Privacy Policy

You can use Siber VPN without registering, and you can buy Premium without an account too. If you buy before creating one, the app gets an anonymous account identifier from Google Firebase Authentication so that the purchase is linked to this phone; it is not tied to an email address. An account lets Premium stay with you when you change or reset your phone: to create one you give an email address and a password; we do not ask for your name or phone number. If you create an account after buying without one, we move your orders from the anonymous identifier to the account.

Sign-in is provided by Google Firebase Authentication, which handles your email address, your password and the network address of sign-in requests on our behalf and under its own terms; we never see your password. We keep your email address, whether it has been confirmed, and the link between your account and your Premium orders (section 8). The account is not linked to the product analytics or connection counters described in section 5.

Some identifiers leave the device whether or not you have an account, and we would rather say so plainly: ad networks request an advertising ID (section 5), configuration requests carry a random configuration identifier (section 4), and product analytics carry a random install identifier that is regenerated if you reinstall (section 5). None of them is linked to your account.

We do not log your browsing history, the contents or destinations of your traffic, your DNS queries, or your original IP address. (For a subscription from our Telegram bot, its list of devices also keeps the IP address of each device’s most recent subscription update; see section 11.)

While the VPN is connected, traffic to many Russian sites goes directly rather than through the tunnel, so that Russian banks, government services and local sites keep working; the same applies to anything you exclude yourself in Split tunneling. Some services may also connect directly, without going through the VPN server. Sites and services reached this way see your real IP address. DNS lookups for Russian domains are also sent directly, to Yandex Public DNS, so Yandex and your internet provider can see which of those domains you look up, from your real IP address. We do not run that resolver and do not receive those lookups.

The app shows ads, and ad networks request an advertising ID. It also collects product analytics (tied to a random install identifier, not to you), which you can switch off in Settings; they are processed on our own servers and may also be sent to PostHog. None of these see the sites you open through the tunnel: neither the ad networks, nor analytics, nor the connection counters in section 5 — so there is nothing about your browsing to store or hand over.

The app keeps some information on your device so that it works — for example your settings, your selected location and records used by its features — and deletes it when you uninstall the app or clear its data. This includes random identifiers, such as a configuration identifier, sent only with configuration requests (section 4), and an install identifier used by product analytics (section 5); new ones are created afterwards. If you use Split tunneling, the app reads which installed apps have a launcher icon so that you can choose them there; that list and the exceptions you set stay on your device. Apart from the configuration request (section 4), the connection counters and product analytics (section 5), the advertising ID that ad networks receive (section 5), and what the app sends for your account and Premium (sections 1 and 8), this information is not sent anywhere.

To stay reachable, the app fetches its server configuration from our own servers and, as a fallback, downloads it from public file-hosting services.

A request to our servers contains a random configuration identifier (kept separate from the app’s other identifiers; a new one is created if you reinstall the app or clear its data), the app version and a few technical details, such as the network type. We use them only to choose which configuration to send back; our servers do not store these requests and keep no request logs.

Like any request on the internet, the servers involved — ours and the public file-hosting services — can see standard request information such as your IP address. The file-hosting services receive nothing else from the app. All of this happens only to retrieve configuration, not to track you.

To detect when servers stop working — for example when they are blocked in a particular country — the app sends small anonymous connection counters through the VPN tunnel: whether connection attempts succeeded, together with the server location, the app version and the country from your device’s region settings. Because they are sent through the tunnel, our collector sees the server’s address, not yours, and your IP address is never stored.

These counters contain no account, no device identifier, and nothing about what you browse or do online. In aggregate they tell us only whether connections are working.

Separately, the app collects product analytics, which you can switch off in Settings. They are processed on our own servers; the app may also send them to PostHog, an analytics provider. From the network the analytics are sent over, our servers record which mobile operator or internet provider it belongs to; the IP address itself is not stored. They are pseudonymous rather than anonymous: they are not tied to an account or to who you are, but events from one installation are linked to each other by a random install identifier. They cover how the app is used and how well it works — for example connection attempts, their outcome and quality, and the region you connect to; configuration updates; app launches, returns to the app, and problems such as interrupted connections or why the app last closed (for example, a crash); whether battery saving on the device restricts the app in the background; the features and settings you use (for Split tunneling, only how many apps and sites are set, never which ones); where the app was installed from, as a broad category (for example the store or an ad campaign) and, for an ad campaign, which campaign; and ad activity, such as ads loaded and shown, the ad network and the revenue it reports. Events carry a random install identifier and the usual device and app attributes (model, OS version, language, time zone, app version, and the mobile operator and country of the SIM card) — no account, no personal profile, no advertising ID, and never a server address, a key, or anything about what you browse.

We also use AppMetrica, Yandex’s analytics service, to measure which ad campaigns installations come from and the ad revenue the app earns. It comes into the app with the Yandex Mobile Ads adapter (included through CAS.ai) and reports installation and usage signals to Yandex together with the advertising ID and general device data, which Yandex processes under its own policy. It is not part of the analytics described above, so the Settings switch — which controls our own analytics — does not turn it off.

