Privacy Policy

Information on your device

On Android, imported profiles and managed-access credentials are encrypted with AES-256-GCM using a key in Android Keystore and stored in the app's no-backup directory. Cloud backup and device transfer are disabled. On iOS, imported connection credentials are stored in the Keychain access group shared by the app and its VPN extension, with iCloud synchronization disabled. Consent preferences are stored locally on both platforms. Personal routing exceptions, the sites you choose to send always direct or always through the VPN, also stay on the device: on Android they are encrypted the same way in the no-backup directory; on iOS they are kept in the Keychain on this device only, with iCloud synchronization disabled. The app does not send these lists to ChromVoid or to a VPN server. On Android, your app selection and the built-in apps you deselect are also stored only on the device. The app list and package names are not sent to ChromVoid or a VPN server and are not included in diagnostics.

The app reads a selected profile file locally. Camera access is used only to scan a connection QR code; camera images are not uploaded. Removing an imported profile in the app deletes its saved profile credentials.

Optional Android managed access

If you activate an invitation, the Android app sends the invitation credential, a randomly generated installation identifier, an authentication token and a device name based on your Android device model to https://link.chromvoid.com over HTTPS. The controller stores a device record linked to the access grant, the installation identifier, device name, a hash of the authentication token and revocation state. Catalog requests authenticate this installation. When the catalog reports a newer version of the built-in list of directly routed domains, the Android app downloads that list from the controller with the same authentication and keeps a copy on the device. Managed VPN nodes periodically report device identifiers and current connection counts and, for the whitelist bypass described below, how many bytes each device sent and received through it. The controller stores each node's latest report and its receipt time to show current connection state and support access control. The service operator can view this access and connection information.

Catalog and ticket refreshes continue while managed access is in use, including while the VPN runs in the background. These records support access control and connection operation, not advertising. You can instead import your own profile without activating an invitation. The current iOS client does not use invitation enrollment or the managed node catalog. Neither client offers a user account with an email/password login.

VPN traffic and server operators

When you connect, authentication and traffic routed through the VPN are sent to your selected managed node or the server in your imported profile. The server processes the connection and the destinations you request. Its operator may observe your source IP address, connection times, destination addresses and DNS requests. Server-side logging and retention depend on that operator. This policy does not make a no-logs promise about third-party or user-managed servers. Only use servers and profiles you trust.

On Android, only apps you select use the VPN. Other apps, including Max and Android Auto, use your regular connection. Installed apps from a built-in list are selected automatically unless you have deselected them; you can change the selection in the app. At least one app must be selected to connect. The site rules below apply within selected Android apps; iOS routing is unchanged.

Local/private destinations bypass the tunnel. Russian domains and services in the app's base list use your regular connection; other public traffic uses the VPN. With Android managed access, this list can be updated from the controller. Sites in your Always direct exceptions use your regular connection, and sites in Always through VPN use the tunnel, including Russian sites. There is no routing mode selection. Your network provider can observe connections that bypass the tunnel.

Mobile whitelist bypass

Some mobile operators at times allow connections only to an approved list of services. On Android, when the app detects such a whitelist mode and your managed-access catalog offers a bypass entry point, the app connects to the managed node through a content delivery network run by a third party (currently Timeweb's CDN, which runs on CDNvideo's network). The CDN receives your IP address, connection times and the amount of data transferred, and forwards the VPN connection to the node. The VPN traffic inside is encrypted between the app and the node, so the CDN does not see the destinations you visit or their content. Imported profiles do not use this bypass.

Bypass traffic is limited by a monthly quota for each access grant. The node counts the bytes each device sends and receives through the bypass entry point and reports them to the controller, which stores the monthly total for the grant. The app shows the remaining quota and the date it resets. The controller keeps these monthly totals until the service operator deletes them.

DNS and connection checks

The client resolves names that go through the VPN with Cloudflare's public DNS resolver over HTTPS. Names of sites that go directly, such as Russian sites, are resolved with Yandex's public DNS resolver over HTTPS (77.88.8.8 and 77.88.8.1), and with Cloudflare when Yandex does not answer. The client also requests https://1.1.1.1/cdn-cgi/trace through the Hysteria2 connection to check internet access. Cloudflare and Yandex receive those requests and the source address visible on their route.

To detect a mobile whitelist mode, the Android app opens short TCP connections to port 443 of the managed nodes in its catalog, Cloudflare (1.1.1.1), ya.ru, vk.com and gosuslugi.ru when it connects and when the network changes; while a whitelist mode lasts, it repeats the check with the managed nodes and Cloudflare every five minutes. These checks send no data; the operators of those addresses see a connection attempt from your address. When the Yandex and Cloudflare resolvers do not answer, the client may resolve the bypass entry point's name with your network's own DNS server, which then sees that name.

Cloudflare's Public Resolver privacy commitment describes limited DNS transaction/debug logs, normally deleted within 25 hours, IP truncation, and narrowly sampled network packets for troubleshooting and denial-of-service mitigation. Its Privacy Policy governs Cloudflare's processing, and Yandex's Privacy Policy governs Yandex's processing. These requests are not an advertising or analytics integration.

No advertising or app analytics

The app has no advertising, analytics SDKs, advertising identifiers or in-app purchases. We do not sell or monetize VPN user data, use it for advertising, profiling or unrelated secondary purposes, or disclose it to third parties for those purposes. Network data is processed to carry out the requests selected by you.

The app does not upload browsing history or profiles to a ChromVoid telemetry service. Local diagnostic files may contain technical runtime information; the core's plaintext configuration snapshot is discarded. This is a statement about the client, not a guarantee about an independently selected server operator.

Diagnostics

To find connection failures, freezes and crashes, the Android app keeps a technical journal on the device for up to 7 days: connection states and their durations, error codes, results of reachability checks to the Wayveil server and controller and to well-known sites (ya.ru, vk.com, gosuslugi.ru and Cloudflare), whether a mobile whitelist mode was detected and what triggered the check, network type (Wi-Fi or cellular), the mobile operator code (MCC/MNC), app and Android versions, device model, crash and freeze reports. It never records the websites, domains or addresses you visit, DNS requests, traffic content or profile secrets.

Unless you turn off “Send diagnostics” in the app, the journal is sent to the Wayveil controller. When you tap “Send report”, the app sends the journal at once and shows a code to pass to support. The controller does not store the IP address diagnostics came from and deletes diagnostics after 14 days.

Retention and deletion

Managed-access registration records are retained until the service operator deletes them; the current service has no automatic deletion schedule. Node connection reports contain the latest reported connection state rather than a browsing history. Choosing Remove device access on Android revokes this installation, frees its device slot and removes its saved access credentials from the app. It does not erase the controller's device record. Uninstalling the app does not request deletion of server records.

To request deletion of managed-access records or ask about retained information, contact legal@chromvoid.com and identify Wayveil and the service operator or invitation issuer. Do not email invitation links, authentication tokens or profile credentials. We may need additional information to verify the request and identify the relevant records.

Support and your choices

If you email support, we receive your return address and the information you choose to include. Do not send profile links, passwords, private keys or browsing contents. Contact apple@chromvoid.com or legal@chromvoid.com for support, access, deletion or privacy questions. Disconnect before removing the profile or the system VPN configuration.

The relevant sections of the common ChromVoid Privacy Policy cover support/legal correspondence, website visits and other ChromVoid products. This VPN supplement describes these Android and iOS clients' processing and takes precedence for that description. Material changes require an updated policy and store declaration.