This Privacy Policy explains how Contra VPN (“Contra”, “we”, “us”) collects, uses, and shares information when you use the Contra VPN Android app, the iOS app and Chrome and Firefox browser extensions once they are released, and the website at contravpn.com (together, the “Services”). By using the Services you agree to the practices described here.
1. Summary
Contra is a VPN. Its purpose is to protect your privacy, so we collect only what we need to run the service, prevent abuse, and process payments.
- We do not log the websites you visit, the content of your traffic, or your DNS queries.
- We do not sell your personal data or use your browsing activity for advertising.
- On the free plan, ads appear only inside the app (for example a short ad before connecting), never in your browsing. Premium has no ads.
- You can use the free plan without creating an account or giving us an email address.
2. What we do not collect
When you are connected to Contra, we do not collect or store:
- Your browsing history or the websites and apps you access through the VPN
- The content of your traffic
- DNS queries made through the VPN
- A record that links your VPN IP address to your activity
3. What we collect
Account information. When you first open the app, we create an anonymous guest account with a randomly generated username. If you choose to register, we collect your email address and a password. We store the password only as a secure hash. We may send a one-time verification code to your email.
Device verification data. To prevent abuse of the free plan, the app uses Google Play Integrity (Android) or Apple DeviceCheck (iOS) to confirm that it is a genuine app running on a genuine device. This gives us a device integrity token, not your name or contact details.
Device identifier. So that your device keeps the same guest account when you sign out or reinstall the app, the app sends us an app-specific device ID (Android ID on Android, the identifier for vendor on iOS). We do not store this ID itself; we store only a one-way, keyed hash of it, linked to your guest account. It is not used for advertising or tracking across other apps, and it is deleted with your guest account or unlinked when you register an account.
VPN connection data. To set up and manage your connection, we store:
- A WireGuard public key generated on your device (the private key never leaves your device)
- The internal VPN IP address assigned to your device and the server you connected to
- Session start and end times and the total amount of data transferred, used to apply plan limits and to manage server capacity
- Your total daily connection time (free plan only). The free plan currently has no daily time limit; this total is used only if we introduce one, and the app always shows the limit that applies
IP address. Our servers necessarily see your real IP address while you connect. For browser extension proxy connections, your IP address is temporarily added to a server firewall allow-list while your session is active and removed when it ends.
Purchase information. Subscriptions are processed by Google Play or the Apple App Store and managed through RevenueCat. We receive your subscription status and a purchase identifier. We never receive or store your card number or other payment details.
App usage analytics. To understand how the app is used and improve it, the Android app sends usage events to Google Analytics for Firebase: for example, that onboarding was completed, that the connect button was tapped, whether a connection succeeded or why it failed, roughly how long a session lasted, which server country was chosen, and which subscription plan was viewed. Events carry your plan type (free or premium) and whether you use a guest account, plus a random app-instance ID that Firebase creates on your device. They neverinclude your email address, username, VPN or real IP address, or anything about the websites you visit. Analytics does not collect your device’s advertising ID, and analytics data is not used for advertising or ad personalization. Subscription events (such as renewals and cancellations) may also be sent to Google Analytics by RevenueCat.
Ads on the free plan. The free plan is supported by ads shown by Google AdMob, only inside the Contra app: a short full-screen ad may be shown when you tap Connect, and when a daily free-time limit applies you can choose to watch an ad to get more time. Ads never appear in the websites or apps you use through the VPN, and Premium users never see them. When an ad is shown, Google collects information from your device to deliver and measure it, such as your device’s advertising ID, device and app information, your IP address and how you interact with the ad. In the European Economic Area, the UK and Switzerland, the app first asks for your consent through Google’s consent message; without it, Google shows only limited, non-personalised ads. When you finish an ad, Google’s servers tell ours that you earned the reward, identifying you only by an internal account number (never your email). We store that the reward was granted (date, amount and Google’s transaction ID) so we can add the time and apply the daily limit. Learn how Google uses this data at policies.google.com/technologies/partner-sites.
Approximate location for display.To show your current IP address and approximate location on the in-app map, the app sends a request directly from your device to a public IP lookup service (ipapi.co, ip-api.com, or ipify.org). We do not store this result. The app does not use your device’s GPS location.
Website. If you join our waiting list on contravpn.com, we collect the email address you submit. Our hosting provider may process standard server logs (such as IP address and browser type) to deliver the website.
4. How we use your data
- To provide the VPN service and connect you to servers
- To create and secure your account and verify your email address
- To apply your plan’s features, including device and daily usage limits
- To detect and prevent fraud and abuse of the free plan
- To process subscriptions and restore purchases
- To send you service messages, such as verification codes and replies to support requests
- To keep the service running and plan server capacity
- To understand, in aggregate, how the app is used so we can fix problems and improve it
- To show ads to free-plan users inside the app, and to add free time earned by watching an optional rewarded ad
Apart from showing ads on the free plan as described above, we do not use your data for advertising or profiling, and we never sell it.
6. Data retention
- Account data is kept until you delete your account.
- Connection and usage records are kept only as long as needed to enforce plan limits and operate the service, and are deleted with your account.
- Email verification codes expire after 10 minutes.
- Backups are overwritten on a rolling basis, generally within 7 days.
7. How we protect your data
All data between the app and our servers is encrypted in transit using HTTPS/TLS. VPN traffic is encrypted using the WireGuard protocol. Passwords are stored as salted hashes. Access to our servers is restricted to authorized staff. No system is perfectly secure, but we work to protect your information.
8. Your rights and account deletion
You can ask us to access, correct, export, or delete your personal data. To delete your account and all associated data, email [email protected] from the email address on your account with the subject “Account deletion request”. We will delete your account within 30 days. Full details are on our account deletion page.
Deleting your account does not cancel an active subscription. Please cancel it in Google Play or the App Store first. Uninstalling the app removes all data stored on your device.
Ad choices. In the European Economic Area, the UK and Switzerland you can change or withdraw your ad consent at any time in the app under Profile → Ad privacy choices. On any Android device you can reset or delete your advertising ID, or opt out of personalised ads, in Settings → Google → Ads. Premium users never receive ad requests.
Depending on where you live (for example, in the EU, UK, or California), you may have additional rights under laws such as the GDPR or CCPA, including the right to complain to a data protection authority.
9. Children
The Services are not directed at children under 13 (or the minimum age in your country). We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
10. International transfers
Our servers are located in several countries, including the United States. By using the Services, your data may be processed outside your country of residence, with appropriate safeguards where required by law.
11. Changes to this policy
We may update this policy from time to time. We will change the “Last updated” date above and, for significant changes, notify you in the app or by email.
12. Contact us
If you have questions about this policy or your data, email us at [email protected].