Ads are served through CAS.ai, a mediation platform that routes each ad request to a number of ad networks and real-time bidding exchanges. The partners built into this version of the app include Google AdMob, Meta Audience Network, Yandex Mobile Ads, Unity Ads, ironSource, Vungle, InMobi, Mintegral, Bigo Ads, Amazon, AppLovin, Chartboost, Tapjoy, BidMachine, Pangle, PubMatic, Kidoz, Maticoo, Display.io, YSO Network, Monetrix, Bidease, BlueSea and HyprMX. This list is not exhaustive and it changes: CAS adds and removes partners without an app update, and in a real-time auction the winning buyer can be a demand platform whose name never appears in the app at all. They receive the advertising ID, general device data (model, OS version, language, approximate region derived from your IP) and information about the ads loaded, shown and tapped in the app, and process it under their own policies. They do not receive, and cannot see, the sites you open through the tunnel. Depending on whether the VPN is on and how each request is routed (section 2), they see either your real IP address or the VPN server’s. You can reset the advertising ID or turn off ad personalisation in Android settings.

If you choose to email us feedback from within the app, the message includes basic technical details you can see before sending (app version, device model, Android version, and connection counters). The details the app adds contain no identity information and no server addresses. We also receive whatever the email itself contains: your email address, the sender name your email app shows, and anything you choose to write. Sending feedback is entirely optional.

Our configuration servers do not store configuration requests or keep request logs (section 4). The public file-hosting services the app may download from keep their own logs under their own policies.

Product analytics (section 5) are kept only as long as we need them to understand how the app is used and to find and fix problems, and are then deleted. Turning analytics off in Settings stops any further events. Events from one installation are linked to each other by a random install identifier and carry the device and app attributes listed in section 5, but not your name or email address, so we cannot look up your events by either; reinstalling the app or clearing its data starts a new identifier.

We keep the anonymous connection counters (section 5) as statistics.

Feedback emails you send us (section 6) are kept only as long as we need them to reply to you and handle your request, and are then deleted. You can ask us to delete your messages at any time by writing to support@siber-vpn.cc.

Your account (section 1) is kept until you delete it. You can delete it at any time in the app (Settings, then Account, then Delete account; if you bought without an account, Delete data deletes everything linked to the anonymous identifier from our servers, and the app stops using it), or follow the steps at www.siber-vpn.cc/delete-account. Deleting the account removes its email address and sign-in from Firebase and unlinks your orders from it; order records that accounting or tax law requires us to keep are kept as described in section 8.

Data from the Telegram bot and subscriptions (section 11) is kept as described in that section.

Order data and any wallet address you give us for a refund (section 8) are kept as described in that section.

Data on your device (section 3) is deleted when you uninstall the app or clear its data. Data that ad networks and AppMetrica receive (section 5) is kept under their own policies.

If you pay for Premium by card or СБП, the payment is processed by our payment provider and your bank. Your card details and other payment credentials are entered on the payment provider’s side and handled by the payment provider and the bank; we never receive or store them.

If you pay in cryptocurrency, through our Telegram bot or on the subscription payment page, the payment is processed by a third-party cryptocurrency payment service, on a page it provides and under its own policies.

To provide Premium, we receive order details from the payment provider or the cryptocurrency payment service — for example the plan, the amount, the date and time of payment, the order number and the payment status and, for a cryptocurrency payment, the currency and the network — together with the technical information needed to activate Premium in the app, and we link the order to your account so that Premium works on any device where you sign in (for a purchase through the Telegram bot, to your Telegram account; section 11). If you give an email address for a receipt or write to us about an order, we also receive that address.

We use this data only to process your order, activate Premium, answer your questions, send you messages about your Premium (for example before it ends), handle refunds, give and take back invitation bonuses (section 11), meet our accounting and legal obligations and, under a pseudonym or as totals, see how purchases go and which channels and ad links they come from (section 11), so that we can improve the service and decide where to advertise. We do not use it to target advertising at you, we do not pass it to advertising networks, we do not add it to the product analytics described in section 5, and we do not sell it.

Order data, including the currency, network and amount of a cryptocurrency payment, is kept for as long as we need it for these purposes and for any period required by accounting or tax law, and is then deleted. The payment provider, the cryptocurrency payment service and the bank keep their own records under their own policies.

If you ask for a refund of a cryptocurrency payment, you give us a wallet address in the bot. We use it only to make that refund: our support staff use it to send the money, and we may pass it to the cryptocurrency payment service that carries out the transfer. We delete the address from our servers once the refund has been handled. Like any blockchain transfer, the refund itself is recorded publicly on the blockchain.

When you use Premium servers, the app also sends us a random device identifier that it creates itself; we use it only to limit how many devices use one Premium at the same time and to protect Premium from abuse; we delete it from our servers after the device stops using Premium servers.

