Tunnexa Privacy Policy

This Privacy Policy applies when you use the Tunnexa VPN app for Android, visit tunnexa.com, or get an email from us. Please read it alongside our Terms of Service.

1. Who we are

Tunnexa VPN (“Tunnexa”, “we”, “us”) is a VPN app for Android. It is run by [Operator legal name], registered at [Registered address], [Country]. Under data protection law, [Operator legal name] is the controller of the personal data described here.

You can reach us about anything in this policy at support@tunnexa.com. [EU and UK representative, if required: name and address.]

2. What this policy covers

It covers the Tunnexa app for Android, our website at tunnexa.com (including its contact form and newsletter), and the emails we send, such as sign-in codes.

It doesn’t cover the websites, apps and services you reach through the VPN, which have their own policies. Google Play, and Google or Apple sign-in if you use them, are also covered by Google’s and Apple’s own privacy policies.

3. What we never collect

Tunnexa follows a strict no-logs policy. For everyone, guest or signed in, we don’t collect, store or share:

• your browsing history: the websites and apps you open while connected
• your connection history: a record of when your sessions started, how long they lasted or how much data they used
• your traffic destinations: the IP addresses and domain names your traffic goes to
• the content of your traffic: what you send and receive
• your DNS queries
• bandwidth use tied to you or your device

Our VPN servers pass your traffic on to the internet without recording it. The app also never asks for your name, phone number, contacts, or Android’s location permission.

4. What we collect

4.1 From every install of the app

When you open Tunnexa, it registers with our servers so it can fetch server lists and VPN settings. This happens for guests and signed-in users alike. We collect:

• App identifiers. The identifier Android gives the app on your device (the Android ID), and a random token our server issues to the app.
• Registration details. The IP address and user-agent string the app sends when it first registers. We use the IP address to estimate a city and country, which signed-in users see in Connected Devices.
• Current connection state. While you’re connected, the app reports this to us about every five minutes, and it reports when it stops. We keep the time of the latest report, the time it last stopped and the protocol in use. Each report overwrites the previous one, so no history builds up. We use it to apply the connection limit.
• VPN keys. To connect with WireGuard, AmneziaWG or Stealth, a server needs a key or login for your install. We keep the ones issued to your install, one per server and protocol it has used, so it can reconnect.
• App requests. To show servers and connect, the app sends its identifiers and the protocol you chose. With Ad & Tracker Shield on, it downloads a blocklist from us at most once a day; the blocking itself happens on your phone.
• In-app messages. We sometimes show a message inside the app, such as news about a feature. The app tells us whether it was shown, tapped or dismissed, with its identifier, the app version and the time.

4.2 If you create a free account

An account is optional. If you sign in with an email code, Google or Apple, we also collect:

• Your email address. With an email code, you give it to us. With Google or Apple, you sign in through Google’s Firebase Authentication, and the app sends us your email address with a token that proves the sign-in. With Apple’s Hide My Email, that’s the relay address Apple gives us.
• Account details. How you signed in and when you created the account.
• Your devices. For each device on your account: its brand, model and Android version, plus a city and country estimated from its registration IP address. You can see them under Account › Connected Devices.
• Sign-in IP addresses. The IP address you created the account from and the one you most recently signed in from.
• Your plan. Every account is on the free plan today. When Premium launches, we’ll also keep your plan, when it renews or ends, and the purchase token Google Play gives us to check it. Google Play handles payment, so we never see your card details.

We email you a sign-in code when you use email sign-in, and a welcome email when you create an account.

4.3 If you contact us or send feedback

• In-app feedback. Settings › Send feedback sends us your message, the email address you add (optional), the app version, the protocol you were using and the app’s identifiers. It arrives as an email to support@tunnexa.com.
• Email and our contact form. Your name if you give it, your email address, the topic, your message and anything else you choose to include.

4.4 What Google’s services collect in the app

The app includes these Google services. They collect information from your device under Google’s terms and report it to us:

• Firebase Analytics: how the app is used, such as screens and features opened and the server the app selects when it starts, with an app-instance ID, device model, Android version, language and an approximate location based on your IP address.
• Firebase Crashlytics: crash reports, including what the app was doing, device model, Android version and an installation ID.
• Firebase Performance Monitoring: how long the app takes to start and how long its requests to our servers take, with device and network type.
• Firebase Cloud Messaging and In-App Messaging: a token that lets us deliver notifications and messages to your install.
• Google Play: downloads and updates, the in-app review prompt and, once Premium launches, payments.

