreds of sessions per minute).
- Rewarded-ad credit records. When you finish watching a rewarded ad, Google's AdMob server signs and sends a verification callback to our server. We store the AdMob transaction ID, your anonymous device hash, the UTC date, and the bytes credited (currently 50 MB per view, capped at 300 MB per day) so the bonus can be applied. We do not store anything else AdMob sends.
- Network metadata at connection time. When the app contacts our API, our infrastructure (Cloudflare) sees your device's public IP address, your User-Agent, and the country your IP geolocates to, in the same way every web server does. We do not store these against your device ID; they exist only in Cloudflare's standard request logs and are subject to Cloudflare's retention.
3. Advertising (Google AdMob)
FreeVPN shows an optional rewarded video ad via Google AdMob. The ad is only displayed if you tap the "Watch ad" button — there is no banner, no interstitial, and no ad while the VPN is actively running.
When the AdMob SDK is initialized and serves an ad, Google (acting as an independent controller) automatically processes:
- The Android Advertising ID (AAID), unless you have opted out of personalized ads in Android system settings.
- Coarse, IP-derived location and approximate device type, for frequency capping and fraud prevention.
- The ad unit ID, app package name, and basic SDK telemetry.
Google processes this data under its own privacy policy and Families/Ads policies; we do not receive the AAID and never link it to the anonymous device hash described in section 2. See Google's Privacy Policy and the AdMob "How Google uses information" page for details.
You can reset or opt out of personalized advertising at any time via Android Settings → Google → Ads. Opting out does not stop ads from being available; it only stops them from being personalized.
4. What we do not collect
- No account information — there is no signup screen.
- No email address, phone number, name, date of birth, or government identifier.
- No browsing history, no DNS queries, no per-URL or per-domain logs. The VPN node measures only total bytes per device per day; the contents of the tunnel are not inspected, parsed, or stored.
- No precise location and no GPS access.
- No third-party analytics SDK, no crash reporting service, no behavioural-profile tracking SDK beyond the AdMob SDK described in section 3.
- No access to contacts, calendar, photos, microphone, or camera.
5. How long we keep things
- Daily byte counter (the value compared against the 200 MB base + bonus cap): expires automatically 48 hours after the day it represents, then is permanently deleted.
- Session timestamps: retained for up to 90 days for abuse analysis, then deleted.
- Rewarded-ad credit records: retained for up to 90 days for cap enforcement and abuse analysis, then deleted.
- Cloudflare request logs: governed by Cloudflare's retention; we do not export them.
- Data held by Google AdMob: governed by Google's retention policies and is outside our control.
6. Where the data lives
FreeVPN runs on four pieces of infrastructure:
- The Android app on your device.
- An API hosted on Cloudflare Workers, with state stored in Cloudflare KV and Cloudflare D1. Cloudflare acts as a data processor; their privacy policy applies to traffic terminated at their edge.
- A VPN exit node hosted on a third-party cloud provider. The node terminates the tunnel and forwards your traffic to the open internet.
- Google AdMob, only when the rewarded video ad is requested or played, as an independent advertising controller.
7. Third-party recipients
We do not sell, rent, or share your information with data brokers or analytics companies. The third parties that touch your data are:
- Cloudflare — runs the API and the underlying KV / D1 storage.
- The cloud provider hosting the VPN node — by virtue of forwarding network packets through their infrastructure, they see the same connection metadata (source/destination IP) any internet provider would see.
- Google AdMob — only invoked when you choose to watch a rewarded ad; data flow scoped to section 3.
8. Your rights and how to exercise them
- Erasure. Because we have no account or email tied to you, the simplest way to "delete" yourself is to uninstall the app — your daily byte counter then ages out naturally within 48 hours and the session log within 90 days. If you want immediate deletion of records linked to a specific device hash, email us (see Contact) with the hash from the app's About screen.
- Access / portability. Email us with your device hash and we will send you a copy of every record we hold against it.