You can ask us what personal data we hold about you, ask us to correct or delete it, or object to its processing by writing to support@siber-vpn.cc. Please write from the email address of your account, or include details that help us find the data, for example an order number. If you use our Telegram bot, you can also contact support in the bot. We may keep data that the law requires us to keep, such as payment records.

You can also switch off product analytics in Settings, and reset the advertising ID or turn off ad personalisation in Android settings, at any time. If you believe we handle your data unlawfully, you may complain to the data protection authority where you live.

This website does not use advertising or analytics cookies and does not ask you to sign in. Our hosting and network providers may set strictly necessary technical cookies and keep standard server logs (such as IP address and browser type) to deliver the site and protect it from abuse.

Pages under www.siber-vpn.cc/s/ are opened from a personal link sent by our Telegram bot. Anyone who has the link can see that subscription’s status and how to connect, so do not share it.

When you pay for Premium there, the page may set short-lived functional cookies that are used only to bring you back to your subscription after the payment and to show whether your payment has been applied.

You can also get Siber VPN through our Telegram bot, @siber_vpn_bot. It gives you a subscription that apps such as Happ use to connect on iPhone, iPad, Mac and Windows, and a page on this website that shows the subscription’s status. When you use the bot, we receive what Telegram passes to bots — such as your Telegram user ID, the name and username in your profile, and the language of your Telegram app — and the messages and button presses you send to the bot. We use them to provide and manage your subscription, to send you messages about it (for example before it ends or after a payment) and to answer your questions. Telegram delivers these messages and handles them under its own policy.

To provide the subscription, our servers keep its period, its status and how it is used — for example how much traffic it has used and on which of our servers, and when it was last connected. When an app updates the subscription, it may send us an identifier of the device and basic information about it, such as the model, the operating system version and the app’s name and version; our servers keep these in the subscription’s list of devices, together with the IP address and time of each device’s most recent subscription update. We use them to limit how many devices can use one subscription, to show you your devices in the bot so that you can remove them, and to protect the free trial and Premium from abuse — for example, a free trial is given only once per device. Like any request on the internet, the network providers that deliver subscription updates can see standard request information such as the IP address. The sites you open through the VPN are not part of this data.

Text messages you write to the bot (for example, questions to support) are processed by an AI service provided by a third party, which helps answer them. The service may also receive basic facts about your subscription, orders and bonus days needed to answer you, without your name or Telegram ID. If a question needs a person, we keep a summary of it and the conversation, and send them, together with an internal customer number, to our support staff through a third-party workplace messaging service, so that they can reply to you in the bot.

If you pay for Premium through the bot or on the subscription page, the order is linked to your Telegram account (section 8).

We also record how the bot and the subscription pages are used — for example what is opened, chosen and clicked, and whether a payment went through — to improve the service. These records identify you by a pseudonym rather than your Telegram ID, do not include the text of your messages or the sites you visit, and do not use cookies. They are kept for a limited time and then deleted. Separately, we keep a note with your Telegram account of how you first reached the bot — for example through a channel or an ad link — to understand which of these ways work.

If you invite someone, or open the bot through an invitation link, while our invite-a-friend programme is running (section 7 of the Terms of Service), we keep any invitation code you have, who invited whom, whether a first payment counted, and the bonus days given or taken back, including why a bonus was not given. We use this to give and take back bonuses, apply the programme’s limits and send you messages about them. In the bot, a person who invites others sees how many people they have invited and how many bonus days they have received, and gets a message when a bonus is added or taken back, so they may be able to tell that someone they invited has paid or had a refund. Those figures and messages do not include the invited person’s name, username or Telegram ID.

To stop people inviting themselves, when a bonus is due we compare the devices recorded for the two accounts, using a coded form of the device identifiers described above. While the programme is running, we record this coded form for every device connected to your subscription, whether or not you take part, because the check needs devices seen earlier; we also use it for the free trial.

We keep your Telegram user ID, that note and the subscription, device, order and invitation data described above while you use the bot and the subscription, and afterwards only as long as we need them for these purposes (for example, to give a free trial only once) or as the law requires. Support conversations, including the copy sent to our support staff, are kept to reply to you and handle your request, and we do not use them for anything else. You can remove a device from your subscription in the bot at any time, and you can ask us to delete your data by writing to the bot’s support or to support@siber-vpn.cc (section 9).

If you ask us to delete your data, your invitation code stops working, and the invitation records and bonus orders no longer point to you. Their order numbers stay so that a later refund can still take back the bonuses; until then, the other person keeps the bonus days already given. After a limited time we also remove the link between an invitation record and the order of a person who deleted their data. Where the free trial, a refund or an invitation has already been used, or you have paid, we also keep coded marks of your Telegram account and devices for a limited time. These marks contain no name, Telegram ID or order details; they show whether these have been used and tie your devices to the mark of your account, so that deleting your data does not reset these limits or the check against inviting yourself.

Siber VPN is intended for users aged 13 and over. We do not knowingly collect data from children under 13.

We may update this policy to reflect changes in the app. Material changes will be posted here with a new date.

Questions? Email support@siber-vpn.cc.