1. Data Controller
The OnayVPN mobile app and the onayvpn.com service are provided by Webmetri Digital Solutions Ltd. For any request about your personal data, write to info@webmetri.com.
2. What We Never Log
None of the following is written to any database, log file or statistic:
- Websites, domains and URLs you visit, or the apps you use
- Destination IP addresses you connect to
- Your DNS queries
- The content of your traffic, or packet sizes and timing
- Per-user data volume (the download/upload counters in the app are calculated on your device only and never sent to us)
- Any link between your real IP address and the time of a VPN connection
Your VPN tunnel does not pass through our application servers; it goes straight to the VPN infrastructure servers. Our servers only manage your account, your subscription and your tunnel configuration.
3. Data We Process
a) Account
On first launch the app creates an anonymous account for you automatically (Firebase Authentication); we do not ask for your name, email or phone number. If you choose to link your account with Google, Apple or email, the email address and display name provided by that service are stored. If you sign in with Google, your profile photo is loaded from Google directly to your device for display only; it is not stored on our servers.
b) Devices
To enforce the device limit and deliver notifications to the right device, we keep per device: a random installation ID generated by the app, platform (iOS/Android), device model, OS and app version, device language and region, first and last seen times and, if you allow notifications, a push token. The installation ID is not an advertising ID; platform identifiers such as IDFA/GAID or ANDROID_ID are not read, and it cannot be used to track you across apps.
c) Connection sessions (no content)
When you connect, we record only: your account, your device, the server you chose, the protocol (WireGuard / OpenVPN / VLESS), start and end time and the end reason (e.g. "user disconnected", "network lost"). Your IP address, traffic volume or content are not part of this record. These records exist to enforce the device limit, provide support and troubleshoot connection issues, and are deleted automatically after 7 days. The hourly statistics we keep to monitor server quality (e.g. how many connections a server received) cannot be linked to any user.
d) Sign-in and consent records (IP and country)
When you sign in, sign out, link an account or give consent to the data use disclosure, we record your IP address, the country resolved from it, platform and app version. The country is resolved with a local database on our server (MaxMind GeoLite2); your IP is not sent to any external service for this. These records are used only for account security (e.g. suspected account takeover), abuse prevention and reviewing refund requests. None of them relate to your VPN connections.
e) Subscription and payment
Subscriptions are sold only through the Apple App Store and Google Play. We never see or store your card or payment details. We process the following, received from the stores and from our subscription infrastructure RevenueCat: purchased plan, store, period start/end dates, renewal and cancellation status, store transaction IDs, purchase country, currency and amount, and refund information.
f) VPN account
When you subscribe, an account is created for you on the VPN infrastructure with a randomly generated username and password; your name, email or any other identity information is not passed to the VPN infrastructure provider. Your WireGuard private key and VPN password are stored encrypted with AES-256-GCM on our servers, and in the iOS Keychain / Android Keystore on your device.
g) Support requests
If you open a support request, the subject, category and messages you write are stored. You may optionally attach the server and protocol you had trouble with; this is off by default. No diagnostic data (IP, connection logs, traffic) is attached automatically. If you accidentally write something sensitive such as a password or card number, you can ask support to delete the message; its text is then removed from our database as well.
h) Notifications
Your notification preferences (subscription alerts, announcements, support replies) and the messages in your in-app inbox are stored. Notifications are limited to subscription status, account and support topics; VPN usage information such as which server you connected to, connection duration or your IP address never appears in a notification.
i) App integrity and abuse prevention
We use Firebase App Check to verify that the service is used only from the genuine OnayVPN app. App Check obtains an attestation from your device's platform service (Google Play Integrity on Android, Apple App Attest on iOS) that the app has not been modified. This does not include your identity or usage. Technical request headers (app version, platform) are checked for the same purpose.
4. Purposes and Legal Bases
- Providing the service (account, VPN account, tunnel configuration, device limit): performance of a contract.
- Subscription and payment management, billing records: performance of a contract and legal obligations (tax and accounting law).
- Account security, prevention of abuse and fraud, reviewing refund requests: legitimate interests.
- Answering support requests: performance of a contract and your request.
