Last Updated: July 18, 2026 (revision 10)

BratVPN ("the App") provides secure, encrypted VPN connections to protect your privacy and secure your internet connection. Legal company information is available on the Imprint page.

This Privacy Policy explains what information we collect, how we use and protect it, and the choices you have regarding your data. By downloading, accessing, or using the App, you consent to the data practices described in this policy.

The App is designed with your privacy in mind. We follow a principle of minimal data collection:

• The App does not require account creation or sign-up.
• We do not collect your name or phone number. Email is optional for activation-code delivery, website checkout recovery, subscription billing receipts, and support.
• We do not log your browsing activity, connection timestamps, or the IP addresses used for VPN connections.
• We never sell or rent your data to third parties.
• Production iOS and Android builds may show one small Google Mobile Ads banner to authenticated free or short-trial users. Active subscribers, desktop platforms, Android TV, and staging builds do not show this banner. Ad requests are explicitly non-personalized, are made only after Google User Messaging Platform (UMP) reports that ads may be requested, and never use VPN traffic or browsing history. Mobile advertising identifiers are made available to AppsFlyer or Google Mobile Ads only when the relevant device permission and consent conditions permit. Optional website attribution and advertising are controlled by your website privacy choices as described in section 9.

When you use the App, you may voluntarily provide the following:

• Server preferences and saved configurations within the App.
• Support requests sent via email.
• Optional email address entered during website checkout so we can send the paid activation code, help recover the order, and allow the billing provider to send receipts or subscription-management links.

We do not collect:

• Your name, phone number, or email address unless you voluntarily provide it for website checkout, billing, or support.
• Your browsing history or DNS queries.
• Your originating IP address as part of VPN connection logs, or the IP addresses of VPN servers you connect to. Attribution, website, and support providers may receive an IP address as part of the HTTPS request needed to provide their service, as described in section 9.
• Connection timestamps or session durations.
• Your precise location or GPS data.
• Any social media or third-party account information.

To maintain and improve the App, we automatically collect certain technical information:

• Device model and type.
• Operating system version.
• App version.
• Crash logs and performance diagnostics.
• Website analytics and performance diagnostics, including page path, locale, navigation timing, Core Web Vitals, browser/device class, connection type when available, and static resource load summaries.
• General usage statistics (e.g., feature interaction frequency), collected in anonymised or aggregated form.
• Sanitised application diagnostic logs, keyed by a randomly generated install identifier stored in the device's secure storage. Bearer tokens, API keys, and similar secrets are redacted client-side before transmission.
• AppsFlyer attribution data, including an AppsFlyer-generated installation or web identifier, device and app information, campaign or referrer data, consent status, and limited App or website interaction events. On Apple devices this may include IDFV and, only after App Tracking Transparency permission is granted, IDFA. On Android this may include AAID only after advertising consent is granted.
• For eligible mobile banner displays, Google Mobile Ads and Google UMP may process consent choices and signals, the IP address needed to deliver the request, device and app information, a resettable mobile advertising identifier only where permitted, and ad-delivery or interaction data used for non-personalized ad delivery, frequency limiting, measurement, and fraud prevention.
• After website advertising consent, AppsFlyer may process the page path, campaign parameters, browser and device information, an IP address used to deliver the HTTPS request, and web identifiers or cookies. The website does not send client-side purchase, revenue, renewal, or subscription lifecycle events to AppsFlyer.

Some identifiers and technical details can be personal data. We use them only for the purposes described in this policy. The App does not access IDFA unless you grant Apple's App Tracking Transparency permission, and it does not collect AAID unless you grant advertising consent. If you deny or withdraw the relevant permission or consent, BratVPN does not make that advertising identifier available to AppsFlyer or Google Mobile Ads. If Google UMP reports that ads cannot be requested, the App does not request the mobile banner. Attribution and advertising data never includes your VPN traffic, browsing history, or DNS queries.

We use the information we collect for the following purposes:

• To provide and maintain VPN connectivity services.
• To optimize server performance and network routing.
• To maintain, improve, and optimize the App's performance and user experience.
• To manage subscription services and communicate with Apple, Google, or our website payment processor regarding billing and website orders.
• To deliver activation codes and transactional messages requested during website checkout.
• To diagnose technical issues and resolve crashes or bugs.
• To attribute App and website visits or non-purchase interactions to marketing campaigns, where you have granted the relevant consent.
• To serve one explicitly non-personalized mobile banner to eligible authenticated free or short-trial users, and to support frequency limiting, measurement, and fraud prevention, only when the applicable consent state permits an ad request.
• To serve and measure advertising on the website where permitted by applicable law and your consent choices.