None of these services can see your VPN traffic, the sites you visit or your DNS lookups.

4.5 On tunnexa.com

• Newsletter. If you subscribe, your email address and when you subscribed, held by [newsletter provider]. You confirm by email first, and every newsletter has an unsubscribe link.
• Website analytics. We use [analytics tool] to count visits without cookies and without identifying you.
• Request logs. Our web host, [web host], may keep standard request logs (IP address, browser and page requested) to keep the site running and secure, for [retention period].

5. Why we use it, and our legal bases

If you’re in the EU, the UK or a country with similar law, we must have a legal basis for each use of your data. Here they are.

Where we rely on legitimate interests, we’ve weighed them against your rights, and you can object (section 8). We don’t make decisions about you based only on automated processing that have legal or similarly significant effects.

6. Who we share it with

We share personal data only with service providers that process it for us, under contracts that require them to protect it, and only as far as they need it:

• Google: Firebase (Analytics, Crashlytics, Performance Monitoring, Cloud Messaging, In-App Messaging and Authentication), Google Play, and Google Workspace, which hosts our support email
• Apple, if you choose Sign in with Apple
• the companies that host our servers: [hosting providers]
• the service that sends sign-in codes and account emails: [email delivery provider]
• the IP-location database we use to estimate a city and country: [IP-location provider]
• our newsletter provider: [newsletter provider]

We may also disclose data when the law requires it, for example under a valid court order. We can only hand over what we have, and we have no activity or connection logs. If Tunnexa is ever sold or merged, personal data may pass to the new owner, who must keep to this policy, and we’ll tell you.

We don’t sell your personal information, and we don’t share it for cross-context behavioral advertising.

7. How long we keep it

Current connection state	Until the next report replaces it
App identifiers, registration details, VPN keys	[retention period] after the app last checks in
Email, account details, sign-in IPs, plan	While your account exists
A device on your account	Until you remove it or delete your account
Closed account records	[retention period], for billing and legal records
Feedback and support emails	[retention period]
Firebase data	[retention period], as set in our Firebase settings
Newsletter email address	Until you unsubscribe

8. Your rights and choices

8.1 In the app

• Use Tunnexa as a guest, with no email address at all.
• Remove a device: open Settings, tap your account at the top, then Connected Devices.
• Delete your account: open Settings, tap your account, then Delete account. Every device is signed out and unlinked and the account is closed straight away. This doesn’t cancel a Google Play subscription; do that in Google Play.
• Turn off notifications in Android’s settings for Tunnexa.
• Uninstall the app, which stops it sending anything to us or to Google’s services.

8.2 In the EU, the UK and similar countries

You have the right to access your personal data, correct it, have it deleted, restrict how we use it, object to our use of it (including any use based on legitimate interests), receive it in a portable format, and withdraw consent at any time. You can also complain to your data protection authority; in the UK, that’s the Information Commissioner’s Office.

8.3 In California and other US states

You have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and to opt out of its sale or sharing for targeted advertising (we do neither). We won’t treat you differently for using these rights, and you can ask someone to act for you as your authorized agent.

8.4 How to ask

Email support@tunnexa.com, from your account’s address if you have one. We may need to confirm it’s you before we act, and we’ll reply within the time the law sets. If you’ve only used Tunnexa as a guest, we have no name or email for you, but write to us anyway and we’ll help you find and remove what we can.

9. Children

Tunnexa is not meant for anyone under 18, and we don’t knowingly collect personal data from children. If you think a child has given us personal data, email support@tunnexa.com and we’ll delete it.

10. International transfers

We and our providers handle data in several countries, including [Country] and the United States, and our VPN servers sit in several more. When personal data leaves the UK or the European Economic Area, we rely on an adequacy decision or on safeguards such as the European Commission’s Standard Contractual Clauses and the UK’s International Data Transfer Addendum. Ask us for a copy.

11. Security

• Data between the app and our servers is encrypted in transit.
• The app keeps its sign-in token and VPN credentials encrypted on your phone, with a key held in Android’s keystore.
• We limit access to personal data to the people who need it to run Tunnexa.

No system is perfectly secure. If a breach affects your personal data, we’ll tell you and the authorities when the law requires it.

12. Changes to this policy

We’ll update this policy as Tunnexa changes, for example when Premium launches. The date at the top shows the current version. If a change affects you in a meaningful way, we’ll tell you in the app or by email before it takes effect.

13. Contact us

Questions, requests or complaints: email support@tunnexa.com, write to [Operator legal name], [Registered address], [Country], or use our contact page.