- Sending service notifications: performance of a contract; you can turn off announcements and subscription alerts in settings.
We do not use your data for marketing, profiling, ad targeting or automated decision-making.
5. Service Providers We Share Data With
We do not sell or rent your data or share it with ad networks. To provide the service we work only with the providers below, and only with the data listed:
| Provider | Purpose | Data |
|---|---|---|
| Google Firebase (Authentication, Cloud Messaging, App Check) | Sign-in, push delivery, app attestation | Account ID; email and name if you linked them; push token and notification text |
| RevenueCat | Validating store subscriptions | Random account ID and store purchase information. No email, name or device identifier is sent; RevenueCat's device identifier collection and diagnostics are disabled. |
| Apple App Store / Google Play | Payments, subscriptions and refunds | Purchase information. When you request a refund, only whether the service was delivered and how much of the subscription period has elapsed may be reported so the store can assess it; sites visited, traffic, IP or server choice are never reported. |
| VPN infrastructure provider | Operating the VPN servers | A VPN account created with a random username and password. No identity information is passed. When you connect, your encrypted tunnel traffic and connecting IP reach these servers because the tunnel technically requires it. |
| Cloudflare (1.1.1.1) | In-tunnel DNS resolution for the VLESS protocol only | DNS queries made while connected over VLESS. With WireGuard and OpenVPN, DNS is resolved by the VPN server. |
| Hetzner Online GmbH (Germany) | Hosting our application servers | The data described in this policy that is kept on our servers |
Some of these providers may process data outside the European Union and Türkiye (e.g. in the USA). Transfers are limited to the minimum data needed to provide the service and made with the safeguards required by applicable law. We do not disclose data to any authority except in response to lawful and binding requests; traffic data we do not keep can never be disclosed.
6. Retention
| Data | Retention |
|---|---|
| Connection session records | 7 days, then deleted automatically |
| Tunnel configuration cache (server side, encrypted) | 24 hours |
| Read in-app notifications | 90 days (unread ones until you read them) |
| Account, devices, sign-in/consent records, support requests, notification preferences | Until your account is deleted |
| Subscription, transaction and store notification records | Also after account deletion, for the legally required period (tax/accounting and refund disputes) |
7. Deleting Your Account
You can delete your account at any time in the app: Account → Delete account. Deletion is carried out automatically 7 days later so you can change your mind; during that time you can cancel the request from the same screen. If you cannot access the app, write to info@webmetri.com. Details: Account deletion.
On deletion, your email address, name, devices, push tokens, sign-in and consent records, connection sessions, support requests, notifications, VPN account and encryption keys are deleted, and your sign-in identity is permanently removed. As required by law, subscription and transaction records are retained in a form that can no longer be linked to you. Deleting your account does not cancel your store subscription; cancel it separately in App Store or Google Play settings.
8. Your Rights
Under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where applicable to you, the EU General Data Protection Regulation (GDPR), you have the right to:
- Know whether your data is processed and request a copy
- Have incomplete or inaccurate data corrected
- Have your data deleted
- Request restriction of, or object to, processing
- Know the third parties your data is transferred to
- Receive your data in a portable format
- Lodge a complaint with the Turkish Personal Data Protection Authority or the data protection authority in your country
Send your requests to info@webmetri.com. For your security we may need to verify that the request comes from the account owner. We respond within 30 days at the latest.
9. Security
All communication between the app and our servers is encrypted with HTTPS. VPN passwords, WireGuard private keys and tunnel configurations are encrypted on our servers with AES-256-GCM and are never returned in plain text in any API response. On your device they are kept only in the operating system's secure storage (Keychain/Keystore). All administrator actions are written to an audit log.
10. Other
Children
OnayVPN is not directed at children under 13 and does not knowingly collect data from them. If you become aware of such a case, contact us and we will delete the account.
Changes
We may update this policy. The current version is always published on this page. If the data we collect or the purposes change, we will update the in-app data use disclosure and ask for your consent again.
Language
This policy is also available in Turkish. In case of any discrepancy, the Turkish version prevails.
Contact
For any privacy question: info@webmetri.com