Privacy policy

1. Who this covers

This policy covers the GMEOW VPN Android application, this website, and the service at admin.gmeow.org that the app talks to. It is written for the person holding the phone, and it tries to be specific rather than general, so that you can check it against what the app actually does.

2. What we store, field by field

Everything below is stored against your account and goes when the account goes. There is no third party analytics SDK in the app and no advertising identifier anywhere in it. The one table we do read in aggregate is the connection attempt log, which tells us which servers keep failing so we can drop them.

a. Your account

An email address, a hashed password, and the account identifier our authentication provider generates. That is the whole sign-up: no name, no phone number, no address. The email address is used to sign you in, to send a password reset when you ask for one, and to reply if you write to support.

b. Live tunnels

When a tunnel opens we write a row holding your account id, which server you chose, the time it started, a lease expiry, and the time it ended. It is worth being specific about this one, because it is a connection timestamp tied to your identity. It exists for a single purpose: to count how many tunnels the account holds at once, and to stop the one that would exceed the limit.

The row holds no IP address, no traffic volume, and nothing about what passed through the tunnel. We count sessions rather than devices on purpose, because counting devices would mean storing a persistent identifier for your phone, and for a VPN that is a worse trade than the one it buys.

c. Connection attempts, including the ones that succeed

Every time the app tries to open a tunnel it writes a row holding your account id, which server was tried, that server's country code, which attempt number it was, whether it connected or failed, and the time. Attempts are numbered because the app moves to a different server by itself when the first one does not answer, and separating the server you chose from the server it fell back to is the only way to tell a broken server from a broken network.

A failed row also carries a short reason code from a fixed list, and the last error or warning line the OpenVPN engine printed, trimmed to 300 characters. That line is the engine's own text rather than ours, so we cannot promise a precise shape for it: it describes the connection failure and usually names the server's address and the stage the handshake stopped at. It is kept because a code from a fixed list will eventually be wrong about something and the engine's own words are what correct it, and it is capped in length so the field cannot become storage for anything else.

No IP address of yours, no device identifier, and nothing about traffic is stored with any of it.

d. Your settings and favourites

The toggles you set, your resolver choice including a custom address if you typed one, and the servers you starred. These are stored against the account so they follow you to a new phone rather than being lost with the old one. A copy is also kept on the phone itself, and deleting your account erases that copy too.

e. Premium status

Your tier, when it expires, and the purchase token Google Play issues so that a subscription can be verified as real. Card numbers never reach us. Google Play processes the payment, and we only ever see whether a purchase is valid.

f. The address check on the Home screen, which stores nothing

The app shows which address the internet currently sees you as, so you can tell for yourself whether the tunnel is carrying your traffic. Getting that answer takes one request to our own service, which reads the address the request arrived from, sends it straight back, and writes it nowhere. It is not logged, not counted, and not kept a moment longer than the reply takes. The reason it goes to us rather than to a public address-lookup site is exactly that: a third party asked the same question would keep its own logs, and there would be nothing we could tell you about them.

3. What we never store

• The sites you visit, your search history, or any part of your browsing.
• The domain names you look up, or the content of any DNS query.
• Traffic payloads or packet contents, in any form.
• Bandwidth or data-volume figures attached to your account.
• Your home IP address, or the virtual address a server assigns you.
• Any device, hardware, or advertising identifier.
• Location beyond the country code a connection arrives with, and even that is only shown to you rather than retained.
• A list of what was filtered for you, because such a list would be a record of what you visited (§5).

4. The servers you connect through

Not all of the servers you can connect through are operated by us. Part of the list is published by third parties whose machines they host and administer themselves. We do not own, rent, or administer those machines, we cannot inspect their logs, and we are not in a position to describe their logging on their behalf. This matters enough to be its own section rather than a footnote.

What the operator of the server you pick can see

• That a connection arrived from your network address, and when.
• The addresses and ports your traffic leaves their machine for, since they are the ones forwarding it.
• The plain content of anything you send that is not itself encrypted. Traffic to an https:// site stays encrypted end to end and they cannot read it; traffic over plain HTTP they can.

What they cannot see

• Your GMEOW account or email address. The tunnel carries no account credentials, and we never hand your identity to a server.
• Your DNS queries, because the app moves resolution past them to the resolver named in §5. That single measure is the largest privacy difference between using this app and importing the same free configuration by hand.