We never sell or rent your data. We do not share your browsing activity, VPN traffic, or connection logs with any third party. We never use VPN traffic or connection logs for advertising. Limited App interaction and attribution data may be used for marketing measurement with your consent. Eligible users of production iOS and Android builds may see the non-personalized mobile banner described above. Website attribution and advertising are described in section 9 and controlled by the choices available to you.

When you connect to BratVPN, your internet traffic is encrypted and routed through our VPN servers. We do not inspect, log, or store your VPN traffic. The encrypted connection is maintained only for the duration of your session.

App preferences, saved server selections, and connection settings are stored locally on your device. We do not create a persistent customer account merely because you enter an email at checkout. We retain the limited order and delivery records needed to fulfil and support that purchase.

We retain your data only for as long as necessary to provide the App's services:

• VPN connection data is not logged and therefore not retained.
• App preferences persist only while they remain on your device. Uninstalling the App removes all local data.
• Crash logs and diagnostic data are retained for a limited period to support troubleshooting and are subsequently deleted.
• Website order, optional email, activation-code linkage, and transactional delivery records are retained only as long as reasonably needed to fulfil the purchase, recover the order, prevent duplicate delivery, meet legal obligations, and handle support or payment disputes.
• AppsFlyer attribution records are retained according to our AppsFlyer settings and AppsFlyer's retention practices. Its Web SDK may set first-party measurement or consent cookies for up to 395 days; the AF_SYNC cookie lasts up to one week. Browser settings may block or shorten these periods, and you can withdraw website advertising consent at any time.
• We do not maintain long-term archives of your usage data or build personal profiles based on your activity.

Payments may be processed by Apple through the App Store, Google through Google Play, or the applicable website payment processor for website checkout. We do not collect, store, or have access to your full payment details, including card numbers, bank credentials, wallet private keys, or other sensitive payment credentials.

For website checkout, the payment processor handles the payment form and payment processing. We receive only the limited information needed to fulfil the order, such as the selected tariff, order status, transaction identifier, order ID or anonymous website checkout user ID, and issued activation code. If you enter an email address at checkout, we use it to send the activation code and support order recovery. The website billing provider may also use it for receipts, subscription management, and payment recovery.

Apple, Google, and our website payment processor handle transaction processing and refund workflows according to their own policies. Please review their privacy policies to understand how your payment data is handled.

The App is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have inadvertently received data from a child under 13, we will take immediate steps to delete such data from our systems.

If you are a parent or guardian and believe your child has provided data through the App, please contact us at support@bratvpn.app so that we can take appropriate action.

We take the security of your information seriously and implement appropriate technical and organizational measures to protect it, including:

• Encrypted VPN connections.
• Encrypted data transmission between the App and our infrastructure using HTTPS/TLS encryption.
• Secure server infrastructure with restricted access controls.
• Regular security assessments, monitoring, and software updates.
• Minimal data collection practices to reduce the scope of potential exposure.

While we strive to protect your information using commercially reasonable measures, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security, but we are committed to promptly addressing any security incidents that may arise.

The App integrates with third-party services in the following categories. These providers operate under their own privacy policies and terms of service:

• Apple — App Store distribution, subscription management, payment processing, and crash reporting. See Apple's Privacy Policy.
• Google — Google Play distribution, subscription management, and payment processing. See Google's Privacy Policy.
• Google Mobile Ads and User Messaging Platform (Google) — mobile consent management and one small banner in production iOS and Android builds for authenticated free or short-trial users. Ad requests are explicitly non-personalized and are made only when Google UMP reports that ads may be requested. Google may process consent choices and signals, IP address, device and app information, a permitted IDFA or AAID, and ad-delivery or interaction data for non-personalized delivery, frequency limiting, measurement, and fraud prevention. Active subscribers, desktop platforms, Android TV, and staging builds do not show this banner. We do not provide Google Mobile Ads with VPN traffic, browsing history, or DNS queries. See Google's Privacy Policy and Google's advertising technologies.
• Google Analytics — website analytics and performance diagnostics used to measure page load speed, Core Web Vitals, navigation readiness, and aggregate site usage. Google Analytics is not used for advertising personalisation by BratVPN. See Google's Privacy Policy.
• Google AdSense — website advertising. Where enabled, Google and its advertising technology providers may use cookies or similar technologies, IP address, browser and device information, and consent signals to serve, measure, limit, or personalise ads according to your choices and applicable law. Before we serve personalised advertising to visitors in the EEA, the UK, or Switzerland, we use a Google-certified consent management platform. See Google's Privacy Policy and Google's advertising technologies.
• AppsFlyer — mobile and website attribution and marketing measurement. AppsFlyer may process its installation or web identifier, IDFV, and, only with the relevant permission, IDFA or AAID, together with IP address, device/browser/app information, campaign or referrer data, consent status, and limited interaction events. The website SDK starts with measurement disabled, loads only after website advertising consent, and stops measurement when that consent is withdrawn. We do not send AppsFlyer VPN traffic, browsing history, DNS queries, names, email addresses, or client-side website purchase, revenue, renewal, or subscription lifecycle events. See AppsFlyer's Privacy Policy.
• RevenueCat — subscription management, entitlement validation, and subscription lifecycle reporting. RevenueCat may send subscription events and the limited attribution identifiers needed to connect those events to AppsFlyer; it does not receive VPN traffic or browsing history from BratVPN. See RevenueCat's Privacy Policy.
• Website checkout payment processor — website checkout payment processing for supported methods and subscription billing.
• Resend — transactional delivery of activation-code emails requested during website checkout. Resend processes the recipient address, message content, delivery events, and related technical metadata. We use an Ireland sending region where available; Resend states that account and message metadata may still be stored in the United States. See Resend's Privacy Policy.
• Firebase (Google) — App analytics, performance monitoring, crash reporting, and remote feature configuration. Data is collected in anonymised and aggregated form where possible. See Firebase Privacy Information.
• PostHog (PostHog Inc., EU Cloud — eu.i.posthog.com) — sanitised application diagnostic logs and website performance diagnostics used to investigate bugs, speed issues, and operational problems. Bearer tokens, API keys, and similar secrets are redacted client-side before transmission. Logs are keyed by a randomly generated install identifier where applicable; we do not send your name, email address, IP address, or VPN traffic to PostHog. Data is hosted in the European Union. See PostHog's Privacy Policy.
• Crisp — In-app and on-website live chat and support ticketing. When you initiate a chat, Crisp processes the content of your messages, your IP address, browser/device information, and session cookies required to operate the chat widget. This data is used solely to deliver support and is not used for advertising. See Crisp's Privacy Policy.

We are not responsible for the privacy practices of these third-party services. Please review the privacy policy shown by the relevant store, website checkout, analytics, diagnostics, or support provider to understand how your data may be handled.

You have the following rights regarding your data:

• Access & Deletion: You may request access to or deletion of any data associated with your use of the App at support@bratvpn.app.
• Device Permissions: You can manage the App's access to VPN configuration and Apple's App Tracking Transparency permission at any time through your device's Settings. Where required, you can reopen Google UMP privacy options from the App's settings. On Android, you can also reset or delete the advertising ID through system settings.
• In-App Data Management: You can reset saved preferences and server selections directly within the App at any time.
• Advertising choices: You can use the website's privacy controls to change or withdraw advertising consent. Withdrawal tells AppsFlyer to stop website measurement; a consent-state cookie may remain so the SDK remembers your opt-out, and you can also clear site data in your browser. On mobile, you can reopen Google UMP privacy choices where available and control ATT or AAID through system settings. Mobile ad requests remain non-personalized; depending on your jurisdiction and UMP status, your choice may prevent an ad request entirely. Denying ATT prevents IDFA access but does not necessarily remove a non-personalized banner that does not use IDFA. You may uninstall the App at any time to cease its local data collection.

We will respond to all data access and deletion requests within a reasonable timeframe and in accordance with applicable laws.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Changes will be posted within the App or on our website, and the "Last Updated" date at the top of this page will be revised accordingly.

Your continued use of the App following any changes to this Privacy Policy constitutes your acceptance of the updated policy. We encourage you to review this page periodically to stay informed about how we protect your data.

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:

Support: support@bratvpn.app Company details: legal/imprint