- Objection. If you do not agree to this policy, do not use FreeVPN. Uninstalling the app will stop any further data from being sent. To stop personalized ads while continuing to use the app, reset or opt out of your Android Advertising ID via system settings.
9. Children
FreeVPN is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has used the service and you would like the corresponding device record erased, contact us.
10. Security
Communication between the app and our API is over HTTPS. The VPN tunnel itself is VLESS over Reality with XTLS-Vision, which is end-to-end encrypted. The signing keystore for the Android app is stored offline; node credentials are kept on the server side and never embedded in the APK. AdMob server-side reward verification callbacks are cryptographically signed by Google with ECDSA-P256 and validated on our server before any quota bonus is credited.
11. Changes to this policy
If we change what we collect, retain, or share, we will update the "Effective date" at the top of this page and post a short summary of what changed below. Material changes that affect existing users will also be surfaced in-app the next time you open it.
Questions, deletion requests, or security reports: freevpn-privacy@example.com.
1. 谁在运营 FreeVPN
FreeVPN 是一名独立开发者运营的项目。它每天提供 200MB 免费 VPN 流量，不需要任何注册、账号、邮箱或手机号。用户可以选择性观看一段奖励视频广告，在同一天内最多再追加 300MB。本隐私政策中"我们"指的就是这名开发者。
2. 我们收集什么
FreeVPN 在设计上尽可能少地知道你的信息，仅保留执行每日上限和发放奖励额度所需的最小数据。完整列表如下：
- 匿名设备标识。首次打开 App 时，设备会用 Android 的
SSAID 与一个安装时本地生成的 UUID 拼接后做 SHA-256，得到一段 32 位的十六进制哈希值。仅这段哈希会被发送到服务端。它不包含手机号、IMEI、硬件序列号、姓名、邮箱或任何账号 ID。重装 App 会生成新哈希，旧哈希自然失效。
- 每日流量字节计数。VPN 节点会统计你在一个 UTC 日历日内的上下行总字节数，服务端按设备哈希累加这个数字。我们不记录你访问了什么网站、应用、域名或 IP，只是计字节。
- 会话时间戳。每次点击「连接」时，服务端会记录开始时间、结束时间和使用的节点，用于反滥用分析（例如检测同一台设备在一分钟内开了几百个会话）。
- 奖励广告兑换记录。当你看完一段奖励视频后，Google AdMob 服务端会向我们的服务端发送一条签名校验回调。我们仅保存 AdMob 的 transaction ID、你的匿名设备哈希、UTC 日期，以及兑换字节数（当前每段 50MB，每日上限 300MB），用于发放和封顶。其它 AdMob 字段不入库。
- 连接时的网络元数据。App 与我们 API 通信时，基础设施（Cloudflare）会看到设备的公网 IP、User-Agent 以及 IP 所在国家——任何 Web 服务器都会看到这些。我们不会把这些信息绑定到设备哈希存储；它们仅存在于 Cloudflare 的标准请求日志中，受 Cloudflare 的保留策略约束。