Two things are done about this rather than said about it. Every server's TLS certificate is verified before the tunnel opens, so a machine impersonating a server fails to connect instead of quietly succeeding, and name resolution is taken out of the server's hands. Beyond that, which server you connect through is your choice, and the honest framing is that a VPN moves who can see your traffic rather than removing the question.

5. DNS and ad filtering, including the part that is a trade-off

While the tunnel is up, the app overrides your DNS settings so that name lookups do not go to the server operator's resolver. They go instead to:

• Cloudflare on the free tier, and on Premium whenever you choose it. No filtering.
• AdGuard DNS on Premium, if you turn ad filtering on.
• An address you type yourself on Premium, if you would rather use your own resolver.

The resolver operator sees your DNS queries

This is worth saying plainly, because forcing private DNS can be read as though the queries disappear. They do not. Cloudflare or AdGuard, whichever is in use, receives the names your phone looks up while the tunnel is up, and their own privacy policies govern what they do with them. We chose this over the alternative, which is leaving resolution with a server operator whose logging we know nothing about. It is a better trade rather than no trade, and if you pick a custom resolver then the operator of that address sees the queries instead.

Ad filtering works by that resolver declining to answer for known advertising and tracking domains, which is why it works inside other apps and not only in a browser. Two consequences follow from the mechanism: it cannot filter an advert served from the same domain as the content around it, and there is no list of what was filtered for you, because such a list would be a record of the sites you visited and keeping one would contradict everything above.

6. Where the data lives

GMEOW VPN is a small operation and does not run its own datacentre. Four providers are involved, and each one is here for a single job.

These providers operate internationally, so your account data may be stored or processed outside your own country. The publishers of the third-party server list are not on this table, because we send them nothing: the app downloads a public list and never uploads anything about you.

We do not sell data, and we have never received a lawful request for user data. If one arrived, what could be handed over is the list in §2 and nothing more, because nothing more exists.

7. How long we keep it

• Account, settings, and favourites — for as long as the account exists.
• Session rows — until the tunnel closes or its lease expires, and then only as a closed row that no longer counts against your limit.
• Connection attempts — 30 days, then deleted. The deletion is not a scheduled job that could quietly stop running: each new attempt removes your own rows older than 30 days as it is written.
• Support emails — kept in the support inbox until the matter is closed.

Deleting your account short-circuits all of it. Every row above is tied to your account id and is removed with it in the same operation rather than queued for a later cleanup.

8. Your rights, and deleting your account

You can see what is stored, ask for a copy, ask for a correction, or erase all of it. Erasure is self-service and takes effect immediately, with nobody to ask and no waiting period.

Delete your account, in the app

The account, its session rows, its connection attempts, its settings and its favourites are deleted in one operation, and the copies held on the phone are erased at the same time. There is no undo, and signing up again gives you a new empty account rather than the old one back.

If you have a Premium subscription, cancel it first

Deleting your account does not cancel a Google Play subscription, because we cannot reach into your Play account to stop one. Cancel it in the Play Store first, otherwise the charges continue after the account that mapped them to you is gone. The app says the same thing before it deletes anything.

If you cannot reach the app, because the phone is lost or you cannot sign in, write to support@gmeow.org from the address the account uses and it will be handled by hand.

9. Security

• Passwords are hashed by the authentication provider and are not readable by us or recoverable by anyone.
• Every request between the app and our service runs over TLS.
• Database rows are protected by row-level security, so an account can only ever read its own.
• The app can be locked behind your device biometrics if you turn that on.

No system is beyond compromise, and it would not help you for this page to suggest otherwise. If a breach ever affected your data we would say so in the app and on this site, and describe what was exposed rather than only that something was.

10. Children

GMEOW VPN is not directed at children and we do not knowingly collect anything from a child. If you believe a child has created an account, write to support@gmeow.org and it will be deleted.

11. Changes to this policy

This policy changes when the app changes. The date at the top moves with it, and this page always holds the version in force. If a future change meant collecting something not listed in §2, it would be announced in the app before it started rather than quietly added here.

12. Contact

Any question about this policy, or about what is stored on your account:

Email support@gmeow.org, or use the form at gmeow.org/contact.html.

Read the terms of service