Privacy Policy

Last updated: 2026-05-28

VLight VPN is a virtual private network client for Android. This page explains exactly what we handle and what we deliberately do not collect.

What we collect from you

Nothing that identifies you personally. Specifically:

We do not require account registration, email, or phone number.
We do not assign you a user ID, advertising ID, or device fingerprint.
We do not log your browsing history, DNS queries, destination IPs, or any traffic content that passes through the VPN tunnel.
We do not store individual connection timestamps against any identifier that can be traced back to you.

What is stored only on your device

The following preferences live in Android SharedPreferences and never leave the device:

The server you last selected.
Your preferred DNS server and protocol override.
Your interface language (English / Russian).
A cached copy of the available servers list.

You can erase all of this at any time by clearing the app's storage in Android Settings, or by uninstalling the app.

What goes to our discovery API

When the app fetches the list of servers, it sends an HTTPS request to api.vlight.app. That request contains:

Your IP address (visible to any server you contact — unavoidable at the TCP/IP layer).
The HTTP User-Agent that the underlying network stack provides.

We do not attach a session ID, account ID, advertising ID, or any other identifier to these requests. Access logs are rotated within 7 days.

The VPN nodes themselves

Each node runs Xray. They forward your traffic to its destination on the public internet. They do not log connections, destinations, DNS queries, or payloads. They report only aggregate per-node load metrics (CPU %, memory %, total bandwidth, connection count) to our API every 60 seconds. These metrics are not tied to any individual user.

Note that whatever website or service you visit through the VPN will see the node's IP address and may log your activity according to their own privacy policy. We have no control over that.

Permissions the app requests

INTERNET — reach the API and the VPN nodes.
ACCESS_NETWORK_STATE — detect connection loss to auto-reconnect.
FOREGROUND_SERVICE + FOREGROUND_SERVICE_SPECIAL_USE — keep the tunnel running while the screen is off.
POST_NOTIFICATIONS — show the persistent "VPN active" notification.
BIND_VPN_SERVICE — the standard Android VPN API.

The app does not request the camera, location, contacts, microphone, storage, accounts, or any other sensitive permission.

Third-party SDKs

The app does not embed any analytics, advertising, crash reporting, or attribution SDKs. The only network destinations the app reaches are:

api.vlight.app (the discovery API).
The VPN node you select.
DNS-over-HTTPS resolvers (Cloudflare, Google, Quad9) used purely to look up our own API hosts.

Children

The app is not directed at children under 13 and we do not knowingly collect data from them.

Your rights

Because we do not collect personal data tied to an identity, there is no personal profile to access, correct, or delete. To remove all local state, uninstall the app or clear its storage in Android Settings.

Changes

If this policy changes materially, we will update the "Last updated" date and post the new version at the same URL.

Contact

Questions: spilatovich@gmail.com