3. 广告（Google AdMob）
FreeVPN 通过 Google AdMob 展示可选的奖励视频广告。只有当你主动点击「看广告」按钮时才会播放——没有横幅广告、没有插屏广告，VPN 正在运行时也不会插播广告。
AdMob SDK 在初始化和投放广告时，Google（作为独立的数据控制者）会自动处理以下数据：
- Android 广告 ID（AAID），除非你已在系统设置中关闭个性化广告。
- 由 IP 推断的粗略位置和大致设备类型，用于频次控制和反欺诈。
- 广告位 ID、应用包名以及基础 SDK 遥测数据。
这些数据由 Google 按其隐私政策与 AdMob 广告政策处理；我们不会收到 AAID，也不会把它与第 2 节描述的匿名设备哈希做任何关联。详情见 Google 隐私政策 和 AdMob「Google 如何使用您的信息」。
你可以随时在 Android 设置 → Google → 广告 中重置或关闭个性化广告。关闭后广告依然会出现，但不再是个性化的。
4. 我们不收集什么
- 不收集账号信息——根本没有注册流程。
- 不收集邮箱、电话、姓名、出生日期、身份证号。
- 不记录浏览历史、不记录 DNS 查询、不做任何按 URL 或按域名的日志。VPN 节点只计每日每设备的总字节，隧道内部内容既不被解析、也不被存储。
- 不收集精确定位，不申请 GPS 权限。
- 除第 3 节列出的 AdMob SDK 之外，不集成任何第三方分析 SDK、崩溃上报服务或行为画像 SDK。
- 不读取通讯录、日历、照片、麦克风、摄像头。
5. 数据保留时长
- 每日字节计数（用于和 200MB 基础 + bonus 上限比较的那个数字）：对应日期过去 48 小时后自动过期并永久删除。
- 会话时间戳：最多保留 90 天，用于反滥用分析，之后删除。
- 奖励广告兑换记录：最多保留 90 天，用于上限校验和反滥用分析，之后删除。
- Cloudflare 请求日志：由 Cloudflare 自身保留策略决定，我们不会导出。
- Google AdMob 保留的数据：由 Google 自身保留策略决定，超出我们的控制范围。
6. 数据存放位置
FreeVPN 由四部分基础设施组成：
- 你设备上运行的 Android App。
- 部署在 Cloudflare Workers 上的 API，状态存放在 Cloudflare KV 和 Cloudflare D1。Cloudflare 在此扮演数据处理者角色，其隐私政策适用于其边缘节点接收到的请求。
- 托管在第三方云服务商的 VPN 出口节点。节点终止隧道并把流量转发到公共互联网。
- Google AdMob：仅在请求或播放奖励视频时被调用，作为独立的广告控制者。
7. 第三方接收方
我们不会把你的信息出售、出租或分享给数据经纪人或分析公司。接触你数据的第三方是：
- Cloudflare：承载 API 和后端 KV / D1 存储。
- 承载 VPN 节点的云服务商：因为流量经其网络转发，他们能看到与任何 ISP 类似的连接元数据（源/目的 IP）。
- Google AdMob：仅在你主动选择看广告时调用；数据流见第 3 节。
8. 你的权利及行使方式
- 删除。因为没有账号、没有邮箱与你绑定，最简单的"删除我自己"的做法就是卸载 App——每日字节计数会在 48 小时内自然过期，会话日志会在 90 天内删除。如果你需要立刻删除某个设备哈希对应的全部记录，请把 App 的"关于"页中的哈希发邮件给我们（见联系方式）。
- 访问 / 数据可携。把你的设备哈希发邮件给我们，我们会把所有与该哈希相关的记录发给你。
- 反对。如果你不同意本政策，请不要使用 FreeVPN。卸载 App 即可阻止后续数据继续上送。如果你只想在使用 App 的同时关闭个性化广告，可在 Android 系统设置中重置或停用广告 ID。
9. 儿童
FreeVPN 不面向 13 岁以下儿童。我们不会有意收集儿童数据。如果你认为有儿童使用了本服务并希望删除对应的设备记录，请联系我们。
10. 安全
App 与服务端 API 之间的通信走 HTTPS。VPN 隧道本身使用 VLESS over Reality + XTLS-Vision，端到端加密。Android 上传 keystore 离线保管；节点凭据只存在于服务端，不打包进 APK。AdMob 服务端奖励校验回调由 Google 用 ECDSA-P256 签名，我们的服务端验签通过后才会发放 bonus 额度。
11. 政策变更
如果我们调整收集、保留或共享数据的方式，会更新页面顶部的"生效日期"，并在下方简要说明改动。涉及现有用户的实质性变更也会在你下次打开 App 时通过应用内提示展示。
问题、删除请求或安全报告：freevpn-privacy@example.com。